Model training and login behavior prediction method and device, electronic equipment, storage medium and computer program product

Abstract

The invention discloses a model training and login behavior prediction method and device, electronic equipment, a storage medium and a computer program product. The method comprises the steps that feature extraction is carried out on first data to obtain a first feature value, the first data comprises login behavior sample data corresponding to one or more user roles, and the first feature value comprises behavior features corresponding to one or more user roles; determining a first parameter, and performing elimination related processing on the first feature value by using the first parameter to obtain a second feature value, the first parameter representing an influence degree of a random factor on the first feature value; and training one or more first models by using the second feature value, the one or more first models being used for predicting the to-be-predicted login behavior data, and each first model being associated with one user role. According to the technical scheme provided by the invention, the influence of the random factors on the behavior characteristics is analyzed, and the characteristics influenced by the random factors are eliminated when the model is constructed, so that the problem of misjudgment of the model is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a model training and login behavior prediction method, device, electronic device, storage medium and computer program product. Background Art

[0002] With the popularization of the Internet and mobile devices, the security issues of user login behavior have become increasingly prominent. Abnormal login behavior usually indicates security risks such as account theft and data leakage. Therefore, real-time monitoring and anomaly detection of user login behavior have become particularly important. At present, machine learning technology has been widely used in the field of anomaly detection; among them, support vector machine, as a semi-supervised learning method, can be applied to anomaly detection tasks.

[0003] However, in complex and changeable login scenarios, related anomaly detection schemes may make incorrect judgments, which will affect the detection accuracy. Summary of the invention

[0004] To solve related technical problems, the embodiments of the present application provide a model training and login behavior prediction method, device, electronic device, storage medium and computer program product.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present application embodiment provides a model training method, including:

[0007] Extracting features from the first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavior features corresponding to the one or more user roles;

[0008] Determine a first parameter, and use the first parameter to perform a correlation elimination process on the first eigenvalue to obtain a second eigenvalue, wherein the first parameter represents the degree of influence of random factors on the first eigenvalue;

[0009] The second feature value is used to train one or more first models, where the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role.

[0010] In the above solution, using the first parameter to perform a related elimination process on the first eigenvalue to obtain a second eigenvalue includes:

[0011] Determine, by using the first parameter, a behavior feature in the first characteristic value that satisfies a first condition, wherein the first condition indicates that the behavior feature changes under the influence of the random factor;

[0012] The determined behavior feature is subjected to a relevant elimination process to obtain the second feature value.

[0013] In the above solution, extracting features from the first data to obtain a first feature value includes:

[0014] Using the first data, obtaining second data, wherein the second data includes discrete types of login behavior sample data corresponding to the one or more user roles;

[0015] Feature extraction is performed on the second data based on a statistical method to obtain the first feature value.

[0016] In the above solution, the step of extracting features from the second data based on a statistical method to obtain the first feature value includes:

[0017] In the case where the discrete type login behavior sample data includes one or more of the login time, login method and login device, feature extraction is performed on one or more of the login time, login method and login device based on a statistical method to obtain a third feature value, wherein the third feature value includes the common behavior features corresponding to the one or more user roles;

[0018] In the case where the discrete type login behavior sample data includes one or more of the login frequency, the login behavior sequence, and the login time distribution, feature extraction is performed on one or more of the login frequency, the login behavior sequence, and the login time distribution based on a statistical method to obtain a fourth feature value, wherein the fourth feature value includes a specific behavior feature of one or more users corresponding to the one or more user roles;

[0019] The first eigenvalue is obtained by using the third eigenvalue and the fourth eigenvalue.

[0020] In the above solution, extracting features from the first data to obtain a first feature value includes:

[0021] Using the first data, obtaining third data, wherein the third data includes login behavior sample data about time corresponding to the one or more user roles;

[0022] Feature extraction is performed on the third data based on a sliding window to obtain the first feature value.

[0023] In the above scheme, the method further comprises:

[0024] Acquire fourth data, where the fourth data includes login behavior sample data of one or more users;

[0025] Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering correlation processing on the fourth data to obtain the first data.

[0026] In the above solution, determining the user roles corresponding to the one or more users includes:

[0027] Acquire fifth data, wherein the fifth data includes role-related data of the one or more users, wherein the role-related data includes one or more of account type, industry data, and position data;

[0028] The user roles corresponding to the one or more users are determined using the fifth data.

[0029] The present application also provides a login behavior prediction method, including:

[0030] Acquire login behavior data to be predicted that is associated with the first user;

[0031] Determine a first user role corresponding to the first user, and perform feature extraction on the login behavior data to be predicted to obtain a fifth feature value, where the fifth feature value includes a behavior feature of the first user;

[0032] The login behavior data to be predicted is predicted using the fifth characteristic value and a first model corresponding to the first user role to obtain a prediction result, wherein the first model is obtained according to the method according to any one of claims 1 to 7.

[0033] The present application also provides a model training device, including:

[0034] A first extraction unit, configured to perform feature extraction on first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavior features corresponding to the one or more user roles;

[0035] a processing unit, configured to determine a first parameter, and use the first parameter to perform a correlation elimination process on the first eigenvalue to obtain a second eigenvalue, wherein the first parameter represents the degree of influence of a random factor on the first eigenvalue;

[0036] A training unit is used to train one or more first models using the second feature value, wherein the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role.

[0037] The embodiment of the present application also provides a login behavior prediction device, including:

[0038] An acquisition unit, configured to acquire login behavior data to be predicted and associated with the first user;

[0039] a second extraction unit, configured to determine a first user role corresponding to the first user, and perform feature extraction on the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value includes a behavior feature of the first user;

[0040] A prediction unit is used to predict the login behavior data to be predicted by using the fifth characteristic value and the first model corresponding to the first user role to obtain a prediction result, wherein the first model is obtained according to any of the above-mentioned model training methods.

[0041] The embodiment of the present application also provides an electronic device, comprising: a processor and a communication interface; wherein:

[0042] The processor is used to extract features from first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavior features corresponding to the one or more user roles; determine a first parameter, and use the first parameter to perform elimination-related processing on the first feature value to obtain a second feature value, wherein the first parameter represents the degree of influence of random factors on the first feature value; use the second feature value to train one or more first models, wherein the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role;

[0043] or,

[0044] The processor is used to obtain the login behavior data to be predicted associated with the first user through the communication interface; determine the first user role corresponding to the first user, and perform feature extraction on the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value includes the behavior characteristics of the first user; use the fifth feature value and the first model corresponding to the first user role to predict the login behavior data to obtain a prediction result, wherein the first model is obtained according to any of the above-mentioned model training methods.

[0045] The present application also provides an electronic device, including: a processor and a memory for storing a computer program that can be run on the processor.

[0046] Among them, when the processor is used to run the computer program, it implements the steps of any of the above-mentioned model training methods, or implements the steps of any of the above-mentioned login behavior prediction methods.

[0047] An embodiment of the present application also provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned model training methods are implemented, or the steps of any of the above-mentioned login behavior prediction methods are implemented.

[0048] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any of the above-mentioned model training methods, or implements the steps of any of the above-mentioned login behavior prediction methods.

[0049] The model training and login behavior prediction method, device, electronic device, storage medium and computer program product provided by the embodiment of the present application, wherein the model training method includes: extracting features from the first data to obtain a first feature value, the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes the behavior characteristics corresponding to the one or more user roles; determining a first parameter, and using the first parameter to eliminate the first feature value to obtain a second feature value, the first parameter characterizes the degree of influence of random factors on the first feature value; using the second feature value, training one or more first models, the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role. The technical solution provided by the embodiment of the present application analyzes the influence of unconventional factors on the behavior characteristics of the user role dimension, so that when constructing the input parameters of the model training, the behavior characteristics affected by unconventional factors are eliminated according to the analysis results, so that the model can better learn the difference between regular login behavior and abnormal login behavior, so that the prediction accuracy of the login behavior using the model can be effectively improved, and the problem of incorrect prediction of the model due to random unconventional factors is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A flowchart of a model training method according to an embodiment of the present application;

[0051] Figure 2 A flowchart of a login behavior prediction method according to an embodiment of the present application;

[0052] Figure 3 A schematic diagram of a prediction system for the application example of this application;

[0053] Figure 4 A flowchart of a model training process for an application example of this application;

[0054] Figure 5 A flowchart of a method for constructing a feature vector in an application example of this application;

[0055] Figure 6 A flowchart of anomaly detection for an example of application of this application;

[0056] Figure 7 This is a schematic diagram of the structure of the model training device in the embodiment of the present application;

[0057] Figure 8 This is a schematic diagram of the structure of a login behavior prediction device according to an embodiment of the present application;

[0058] Fig. 9 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0059] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0060] In the related art, an anomaly detection scheme detects user login behavior based on fixed rules or statistical models. However, in the face of complex and changeable user behavior, the above scheme does not consider the potential impact of random factors on user behavior, and is prone to omissions or misreporting, which will have a great negative impact on user experience. For example, when a user suddenly goes on a business trip to another city one day, the above scheme may trigger an erroneous report of abnormal login behavior. For another example, if the attacker is in the same place as the user's usual login location, the above scheme will result in omissions of abnormal login behavior. For another example, if a user is logged in all day, the user's login behavior cannot be protected from the time dimension.

[0061] Another anomaly detection solution is to detect user login behavior through machine learning. In the above solution, since the extraction of user behavior features does not take into account the role of the account, the same login behavior may have different meanings for users with different roles. Therefore, it may not be possible to effectively distinguish between normal and abnormal login behaviors; that is, different roles have an impact on user login behavior. For example, the login method, login time, and login behavior sequence adopted by the user will be affected by the characteristics of the role and have a certain characteristic distribution. In addition, the above solution does not consider the potential impact of random factors on user behavior, and is prone to omissions or misreporting.

[0062] In summary, in complex and changeable user login scenarios, related anomaly detection solutions cannot accurately distinguish abnormal user login behaviors, and there are false positives and false negatives.

[0063] Based on this, in various embodiments of the present application, an analysis of the impact of non-standard factors on the characteristic values ​​of login behavior is introduced, that is, the impact of non-standard factors on the characteristic values ​​is analyzed through multivariate linear regression, so that in the process of constructing the input parameters of the training model, the characteristic values ​​affected by non-standard factors are eliminated according to the analysis results, thereby solving the problem of misjudgment and wrong judgment of model prediction caused by the random occurrence of non-standard factors.

[0064] The present application embodiment provides a model training method, which is applied to electronic devices, such as Figure 1 As shown, the method includes:

[0065] Step 101: extracting features from first data to obtain first feature values, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature values ​​include behavior features corresponding to the one or more user roles;

[0066] Step 102: determining a first parameter, and using the first parameter to perform a correlation elimination process on the first eigenvalue to obtain a second eigenvalue, wherein the first parameter represents the degree of influence of random factors on the first eigenvalue;

[0067] Step 103: Using the second feature value, train one or more first models, where the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role.

[0068] In actual application, the electronic device may include a device capable of executing steps 101 to 103, such as a server, a laptop computer, a tablet computer, or a desktop computer.

[0069] In actual application, before step 101, the electronic device needs to obtain the first data.

[0070] Based on this, in one embodiment, the method may further include:

[0071] Acquire fourth data, where the fourth data includes login behavior sample data of one or more users;

[0072] Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering correlation processing on the fourth data to obtain the first data.

[0073] Among them, the fourth data can be understood as the login behavior sample data of the one or more users each time they log in. The login behavior sample data can include login time, login location (such as IP address or geographic location), login device type (such as computer (PC), mobile phone, tablet, etc.), login method, login frequency, login duration, behavior sequence before login (can also be understood as the content that the user pays attention to or visits before login, such as the page Uniform Resource Locator (URL)), behavior sequence during login process (can also be understood as the content that the user pays attention to or visits during the login process, such as the page URL), and one or more items (i.e. at least one item) in the login behavior time distribution.

[0074] In actual application, the electronic device can obtain the fourth data by means of page embedding and back-end log collection.

[0075] Here, each user may have personal behaviors and operating habits, which leads to certain differences in login behaviors. However, users with the same user role have similarities in some login behaviors due to the nature of their work, behavioral norms and other requirements. Therefore, the electronic device can classify the fourth data according to user role categories to obtain login behavior sample data in the user role dimension, i.e., the first data.

[0076] In actual application, in order to determine the user roles corresponding to the one or more users, the electronic device may collect relevant data associated with the roles.

[0077] Specifically, in one embodiment, determining the user roles corresponding to the one or more users includes:

[0078] Acquire fifth data, wherein the fifth data includes role-related data of the one or more users, wherein the role-related data includes one or more of account type, industry data, and position data;

[0079] The user roles corresponding to the one or more users are determined using the fifth data.

[0080] In actual application, the account type represents the account type registered by the user, such as Internet users, government and enterprise users, customer managers, etc.; the industry data represents the industry in which the user is engaged; the position data represents the position held by the user in the company or organization, such as operation and maintenance personnel, technical personnel, product managers, customer managers or management personnel, etc.

[0081] In actual application, the electronic device can obtain the fifth data through page embedding and back-end log collection; when the role-related data includes account type, industry data and position data, the electronic device can integrate the account type, industry data and position data to determine the one or more user roles (that is, the user role can be expressed as account type + industry data + position data).

[0082] Here, after determining the one or more user roles, the electronic device can perform clustering-related processing on the fourth data with the determined user roles as the division dimension to obtain the first data. The first data can be understood as a data set with user roles as the dimension. For example, assuming that there are n user roles (which can also be understood as the total number of data sets), the first data can be expressed as: A = {a1, a2, ..., a n}, a n Represented as the data set corresponding to the nth user role.

[0083] In actual application, before extracting features from the first data, the electronic device may also perform preprocessing operations such as cleaning, deduplication and formatting on the first data to handle missing values, abnormal values ​​and duplicate values, thereby ensuring the quality and consistency of the data.

[0084] In actual application, in order to extract meaningful feature values ​​that can represent the user login behavior from the first data, the electronic device can use different extraction algorithms to extract features according to data characteristics; among them, for discrete data, statistical methods can be used for feature extraction.

[0085] Specifically, in one embodiment, extracting features from the first data to obtain a first feature value includes:

[0086] Using the first data, obtaining second data, wherein the second data includes discrete types of login behavior sample data corresponding to the one or more user roles;

[0087] Feature extraction is performed on the second data based on a statistical method to obtain the first feature value.

[0088] Among them, discrete type login behavior sample data can be understood as data with discrete and independent data characteristics. Discrete type login behavior sample data can include one or more of login time, login device type, login method and login location, which is not limited in the embodiments of the present application.

[0089] In actual application, in the process of extracting features from the second data, the electronic device can focus on the individual characteristics and common characteristics of the data, so as to retain the common behavior characteristics associated with the user role in the extracted behavior characteristics, and also retain the individual behavior characteristics associated with the user, thereby more comprehensively capturing the patterns and regularities of the user's login behavior.

[0090] Specifically, in one embodiment, extracting features from the second data based on a statistical method to obtain the first feature value includes:

[0091] In the case where the discrete type login behavior sample data includes one or more of the login time, login method and login device, feature extraction is performed on one or more of the login time, login method and login device based on a statistical method to obtain a third feature value, wherein the third feature value includes the common behavior features corresponding to the one or more user roles;

[0092] In the case where the discrete type login behavior sample data includes one or more of the login frequency, the login behavior sequence, and the login time distribution, feature extraction is performed on one or more of the login frequency, the login behavior sequence, and the login time distribution based on a statistical method to obtain a fourth feature value, wherein the fourth feature value includes a specific behavior feature of one or more users corresponding to the one or more user roles;

[0093] The first eigenvalue is obtained by using the third eigenvalue and the fourth eigenvalue.

[0094] In actual application, since the user's login time, login method and login device are intrinsically related to the user role, the electronic device can perform data analysis and feature extraction based on statistical methods based on the data set of the user role dimension, so as to obtain the third eigenvalue; wherein the third eigenvalue can be understood as the common behavioral characteristics of each user role.

[0095] For example, in the scenario where an account manager places an order on behalf of a customer, the account manager is generally accustomed to using the simplest login method to reduce the communication process with the customer. At the same time, since placing an order on behalf of a customer is usually a work behavior, the login device used is basically an office computer and the login time is basically during working hours. In addition, the login behavior of operation and maintenance personnel is usually strongly correlated with platform failures or daily resource maintenance, while the login behavior of management personnel is strongly correlated with key activities.

[0096] In addition, since some user data is highly personalized and common features are difficult to extract, the electronic device can use the user as a dimension to perform data analysis and feature extraction on one or more of the login frequency, login behavior sequence, and login time distribution, thereby obtaining the fourth eigenvalue; wherein the fourth eigenvalue can be understood as the personalized behavior characteristics of the user, which is mainly used to predict the user's individual login behavior.

[0097] In the embodiment of the present application, by extracting the common features and individual features of users respectively, it is beneficial to adjust the weights of the subsequent mixed feature values ​​so that the model can better learn the basic patterns and rules of the login behaviors of users of the same type.

[0098] In actual application, for data with time series characteristics, the electronic device can use sliding window technology to extract features.

[0099] Specifically, in one embodiment, extracting features from the first data to obtain a first feature value includes:

[0100] Using the first data, obtaining third data, wherein the third data includes login behavior sample data about time corresponding to the one or more user roles;

[0101] Feature extraction is performed on the third data based on a sliding window to obtain the first feature value.

[0102] The login behavior sample data about time can be understood as data with time series characteristics, which may specifically include one or more of the login frequency, the behavior sequence before login, the behavior sequence during login, and the time distribution of login behavior.

[0103] In actual application, since the login behavior sample data corresponding to different user roles are quite different in time (for example, account managers have a higher login frequency, while managers have a lower login frequency), the electronic device can use the data set of the user role dimension as a unit and perform feature extraction based on the time series analysis method to analyze the changing trends and periodic patterns of the user's login behavior in the time dimension.

[0104] Exemplarily, when the login behavior sample data about time includes the login frequency, the electronic device can calculate the login frequency of the user role within a unit time by using a sliding window; wherein the login frequency within a unit time can be calculated by using the following formula:

[0105]

[0106] in, It is represented as the login frequency of the data set corresponding to user role A at time t, εt is represented as the correction parameter at time t, c is represented as a constant parameter, It is expressed as the login frequency at the previous time associated with time t.

[0107] In an embodiment of the present application, a corresponding extraction method is selected according to the behavioral characteristic attributes of the user role to obtain multi-dimensional behavioral characteristics. In this way, the patterns and regularities of the user's login behavior can be more comprehensively captured, providing more effective feature input for subsequent model training.

[0108] In actual application, in step 102, it is taken into account that random factors (also called unconventional factors or non-standard factors) have a greater impact on the login behavior of user roles. For example, the login behavior of technicians is associated with the system deployment resource change cycle, the login behavior of managers is correlated with activities such as business trips and meetings, the login behavior of account managers is affected by marketing activities, and the login behavior of operation and maintenance personnel is affected by platform failures or daily source maintenance. Therefore, the electronic device can determine the first parameter through a multivariate linear regression model algorithm, so that the influence relationship between changes in user login behavior and random factors can be deeply explored; wherein, the first parameter can be called an influencing factor, an influencing index or a correlation coefficient, etc., and the embodiment of the present application is not limited to this, as long as its function is achieved.

[0109] Here, in actual application, the electronic device can obtain the sixth data through page embedding and back-end log collection, and the sixth data includes login data associated with random factors (which can also be understood as data affecting user login behavior), such as activity distribution, failure time distribution or resource operation time distribution, etc., which is not limited to the embodiment of the present application; the first parameter is calculated using the sixth data and the first eigenvalue, and the first parameter can reflect the degree to which the first eigenvalue is affected by the activity distribution, failure time distribution or resource operation time distribution.

[0110] For example, taking the behavior feature A corresponding to the user role A as an example, the electronic device may perform normalization processing on the behavior feature A to obtain the normalized behavior feature A (which may be expressed as x min Represented as the minimum value in the behavior feature A, x max The first parameter can be determined by the following formula for the normalized behavior feature A:

[0111] y i =β0+β1x i1 +β2x i2 +...+β k x ik +η i (2)

[0112] Among them, y i It is represented as the dependent variable of the i-th observed feature in the behavioral feature A, x ik It is represented as the kth independent variable of the i-th observed feature (such as failure time distribution), and the value of k can be 3; β0 is represented as the intercept term; β k Expressed as the regression coefficient of the kth independent variable; η i It is represented as an error term.

[0113] According to formula (2), the electronic device can use the canonical equation to calculate β k The value of is the first parameter; since the behavior feature A is normalized, β k The size of the numerical value can directly evaluate the influence of the independent variable on the dependent variable, that is, the influence of random factors on behavioral characteristics.

[0114] In actual application, due to the randomness of random factors, the electronic device can eliminate (also understood as release) the behavioral features that are highly correlated with the first parameter to avoid random factors affecting the model's judgment of user login behavior.

[0115] Specifically, in one embodiment, using the first parameter to perform a related elimination process on the first eigenvalue to obtain a second eigenvalue includes:

[0116] Determine, by using the first parameter, a behavior feature in the first characteristic value that satisfies a first condition, wherein the first condition indicates that the behavior feature changes under the influence of the random factor;

[0117] The determined behavior feature is subjected to a relevant elimination process to obtain the second feature value.

[0118] Here, since the first eigenvalue includes common behavioral characteristics associated with the user role, specific behavioral characteristics, and behavioral characteristics affected by the random factors, the electronic device can use relevant processing methods (such as Z-score) to normalize the first eigenvalue, that is, linearly transform the behavioral characteristics in the first eigenvalue to a specific range (specifically [0,1]), thereby eliminating the dimensional differences between different behavioral characteristics.

[0119] In actual application, after determining the behavioral features that are highly correlated with the first parameter, the electronic device can eliminate the behavioral features affected by the random factors from the first eigenvalue after normalization, thereby obtaining the second eigenvalue; wherein, when the behavioral features affected by the random factors include behavioral features corresponding to login time, login frequency, login device, login method and login address, different types of behavioral features can be eliminated separately.

[0120] In actual application, for the second characteristic value, the electronic device can design initialization weights of different types of behavior characteristics based on the sensitivity of the user role to the behavior characteristics; and perform weighted combination of different types of behavior characteristics based on the initialization weights, so as to construct a characteristic vector that can characterize the common behavior of users with the same role to the greatest extent; wherein the characteristic vector can be expressed by the following formula: x norm,T It is represented by the normalized behavior characteristics after removing the relevant processing of the behavior characteristics of the login time. It is represented as the normalized behavior feature after removing the relevant processing of the behavior feature of login frequency, x norm,device It is represented by the normalized behavior characteristics after removing the relevant processing of the behavior characteristics of the login device, x norm,loading_type It is represented as the normalized behavior feature after removing the relevant processing of the behavior feature of the login method, x norm,ip It represents the normalized behavior feature after removing the relevant processing of the behavior feature of the login address, w represents the initialization weight, w1=0.1, w2=0.2, w3=0.3, w4=0.3, w5=0.1.

[0121] In actual application, in step 103, the electronic device can train the one or more first models using the constructed feature vector; that is, using the feature vectors corresponding to different user roles, the electronic device can train different first models respectively, so that the login behavior characteristics of different user roles can be better learned, thereby improving the model's pertinence and prediction accuracy; wherein, a class of support vector machine (SVM) algorithms can be used for training, that is, the first model can include an SVM model.

[0122] Here, in the case where the first model includes an SVM model, the selection of the kernel function has an important influence on the performance of the first model, and can map data to a higher-dimensional space, so that the originally linearly inseparable problem becomes separable. Therefore, the electronic device can select a polynomial kernel function to calculate the similarity between two features, thereby supporting the nonlinear classification capability of the SVM model; wherein the polynomial kernel function can be expressed by the following formula:

[0123] K(mathbfx,y)=(γx T y+r) d (3)

[0124] Among them, x and y represent two feature vectors to be input; γ represents the coefficient of the kernel function, which is used to control the scaling of the kernel function; r represents the constant term, which is used to control the offset of the kernel function; d represents the order of the polynomial, which is related to the complexity of the nonlinear mapping.

[0125] In actual application, during the process of training the one or more first models, the electronic device can use the kernel function to calculate the kernel matrix between the feature vectors; use the kernel matrix to determine the decision boundary that maximizes the interval, and use the decision boundary to determine the support vector (which can also be understood as the sample point in the decision boundary); adjust the parameters of the one or more first models and the weights when constructing the feature vectors to optimize the performance of the first model and determine the final decision function; wherein, during the training process, the weights can be optimized and the parameters can be adjusted by gradient descent, regularization, grid search, etc., so that the first model has the best fit for the feature vectors used for model training, and performs well on the feature vectors used for verification to avoid overfitting.

[0126] Here, after the training is completed, the electronic device can obtain a plurality of first models classified according to user roles; wherein the relationship between the user role and the first model can be expressed as R={Role i ,M i},i=1,2,...,n,Role i Represented as the i-th user role, M i It is represented as the first model corresponding to the i-th user role, and n is represented as the total number of user roles.

[0127] In addition, for the trained first model, the electronic device can periodically evaluate the performance of the first model and update the first model as needed to adapt to changes in data distribution or changes in business needs. At the same time, the electronic device can also track user feedback in real time to confirm the prediction accuracy of the first model; if there is a problem with the model prediction accuracy, the electronic device can analyze the feedback data and readjust the algorithm parameters to retrain the model, thereby outputting a new first model.

[0128] Based on the above model training method, the present application embodiment also provides a login behavior prediction method, which is applied to electronic devices, such as Figure 2 As shown, the following steps are included:

[0129] Step 201: Acquire login behavior data to be predicted that is associated with a first user;

[0130] Step 202: determining a first user role corresponding to the first user, and performing feature extraction on the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value includes a behavior feature of the first user;

[0131] Step 203: Use the fifth characteristic value and the first model corresponding to the first user role to predict the login behavior data to be predicted to obtain a prediction result, wherein the first model is obtained according to the model training method provided in an embodiment of the present application.

[0132] In actual application, in step 201, when the first user performs a login operation, the electronic device can obtain the login behavior data to be predicted associated with the first user by means of page embedding and back-end log collection; wherein the login behavior data to be predicted can include one or more of role-related data, resources accessed before login, resources accessed during login, login time, login device, login method and login address.

[0133] Here, using the role-related data, the electronic device can determine the first user role; extract the features of the resources accessed before login, the resources accessed during login, the login time, the login device, the login method and the login address to obtain the fifth feature value, and normalize the fifth feature value to obtain the feature vector to be predicted. Then, by inputting the feature vector to be predicted into the first model corresponding to the first user role, the first model can predict the feature vector to be predicted according to the decision function and the first threshold value to determine whether the login behavior of the first user is normal login or abnormal login, and the value of the first threshold value can be set as needed; when the decision function value corresponding to the feature vector to be predicted is greater than or equal to the first threshold value, it means that the login behavior of the first user is normal behavior; when the decision function value corresponding to the feature vector to be predicted is less than the first threshold value, it means that the login behavior of the first user is abnormal behavior, at this time, the electronic device can trigger the multi-factor authentication process, that is, the first user is required to perform additional authentication through security methods such as verification code, face recognition, multi-factor authentication (MFA, Multi-factor Authentication) and so on.

[0134] In an embodiment of the present application, for new users (which can also be understood as users logging in for the first time), the login behavior of new users can be predicted through models of similar user roles to achieve effective protection for new users and solve the problem of cold start. In this way, it is possible to avoid the situation where new users cannot be effectively protected due to lack of historical data.

[0135] The model training and login behavior prediction method provided in the embodiment of the present application, wherein the model training method includes: extracting features from the first data to obtain a first feature value, the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes the behavior characteristics corresponding to the one or more user roles; determining a first parameter, and using the first parameter to eliminate related processing on the first feature value to obtain a second feature value, the first parameter characterizes the degree of influence of random factors on the first feature value; using the second feature value, training one or more first models, the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role. The technical solution provided in the embodiment of the present application analyzes the influence of unconventional factors on the behavior characteristics of the user role dimension, so that when constructing the input parameters of the model training, the behavior characteristics affected by unconventional factors are eliminated according to the analysis results, so that the model can better learn the difference between regular login behavior and abnormal login behavior, so that the prediction accuracy of the login behavior using the model can be effectively improved, and the problem of incorrect prediction of the model due to random unconventional factors is solved.

[0136] The present application is described in further detail below in conjunction with application examples.

[0137] In the face of the problem of being unable to accurately distinguish normal from abnormal login behaviors and "cold start" for new users due to ignoring the differences in user roles in complex and changing login scenarios, this application example proposes a login abnormal behavior prediction system based on user role classification, such as Figure 3 As shown, the prediction system may include a data collection module, a data preprocessing module, a feature extraction module, a model training module, a model management module, a prediction module and a response module. Different modules interact with each other through standardized interfaces to ensure the scalability and maintainability of the prediction system.

[0138] The data collection module is used to collect training data samples from multiple dimensions such as user roles, login behaviors, and factors affecting user login behaviors, so as to provide data for the training model. At the same time, the user login data is collected when the user logs in to provide data for login behavior prediction;

[0139] The data preprocessing module is used to clean abnormal data, remove duplicates and format the collected initial data as required, and divide the collected training data samples into multiple data sets according to user roles;

[0140] The feature extraction module is used to extract meaningful feature values ​​that can represent the user's login behavior. Specifically, feature extraction is performed based on corresponding data characteristics (such as discrete features, time series features, etc.) to obtain the behavioral characteristics of users with different roles, and the influence of unconventional factors (such as marketing activities) on the feature values ​​is considered to calculate the correlation coefficient that represents the degree of influence. Based on the correlation coefficient, the extracted feature values ​​affected by unconventional factors are subjected to correlation elimination, and the feature values ​​after eliminating the correlation coefficients are combined using feature weighting to obtain a combined feature value.

[0141] The model training module is used to train the optimal model corresponding to the user role based on the combined feature values ​​according to a specific algorithm;

[0142] The model management module is used to manage trained models and provide a model verification interface to the outside world;

[0143] The prediction module is used to preprocess and extract features of user login data, and input the processed data into the trained model for prediction to determine user behavior;

[0144] The response module is used to initiate the multi-factor authentication process when the model predicts abnormal user behavior.

[0145] Specifically, the process of model training in the above prediction system is as follows: Figure 4 As shown, the following steps are included:

[0146] Step 1: The data collection module collects the user's login sample data (i.e. the fourth data mentioned above), the user role data (i.e. the fifth data mentioned above) and the data affecting the user's login behavior (i.e. the sixth data mentioned above);

[0147] Step 2: The data preprocessing module cleans, removes duplicates and formats the collected data, and classifies and sorts the collected data based on the user role, to obtain data sets corresponding to different user roles (i.e., the first data mentioned above);

[0148] Step 3: The feature extraction module uses different extraction methods according to data characteristics to extract features from data sets corresponding to different user roles to obtain feature values ​​(i.e., the first feature values ​​mentioned above); according to the user roles, the extracted feature values ​​are weighted to construct corresponding feature vectors;

[0149] Specifically, Figure 5As shown, the feature extraction module uses a statistical method to extract features from discrete feature data (i.e., the second data mentioned above) according to the user role to obtain the corresponding feature value (i.e., the third feature value mentioned above); according to the user role, the sliding window technology is used to extract features from the time-series feature data (i.e., the third data mentioned above) to obtain the corresponding feature value (i.e., the fourth feature value mentioned above); according to the user role, the correlation between the feature value and the unconventional factor (i.e., the first parameter mentioned above) is determined through a multivariate regression model, and the feature value and the unconventional factor are input to eliminate the feature value affected by the unconventional factor. Then, based on the assigned weights, the feature values ​​of different types after elimination (i.e., the second feature vector mentioned above) are weighted to obtain the corresponding feature vector.

[0150] It should be noted that in the subsequent training process, the feature extraction module can dynamically adjust the weights through methods such as gradient descent, regularization, and grid search, so that the model fits the training samples optimally and performs well on the verification samples to avoid overfitting.

[0151] Step 4: The model training module uses the constructed feature vector to train a model for predicting user login behavior (ie, the first model mentioned above); wherein each user role corresponds to a model for predicting user login behavior.

[0152] In actual application, the model is used to predict abnormal user login behavior, such as Figure 6 As shown, the following steps are included:

[0153] Step 1: The data collection module collects information related to the user's user role, the resource URLs accessed before and during login, login time, device, etc., combined with the login method selected by the user, source IP, etc.

[0154] Step 2: After the data preprocessing module preprocesses the collected data, it extracts features from the preprocessed data to generate a normalized eigenvalue (i.e., the fifth eigenvalue mentioned above);

[0155] Step 3: The prediction module selects the corresponding model according to the user role corresponding to the user, and inputs the normalized feature value into the selected model to calculate whether the decision function value is higher than the threshold;

[0156] Among them, when the decision function value is higher than or equal to the threshold (that is, the first threshold mentioned above), it means that the local login behavior is a normal login; when the decision function value is lower than the threshold, it means that the local login behavior is an abnormal login. In this case, execute step 4.

[0157] Step 4: The response module starts the multi-factor authentication process to prompt the need to take additional protective measures, such as mobile phone verification code, face recognition or MFA; at the same time, the model is verified through the verification interface provided by the model management module to determine the accuracy of the model prediction.

[0158] Step 5: When there are problems with the model prediction accuracy (which can also be understood as poor model matching), the response module feeds back the model prediction accuracy results to the model training module, so that the model training module can analyze the feedback data, readjust the algorithm parameters, re-train the data, and output a new model set.

[0159] In the application example of this application, since the model training is performed based on the role classification data set, for users logging in for the first time, the model can make predictions based on the behavior of users with similar roles, which can solve the cold start problem.

[0160] In addition, by adopting corresponding feature extraction methods for different characteristic features, the characteristic value of each feature can be extracted to the maximum extent; by adopting feature weighting for all characteristic values ​​and adjusting the weights, the common characteristics of the roles can be amplified, while retaining the influence of individual characteristics on user behavior changes. In other words, when predicting individual behaviors through common characteristics, the differences in individual behaviors can be retained. In this way, the accuracy of model prediction can be improved, and ultimately accurate judgment and timely response to user login behavior can be achieved.

[0161] In order to implement the model training method of the embodiment of the present application, the embodiment of the present application also provides a model training device, which is arranged on an electronic device, such as Figure 7 As shown, the device comprises:

[0162] A first extraction unit 701 is used to extract features from first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavior features corresponding to the one or more user roles;

[0163] The processing unit 702 is used to determine a first parameter, and use the first parameter to perform a correlation elimination process on the first eigenvalue to obtain a second eigenvalue, wherein the first parameter represents the degree of influence of random factors on the first eigenvalue;

[0164] The training unit 703 is used to train one or more first models using the second characteristic value, wherein the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role.

[0165] In one embodiment, the processing unit 702 is configured to:

[0166] Determine, by using the first parameter, a behavior feature in the first characteristic value that satisfies a first condition, wherein the first condition indicates that the behavior feature changes under the influence of the random factor;

[0167] The determined behavior feature is subjected to a relevant elimination process to obtain the second feature value.

[0168] In one embodiment, the first extraction unit 701 is used to:

[0169] Using the first data, obtaining second data, wherein the second data includes discrete types of login behavior sample data corresponding to the one or more user roles;

[0170] Feature extraction is performed on the second data based on a statistical method to obtain the first feature value.

[0171] In one embodiment, the first extraction unit 701 is used to:

[0172] In the case where the discrete type login behavior sample data includes one or more of the login time, login method and login device, feature extraction is performed on one or more of the login time, login method and login device based on a statistical method to obtain a third feature value, wherein the third feature value includes the common behavior features corresponding to the one or more user roles;

[0173] In the case where the discrete type login behavior sample data includes one or more of the login frequency, the login behavior sequence, and the login time distribution, feature extraction is performed on one or more of the login frequency, the login behavior sequence, and the login time distribution based on a statistical method to obtain a fourth feature value, wherein the fourth feature value includes a specific behavior feature of one or more users corresponding to the one or more user roles;

[0174] The first eigenvalue is obtained by using the third eigenvalue and the fourth eigenvalue.

[0175] In one embodiment, the first extraction unit 701 is used to:

[0176] Using the first data, obtaining third data, wherein the third data includes login behavior sample data about time corresponding to the one or more user roles;

[0177] Feature extraction is performed on the third data based on a sliding window to obtain the first feature value.

[0178] In one embodiment, the processing unit 702 is further configured to:

[0179] Acquire fourth data, where the fourth data includes login behavior sample data of one or more users;

[0180] Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering correlation processing on the fourth data to obtain the first data.

[0181] In one embodiment, the processing unit 702 is further configured to:

[0182] Acquire fifth data, wherein the fifth data includes role-related data of the one or more users, wherein the role-related data includes one or more of account type, industry data, and position data;

[0183] The user roles corresponding to the one or more users are determined using the fifth data.

[0184] In actual application, the first extraction unit 701 and the training unit 703 can be implemented by a communication interface in the model training device, and the processing unit 702 can be implemented by a processor in the model training device in combination with the communication interface.

[0185] It should be noted that: the model training device provided in the above embodiment only uses the division of the above program units as an example when performing model training. In actual applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device is divided into different program units to complete all or part of the processing described above. In addition, the model training device provided in the above embodiment and the model training method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0186] In order to implement the login behavior prediction method of the embodiment of the present application, the embodiment of the present application also provides a login behavior prediction device, which is arranged on an electronic device, such as Figure 8 As shown, the device comprises:

[0187] An acquisition unit 801 is used to acquire login behavior data to be predicted associated with a first user;

[0188] A second extraction unit 802 is used to determine a first user role corresponding to the first user, and perform feature extraction on the login behavior data to be predicted to obtain a fifth feature value, where the fifth feature value includes a behavior feature of the first user;

[0189] The prediction unit 803 is used to use the fifth characteristic value and the first model corresponding to the first user role to predict the login behavior data to be predicted and obtain a prediction result. The first model is obtained based on the model training method provided in an embodiment of the present application.

[0190] In actual application, the acquisition unit 801 can be implemented by a communication interface in the login behavior prediction device; the second extraction unit 802 and the prediction unit 803 can be implemented by a processor in the login behavior prediction device.

[0191] It should be noted that: the login behavior prediction device provided in the above embodiment only uses the division of the above program units as an example when performing login behavior prediction. In actual applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device is divided into different program units to complete all or part of the processing described above. In addition, the login behavior prediction device provided in the above embodiment and the login behavior prediction method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0192] Based on the hardware implementation of the above program modules, and in order to implement the method of model training and login behavior prediction in the embodiment of the present application, the embodiment of the present application also provides an electronic device, such as Fig. 9 As shown, the electronic device 900 includes:

[0193] Communication interface 901, capable of interacting with other devices;

[0194] A processor 902, connected to the communication interface 901 to interact with other devices, and configured to execute the method provided by one or more of the above technical solutions when running a computer program;

[0195] A memory 903 , on which the computer program is stored.

[0196] Specifically, in the model training process provided in the embodiment of the present application, the processor 902 is used to:

[0197] Extracting features from the first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavior features corresponding to the one or more user roles;

[0198] Determine a first parameter, and use the first parameter to perform a correlation elimination process on the first eigenvalue to obtain a second eigenvalue, wherein the first parameter represents the degree of influence of random factors on the first eigenvalue;

[0199] Using the second feature value, training one or more first models, the one or more first models are used to predict the login behavior data to be predicted, each first model is associated with a user role;

[0200] In one embodiment, the processor 902 is configured to:

[0201] Determine, by using the first parameter, a behavior feature in the first characteristic value that satisfies a first condition, wherein the first condition indicates that the behavior feature changes under the influence of the random factor;

[0202] The determined behavior feature is subjected to a relevant elimination process to obtain the second feature value.

[0203] In one embodiment, the processor 902 is configured to:

[0204] Using the first data, obtaining second data, wherein the second data includes discrete types of login behavior sample data corresponding to the one or more user roles;

[0205] Feature extraction is performed on the second data based on a statistical method to obtain the first feature value.

[0206] In one embodiment, the processor 902 is configured to:

[0207] In the case where the discrete type login behavior sample data includes one or more of the login time, login method and login device, feature extraction is performed on one or more of the login time, login method and login device based on a statistical method to obtain a third feature value, wherein the third feature value includes the common behavior features corresponding to the one or more user roles;

[0208] In the case where the discrete type login behavior sample data includes one or more of the login frequency, the login behavior sequence, and the login time distribution, feature extraction is performed on one or more of the login frequency, the login behavior sequence, and the login time distribution based on a statistical method to obtain a fourth feature value, wherein the fourth feature value includes a specific behavior feature of one or more users corresponding to the one or more user roles;

[0209] The first eigenvalue is obtained by using the third eigenvalue and the fourth eigenvalue.

[0210] In one embodiment, the processor 902 is configured to:

[0211] Using the first data, obtaining third data, wherein the third data includes login behavior sample data about time corresponding to the one or more user roles;

[0212] Feature extraction is performed on the third data based on a sliding window to obtain the first feature value.

[0213] In one embodiment, the processor 902 is configured to:

[0214] Acquire fourth data through the communication interface 901, where the fourth data includes login behavior sample data of one or more users;

[0215] Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering correlation processing on the fourth data to obtain the first data.

[0216] In one embodiment, the processor 902 is configured to:

[0217] Acquire fifth data through the communication interface 901, the fifth data including role-related data of the one or more users, the role-related data including one or more of account type, industry data and position data;

[0218] The user roles corresponding to the one or more users are determined using the fifth data.

[0219] In the login behavior prediction process provided in the embodiment of the present application, the processor 902 is used to:

[0220] Acquiring login behavior data to be predicted associated with the first user through the communication interface 901;

[0221] Determine a first user role corresponding to the first user, and perform feature extraction on the login behavior data to be predicted to obtain a fifth feature value, where the fifth feature value includes a behavior feature of the first user;

[0222] The login behavior data to be predicted is predicted using the fifth characteristic value and the first model corresponding to the first user role to obtain a prediction result, wherein the first model is obtained based on the model training method provided in an embodiment of the present application.

[0223] It should be noted that the specific processing process of the communication interface 901 and the processor 902 can be understood by referring to the above method.

[0224] Of course, in actual application, the various components in the electronic device 900 are coupled together through the bus system 904. It can be understood that the bus system 904 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 904 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig. 9 Various buses are labeled as bus system 904.

[0225] The memory 903 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device 900. Examples of such data include: any computer program used to operate on the electronic device 900.

[0226] The method disclosed in the above embodiment of the present application can be applied to the processor 902, or implemented by the processor 902. The processor 902 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 902 or an instruction in the form of software. The above-mentioned processor 902 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 902 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 903, and the processor 902 reads the information in the memory 903 and completes the steps of the above method in combination with its hardware.

[0227] In an exemplary embodiment, the electronic device 900 may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0228] It can be understood that the memory (memory 903) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0229] In an exemplary embodiment, the embodiment of the present application further provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, a memory 903 storing a computer program, and the computer program can be executed by a processor 902 of an electronic device 900 to complete the steps of the aforementioned model training method, or to complete the steps of the aforementioned login behavior prediction method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0230] In an exemplary embodiment, the embodiment of the present application also provides a computer program product, including a computer program, which can be executed by the processor 902 of the electronic device 900 to complete the steps of the aforementioned model training method, or complete the steps of the aforementioned login behavior prediction method.

[0231] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0232] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0233] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A model training method, characterized in that: include: Extracting features from the first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavior features corresponding to the one or more user roles; Determine a first parameter, and use the first parameter to perform a correlation elimination process on the first eigenvalue to obtain a second eigenvalue, wherein the first parameter represents the degree of influence of random factors on the first eigenvalue; The second feature value is used to train one or more first models, where the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role.

2. The method according to claim 1, characterized in that The using the first parameter to perform a related elimination process on the first eigenvalue to obtain a second eigenvalue includes: Determine, by using the first parameter, a behavior feature in the first characteristic value that satisfies a first condition, wherein the first condition indicates that the behavior feature changes under the influence of the random factor; The determined behavior feature is subjected to a relevant elimination process to obtain the second feature value.

3. The method according to claim 1, characterized in that The step of extracting features from the first data to obtain a first feature value includes: Using the first data, obtaining second data, wherein the second data includes discrete types of login behavior sample data corresponding to the one or more user roles; Feature extraction is performed on the second data based on a statistical method to obtain the first feature value.

4. The method according to claim 3, characterized in that The extracting features of the second data based on a statistical method to obtain the first feature value includes: In the case where the discrete type login behavior sample data includes one or more of the login time, login method and login device, feature extraction is performed on one or more of the login time, login method and login device based on a statistical method to obtain a third feature value, wherein the third feature value includes the common behavior features corresponding to the one or more user roles; In the case where the discrete type login behavior sample data includes one or more of the login frequency, the login behavior sequence, and the login time distribution, feature extraction is performed on one or more of the login frequency, the login behavior sequence, and the login time distribution based on a statistical method to obtain a fourth feature value, wherein the fourth feature value includes a specific behavior feature of one or more users corresponding to the one or more user roles; The first eigenvalue is obtained by using the third eigenvalue and the fourth eigenvalue.

5. The method according to claim 1, characterized in that The step of extracting features from the first data to obtain a first feature value includes: Using the first data, obtaining third data, wherein the third data includes login behavior sample data about time corresponding to the one or more user roles; Feature extraction is performed on the third data based on a sliding window to obtain the first feature value.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Acquire fourth data, where the fourth data includes login behavior sample data of one or more users; Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering correlation processing on the fourth data to obtain the first data.

7. According to claim 6 The method is characterized in that The determining the user roles corresponding to the one or more users includes: Acquire fifth data, wherein the fifth data includes role-related data of the one or more users, wherein the role-related data includes one or more of account type, industry data, and position data; The user roles corresponding to the one or more users are determined using the fifth data.

8. A login behavior prediction method, characterized in that: include: Acquire login behavior data to be predicted that is associated with the first user; Determine a first user role corresponding to the first user, and perform feature extraction on the login behavior data to be predicted to obtain a fifth feature value, where the fifth feature value includes a behavior feature of the first user; The login behavior data to be predicted is predicted using the fifth characteristic value and a first model corresponding to the first user role to obtain a prediction result, wherein the first model is obtained according to the method according to any one of claims 1 to 7.

9. A model training device, characterized in that: include: A first extraction unit, configured to perform feature extraction on first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavior features corresponding to the one or more user roles; a processing unit, configured to determine a first parameter, and use the first parameter to perform a correlation elimination process on the first eigenvalue to obtain a second eigenvalue, wherein the first parameter represents the degree of influence of a random factor on the first eigenvalue; A training unit is used to train one or more first models using the second feature value, wherein the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role.

10. A login behavior prediction device, characterized in that: include: An acquisition unit, configured to acquire login behavior data to be predicted and associated with the first user; a second extraction unit, configured to determine a first user role corresponding to the first user, and perform feature extraction on the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value includes a behavior feature of the first user; A prediction unit is used to predict the login behavior data to be predicted by using the fifth characteristic value and the first model corresponding to the first user role to obtain a prediction result, wherein the first model is obtained according to the method according to any one of claims 1 to 7.

11. An electronic device, characterized in that: include: Processor and communication interface; wherein, The processor is used to extract features from first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavior features corresponding to the one or more user roles; determine a first parameter, and use the first parameter to perform elimination-related processing on the first feature value to obtain a second feature value, wherein the first parameter represents the degree of influence of random factors on the first feature value; use the second feature value to train one or more first models, wherein the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role; or, The processor is used to obtain the login behavior data to be predicted associated with the first user through the communication interface; determine the first user role corresponding to the first user, and perform feature extraction on the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value includes the behavior characteristics of the first user; use the fifth feature value and the first model corresponding to the first user role to predict the login behavior data to obtain a prediction result, wherein the first model is obtained according to the method described in any one of claims 1 to 7.

12. An electronic device, characterized in that: include: a processor and a memory for storing a computer program capable of being executed on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 7, or implements the steps of the method described in claim 8.

13. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 7, or implements the steps of the method according to claim 8.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 7, or implements the steps of the method according to claim 8.

Images