Model training and login behavior prediction method and device, electronic equipment, storage medium and computer program product

Abstract

This application discloses a model training and login behavior prediction method, apparatus, electronic device, storage medium, and computer program product. The method includes: extracting features from first data to obtain first feature values, the first data containing login behavior sample data corresponding to one or more user roles, and the first feature values ​​containing behavioral features corresponding to one or more user roles; determining first parameters and using the first parameters to perform relevant removal processing on the first feature values ​​to obtain second feature values, the first parameters representing the degree of influence of random factors on the first feature values; and training one or more first models using the second feature values, the one or more first models being used to predict login behavior data to be predicted, each first model being associated with a user role. The technical solution provided by this application analyzes the influence of random factors on behavioral features and removes features affected by random factors when constructing the model, thereby solving the problem of model misjudgment.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a model training and login behavior prediction method, device, electronic device, storage medium and computer program product. Background Technology

[0002] With the widespread adoption of the internet and mobile devices, the security of user login behavior has become increasingly prominent. Abnormal login behavior often indicates security risks such as account theft and data breaches; therefore, real-time monitoring and anomaly detection of user login behavior have become crucial. Currently, machine learning techniques are widely used in the field of anomaly detection; among them, support vector machines, as a semi-supervised learning method, are suitable for anomaly detection tasks.

[0003] However, in complex and ever-changing login scenarios, the relevant anomaly detection solutions may make incorrect judgments, which may affect the detection accuracy. Summary of the Invention

[0004] To address the related technical issues, embodiments of this application provide a model training and login behavior prediction method, apparatus, electronic device, storage medium, and computer program product.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a model training method, including:

[0007] Feature extraction is performed on the first data to obtain a first feature value. The first data contains login behavior sample data corresponding to one or more user roles, and the first feature value contains behavioral features corresponding to the one or more user roles.

[0008] A first parameter is determined, and the first parameter is used to remove related information from the first feature value to obtain a second feature value. The first parameter represents the degree of influence of random factors on the first feature value.

[0009] Using the second feature value, one or more first models are trained, which are used to predict login behavior data to be predicted, and each first model is associated with a user role.

[0010] In the above scheme, the step of using the first parameter to perform relevant removal processing on the first feature value to obtain the second feature value includes:

[0011] Using the first parameter, determine the behavioral features among the first feature values ​​that satisfy the first condition, where the first condition represents the change of the behavioral features under the influence of the random factor;

[0012] The determined behavioral characteristics are subjected to relevant removal processing to obtain the second feature value.

[0013] In the above scheme, the step of extracting features from the first data to obtain the first feature value includes:

[0014] Using the first data, second data is obtained, which includes sample data of discrete types of login behavior corresponding to the one or more user roles;

[0015] The first feature value is obtained by extracting features from the second data using statistical methods.

[0016] In the above scheme, the step of extracting features from the second data using statistical methods to obtain the first feature value includes:

[0017] In the case that the discrete login behavior sample data includes one or more of login time, login method and login device, the third feature value is obtained by extracting features from one or more of login time, login method and login device based on statistical methods. The third feature value includes the common behavioral features corresponding to the one or more user roles.

[0018] When discrete login behavior sample data contains one or more of login frequency, login behavior sequence and login time distribution, feature extraction is performed on one or more of login frequency, login behavior sequence and login time distribution based on statistical methods to obtain a fourth feature value. The fourth feature value contains the specific behavioral characteristics of one or more users corresponding to one or more user roles.

[0019] The first feature value is obtained by using the third feature value and the fourth feature value.

[0020] In the above scheme, the step of extracting features from the first data to obtain the first feature value includes:

[0021] Using the first data, third data is obtained, which includes time-related login behavior sample data corresponding to the one or more user roles;

[0022] The first feature value is obtained by extracting features from the third data based on a sliding window.

[0023] The method in the above scheme further includes:

[0024] Obtain fourth data, which includes login behavior sample data of one or more users;

[0025] Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering related processing on the fourth data to obtain the first data.

[0026] In the above scheme, determining the user role corresponding to the one or more users includes:

[0027] Obtain fifth data, which includes role-related data of the one or more users, and the role-related data includes one or more of account type, industry data, and job data;

[0028] Using the fifth data, the user roles corresponding to the one or more users are determined.

[0029] This application also provides a login behavior prediction method, including:

[0030] Obtain the login behavior data to be predicted associated with the first user;

[0031] The first user role corresponding to the first user is determined, and the login behavior data to be predicted is subjected to feature extraction to obtain a fifth feature value, which contains the behavioral features of the first user.

[0032] Using the fifth feature value and the first model corresponding to the first user role, the login behavior data to be predicted is predicted to obtain the prediction result. The first model is obtained according to any of the above model training methods.

[0033] This application embodiment also provides a model training apparatus, including:

[0034] The first extraction unit is used to extract features from the first data to obtain a first feature value. The first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavioral features corresponding to the one or more user roles.

[0035] The processing unit is used to determine a first parameter and use the first parameter to perform relevant removal processing on the first feature value to obtain a second feature value. The first parameter characterizes the degree of influence of random factors on the first feature value.

[0036] A training unit is used to train one or more first models using the second feature value. The one or more first models are used to predict login behavior data to be predicted, and each first model is associated with a user role.

[0037] This application embodiment also provides a login behavior prediction device, including:

[0038] The acquisition unit is used to acquire login behavior data to be predicted associated with the first user;

[0039] The second extraction unit is used to determine the first user role corresponding to the first user and to extract features from the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value contains the behavioral features of the first user.

[0040] The prediction unit is used to predict the login behavior data to be predicted by using the fifth feature value and the first model corresponding to the first user role, and to obtain the prediction result. The first model is obtained according to any of the above model training methods.

[0041] This application also provides an electronic device, including: a processor and a communication interface; wherein,

[0042] The processor is configured to extract features from first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavioral features corresponding to the one or more user roles; determine a first parameter and use the first parameter to perform relevant removal processing on the first feature value to obtain a second feature value, wherein the first parameter characterizes the degree of influence of random factors on the first feature value; and use the second feature value to train one or more first models, wherein the one or more first models are used to predict the login behavior data to be predicted, and each first model is associated with a user role.

[0043] or,

[0044] The processor is configured to acquire login behavior data to be predicted associated with a first user through the communication interface; determine a first user role corresponding to the first user; extract features from the login behavior data to be predicted to obtain a fifth feature value, the fifth feature value containing the behavioral features of the first user; and use the fifth feature value and a first model corresponding to the first user role to predict the login behavior data to be predicted to obtain a prediction result, wherein the first model is obtained according to any of the above model training methods.

[0045] This application also provides an electronic device, including: a processor and a memory for storing a computer program capable of running on the processor.

[0046] When the processor runs the computer program, it executes the steps of implementing any of the above-mentioned model training methods or the steps of implementing any of the above-mentioned login behavior prediction methods.

[0047] This application embodiment also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the above-described model training methods, or the steps of any of the above-described login behavior prediction methods.

[0048] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described model training methods or the steps of any of the above-described login behavior prediction methods.

[0049] The model training and login behavior prediction method, apparatus, electronic device, storage medium, and computer program product provided in this application embodiment include the following: The model training method includes: extracting features from first data to obtain a first feature value, wherein the first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavioral features corresponding to the one or more user roles; determining a first parameter and using the first parameter to perform relevant removal processing on the first feature value to obtain a second feature value, wherein the first parameter characterizes the degree of influence of random factors on the first feature value; and training one or more first models using the second feature value, wherein the one or more first models are used to predict login behavior data to be predicted, and each first model is associated with a user role. The technical solution provided in this application embodiment analyzes the influence of unconventional factors on the behavioral features of user role dimensions, so that when constructing the input parameters for model training, behavioral features affected by unconventional factors are removed based on the analysis results. This allows the model to better learn the difference between regular login behavior and abnormal login behavior, thus effectively improving the prediction accuracy of login behavior using the model and solving the problem of incorrect predictions caused by unconventional factors with randomness. Attached Figure Description

[0050] Figure 1 This is a schematic flowchart of a model training method according to an embodiment of this application;

[0051] Figure 2 This is a flowchart illustrating a login behavior prediction method according to an embodiment of this application;

[0052] Figure 3 This is a schematic diagram of the structure of a prediction system as an application example of this application;

[0053] Figure 4 This is a schematic diagram illustrating a model training process as an application example of this application;

[0054] Figure 5 This is a schematic diagram illustrating the method flow for constructing feature vectors in the application example of this application;

[0055] Figure 6 This is a flowchart illustrating an anomaly detection process, serving as an application example of this application.

[0056] Figure 7 This is a schematic diagram of the model training device structure according to an embodiment of this application;

[0057] Figure 8 This is a schematic diagram of the login behavior prediction device according to an embodiment of this application;

[0058] Figure 9 This is a schematic diagram of the electronic device structure according to an embodiment of this application. Detailed Implementation

[0059] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0060] In related technologies, one anomaly detection scheme is based on fixed rules or statistical models to detect user login behavior. However, faced with complex and ever-changing user behavior, the above scheme does not consider the potential impact of random factors on user behavior, which can easily lead to missed or false alarms, thus causing a significant negative impact on user experience. For example, if a user suddenly travels to another city on a business trip, the above scheme may trigger false reports of abnormal login behavior. Furthermore, if the attacker's location matches the user's frequently used login location, the above scheme will result in missed detections of abnormal login behavior. Finally, if a user is logged in all day, it is impossible to protect user login behavior from a time-based perspective.

[0061] Another anomaly detection approach is to use machine learning to detect user login behavior. However, the above approach doesn't consider the roles associated with the accounts when extracting user behavior features. The same login action can have different meanings for users with different roles. Therefore, it may fail to effectively distinguish between normal and abnormal login behavior. In other words, different roles influence user login behavior; for example, the login method, login time, and login behavior sequence are all affected by role characteristics and exhibit certain feature distributions. Furthermore, the above approach does not consider the potential impact of random factors on user behavior, making it prone to missed or false alarms.

[0062] In summary, in complex and ever-changing user login scenarios, the relevant anomaly detection solutions cannot accurately distinguish abnormal user login behaviors, resulting in false positives and false negatives.

[0063] Based on this, in various embodiments of this application, an analysis of the influence of non-standard factors on the feature values ​​of login behavior is introduced. That is, the influence of non-standard factors on feature values ​​is analyzed by multiple linear regression. In the process of constructing the input parameters of the training model, feature values ​​affected by non-standard factors are removed according to the analysis results, which solves the problem of misjudgment and wrong judgment caused by the random occurrence of non-standard factors in model prediction.

[0064] This application provides a model training method applicable to electronic devices, such as... Figure 1 As shown, the method includes:

[0065] Step 101: Extract features from the first data to obtain a first feature value. The first data contains login behavior sample data corresponding to one or more user roles, and the first feature value contains behavioral features corresponding to the one or more user roles.

[0066] Step 102: Determine the first parameter, and use the first parameter to perform relevant removal processing on the first feature value to obtain the second feature value. The first parameter represents the degree of influence of random factors on the first feature value.

[0067] Step 103: Using the second feature value, train one or more first models, which are used to predict the login behavior data to be predicted, and each first model is associated with a user role.

[0068] In practical applications, the electronic device may include a device capable of performing steps 101 to 103, such as a server, laptop computer, tablet computer, or desktop computer.

[0069] In practical applications, before step 101, the electronic device needs to acquire the first data.

[0070] Based on this, in one embodiment, the method may further include:

[0071] Obtain fourth data, which includes login behavior sample data of one or more users;

[0072] Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering related processing on the fourth data to obtain the first data.

[0073] The fourth data can be understood as login behavior sample data for each login of one or more users. The login behavior sample data can include login time, login location (such as IP address or geographical location), login device type (such as computer (PC), mobile phone, tablet, etc.), login method, login frequency, login duration, behavior sequence before login (which can also be understood as the content that the user pays attention to or visits before login, such as page Uniform Resource Locator (URL)), behavior sequence during login (which can also be understood as the content that the user pays attention to or visits during login, such as page URL), and one or more of the following login behavior time distribution (i.e., at least one).

[0074] In practical applications, the electronic device can obtain the fourth data through page tracking and backend log collection.

[0075] Here, each user may have individual behaviors and operating habits, resulting in certain differences in login behavior. However, users belonging to the same user role may have similar login behaviors due to the nature of their work, behavioral norms, and other requirements. Therefore, the electronic device can classify the fourth data according to user roles to obtain login behavior sample data in the user role dimension, i.e., the first data.

[0076] In practical applications, in order to determine the user role corresponding to the one or more users, the electronic device can collect relevant data associated with the role.

[0077] Specifically, in one embodiment, determining the user role corresponding to the one or more users includes:

[0078] Obtain fifth data, which includes role-related data of the one or more users, and the role-related data includes one or more of account type, industry data, and job data;

[0079] Using the fifth data, the user roles corresponding to the one or more users are determined.

[0080] In practical applications, the account type represents the type of account a user registers, such as an internet user, a government or enterprise user, or an account manager; the industry data represents the industry a user works in; and the job data represents the job position a user holds in a company or organization, such as an operations and maintenance personnel, a technical personnel, a product manager, an account manager, or a management personnel.

[0081] In practical applications, the electronic device can obtain the fifth data through page tracking and backend log collection. When the role-related data includes account type, industry data, and job data, the electronic device can integrate and process the account type, industry data, and job data to determine one or more user roles (i.e., a user role can be represented as account type + industry data + job data).

[0082] Here, after determining the one or more user roles, using the determined user roles as the dividing dimension, the electronic device can perform clustering correlation processing on the fourth data to obtain the first data. The first data can be understood as a data set with user roles as the dimension. For example, assuming there are n user roles (which can also be understood as the total number of data sets), the first data can be represented as: , This represents the data set corresponding to the nth user role.

[0083] In practical applications, before feature extraction from the first data, the electronic device can also perform preprocessing operations such as cleaning, deduplication, and formatting on the first data to handle missing values, outliers, and duplicate values, thereby ensuring data quality and consistency.

[0084] In practical applications, in order to extract meaningful feature values ​​that can represent user login behavior from the first data, the electronic device can use different extraction algorithms to extract features based on the data characteristics; among them, for discrete data, statistical methods can be used for feature extraction.

[0085] Specifically, in one embodiment, the step of extracting features from the first data to obtain a first feature value includes:

[0086] Using the first data, second data is obtained, which includes sample data of discrete types of login behavior corresponding to the one or more user roles;

[0087] The first feature value is obtained by extracting features from the second data using statistical methods.

[0088] Among them, discrete login behavior sample data can be understood as data with discrete and independent data characteristics. Discrete login behavior sample data may include one or more of login time, login device type, login method and login location. This application embodiment does not limit this.

[0089] In practical applications, during the feature extraction process of the second data, the electronic device can focus on the individual and common features of the data so as to retain both the public behavioral features associated with the user role and the individual behavioral features associated with the user in the extracted behavioral features, thereby capturing the patterns and rules of user login behavior more comprehensively.

[0090] Specifically, in one embodiment, the step of extracting features from the second data using statistical methods to obtain the first feature value includes:

[0091] In the case that the discrete login behavior sample data includes one or more of login time, login method and login device, the third feature value is obtained by extracting features from one or more of login time, login method and login device based on statistical methods. The third feature value includes the common behavioral features corresponding to the one or more user roles.

[0092] When discrete login behavior sample data contains one or more of login frequency, login behavior sequence and login time distribution, feature extraction is performed on one or more of login frequency, login behavior sequence and login time distribution based on statistical methods to obtain a fourth feature value. The fourth feature value contains the specific behavioral characteristics of one or more users corresponding to one or more user roles.

[0093] The first feature value is obtained by using the third feature value and the fourth feature value.

[0094] In practical applications, since a user's login time, login method, and login device are inherently related to the user role, the electronic device can perform data analysis and feature extraction based on statistical methods, using the user role-dimensional data set as the unit, to obtain the third feature value; wherein, the third feature value can be understood as the common behavioral characteristics of each user role.

[0095] For example, in scenarios where account managers place orders on behalf of clients, they typically use the simplest login method to minimize communication with clients. Furthermore, since placing orders on behalf of clients is usually a work-related activity, the login device is generally an office computer, and the login time is generally during work hours. Additionally, the login behavior of operations and maintenance personnel is usually strongly correlated with platform failures or routine resource maintenance, while the login behavior of management personnel is strongly correlated with key activities.

[0096] In addition, since some user data is highly personalized and it is difficult to extract common features, the electronic device can perform data analysis and feature extraction on one or more of the following dimensions: login frequency, login behavior sequence, and login time distribution, in order to obtain the fourth feature value. The fourth feature value can be understood as the personalized behavioral characteristics of the user, which is mainly used for predicting the user's individual login behavior.

[0097] In this embodiment, extracting common and individual features of users separately facilitates subsequent weight adjustment of the mixed feature values, enabling the model to better learn the basic patterns and rules of login behavior of users of the same type.

[0098] In practical applications, for data with time-series characteristics, the electronic device can use sliding window technology for feature extraction.

[0099] Specifically, in one embodiment, the step of extracting features from the first data to obtain a first feature value includes:

[0100] Using the first data, third data is obtained, which includes time-related login behavior sample data corresponding to the one or more user roles;

[0101] The first feature value is obtained by extracting features from the third data based on a sliding window.

[0102] Among them, the login behavior sample data related to time can be understood as data with time series characteristics, which can specifically include one or more of the following: login frequency, behavior sequence before login, behavior sequence during login, and login behavior time distribution.

[0103] In practical applications, due to the significant differences in login behavior sample data related to time for different user roles (for example, account managers log in more frequently, while administrators log in less frequently), the electronic device can use the data set at the user role dimension as a unit and perform feature extraction based on time series analysis to analyze the changing trends and periodic patterns of user login behavior over time.

[0104] For example, when the login behavior sample data regarding time includes login frequency, the electronic device can use a sliding window to calculate the login frequency of a user role within a unit of time; wherein, the login frequency within a unit of time can be calculated using the following formula:

[0105] (1)

[0106] in, The data set corresponding to user role A is shown in Login frequency at any given time Represented as Time-based correction parameters Represented as a constant parameter, Represented as with The login frequency of the preceding moments in the time-series association.

[0107] In this embodiment, the corresponding extraction method is selected according to the behavioral feature attributes of the user role to obtain multi-dimensional behavioral features. In this way, the patterns and rules of user login behavior can be captured more comprehensively, providing more effective feature input for subsequent model training.

[0108] In practical applications, in step 102, considering that random factors (also known as unconventional or non-standard factors) have a significant impact on user login behavior, such as the login behavior of technical personnel being related to the system deployment resource change cycle, the login behavior of management personnel being related to business trips, meetings, and other activities, the login behavior of account managers being affected by marketing activities, and the login behavior of maintenance personnel being affected by platform failures or routine source maintenance, the electronic device can determine the first parameter through a multiple linear regression model algorithm. This allows for a deeper understanding of the relationship between changes in user login behavior and random factors. The first parameter can be referred to as an influence factor, influence index, or correlation coefficient, etc. This application embodiment does not limit this, as long as its function is achieved.

[0109] In practical applications, the electronic device can obtain the sixth data through page tracking and backend log collection. The sixth data includes login data associated with random factors (which can also be understood as data affecting user login behavior), such as activity distribution, fault time distribution, or resource operation time distribution. This application embodiment does not limit this. The first parameter is calculated using the sixth data and the first feature value. The first parameter can reflect the degree to which the first feature value is affected by activity distribution, fault time distribution, or resource operation time distribution.

[0110] For example, taking the behavioral feature A corresponding to user role A as an example, the electronic device can normalize the behavioral feature A to obtain the normalized behavioral feature A (which can be represented as...). , Represented as the minimum value in behavioral feature A, (Represented as the maximum value in behavioral feature A). For the normalized behavioral feature A, the first parameter can be determined using the following formula:

[0111] (2)

[0112] in, Represented as the first in behavioral feature A The dependent variable of each observed characteristic Represented as the first The first observed feature There are independent variables (such as the failure time distribution). The value of can be 3; Represented as the intercept term; Represented as the first The regression coefficients of the independent variables; This is represented as an error term.

[0113] The electronic device can be calculated using a canonical equation through formula (2). The value of , i.e., the first parameter; since behavioral feature A has been normalized, The magnitude of the numerical value can directly evaluate the degree of influence of the independent variable on the dependent variable, that is, the influence of random factors on behavioral characteristics.

[0114] In practical applications, due to the randomness of random factors, the electronic device can remove (or release) behavioral features that are highly correlated with the first parameter to avoid random factors affecting the model's judgment of user login behavior.

[0115] Specifically, in one embodiment, the step of using the first parameter to perform correlation removal processing on the first feature value to obtain the second feature value includes:

[0116] Using the first parameter, determine the behavioral features among the first feature values ​​that satisfy the first condition, where the first condition represents the change of the behavioral features under the influence of the random factor;

[0117] The determined behavioral characteristics are subjected to relevant removal processing to obtain the second feature value.

[0118] Here, since the first feature value includes common behavioral features associated with the user role, specific behavioral features, and behavioral features affected by the random factors, the electronic device can use a relevant processing method (such as Z-score) to normalize the first feature value, that is, to linearly transform the behavioral features in the first feature value to a specific range (specifically [0,1]), thereby eliminating the dimensional differences between different behavioral features.

[0119] In practical applications, after determining the behavioral features that are highly correlated with the first parameter, the electronic device can remove the behavioral features affected by the random factors from the normalized first feature value to obtain the second feature value. In the case that the behavioral features affected by the random factors include behavioral features corresponding to login time, login frequency, login device, login method and login address, different types of behavioral features can be removed separately.

[0120] In practical applications, for the second feature value, the electronic device can design initial weights for different types of behavioral features based on the user role's sensitivity to behavioral features; and then weight and combine different types of behavioral features based on the initial weights to construct a feature vector that can best represent the common behaviors of users with the same role; wherein, the feature vector can be expressed by the following formula: , This represents the normalized behavioral characteristics after removing relevant processing based on login time. This represents the normalized behavioral characteristics after removing relevant processing from the login frequency behavioral characteristics. This represents the normalized behavioral characteristics after removing relevant processing from the behavioral characteristics of the logged-in device. This represents the normalized behavioral characteristics after removing relevant processing from the login method's behavioral features. This represents the normalized behavioral characteristics after removing relevant processing from the login address's behavioral features. This represents the initial weights. =0.1, =0.2, =0.3, =0.3, =0.1.

[0121] In practical applications, in step 103, the electronic device can train one or more first models using the constructed feature vectors; that is, by using the feature vectors corresponding to different user roles, the electronic device can train different first models respectively, so as to better learn the login behavior characteristics of different user roles, thereby improving the model's targeting and prediction accuracy; wherein, a support vector machine (SVM) algorithm can be used for training, that is, the first model can contain an SVM model.

[0122] Here, when the first model includes an SVM model, the choice of kernel function has a significant impact on the performance of the first model. Kernel function can map data to a higher-dimensional space, making previously linearly inseparable problems separable. Therefore, the electronic device can choose a polynomial kernel function to calculate the similarity between two features, thereby supporting the non-linear classification capability of the SVM model. The polynomial kernel function can be expressed by the following formula:

[0123] (3)

[0124] in, and This is represented by two feature vectors to be input; These are represented as coefficients of the kernel function, used to control the scaling of the kernel function; This is represented as a constant term, used to control the offset of the kernel function; It is expressed as the order of a polynomial and is related to the complexity of nonlinear mappings.

[0125] In practical applications, during the training of one or more first models, the electronic device can use a kernel function to calculate the kernel matrix between feature vectors; using the kernel matrix, determine the decision boundary that maximizes the margin, and use the decision boundary to determine the support vectors (which can also be understood as sample points in the decision boundary); adjust the parameters of the one or more first models and the weights when constructing feature vectors to optimize the performance of the first models and determine the final decision function; wherein, during the training process, the weights and parameters can be optimized and adjusted by gradient descent, regularization, grid search, etc., so that the first model has the best fit to the feature vectors used for model training and performs well on the feature vectors used for validation, thereby avoiding overfitting.

[0126] Here, after training, the electronic device can obtain multiple first models classified according to user roles; wherein, the relationship between user roles and the first models can be represented as follows: , Represented as the first User roles, Represented as the first The first model corresponding to each user role. This represents the total number of user roles.

[0127] Furthermore, the electronic device can periodically evaluate the performance of the first model after training and update it as needed to adapt to changes in data distribution or business requirements. Simultaneously, the electronic device can also track user feedback in real time to confirm the predictive accuracy of the first model; if there are issues with the model's predictive accuracy, the electronic device can analyze the feedback data and readjust the algorithm parameters to retrain the model, thereby outputting a new first model.

[0128] Based on the model training method described above, this application also provides a login behavior prediction method, applied to electronic devices, such as... Figure 2 As shown, it includes the following steps:

[0129] Step 201: Obtain the login behavior data to be predicted associated with the first user;

[0130] Step 202: Determine the first user role corresponding to the first user, and extract features from the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value contains the behavioral features of the first user;

[0131] Step 203: Using the fifth feature value and the first model corresponding to the first user role, predict the login behavior data to be predicted to obtain the prediction result. The first model is obtained according to the model training method provided in the embodiments of this application.

[0132] In practical applications, in step 201, when the first user performs a login operation, the electronic device can obtain the login behavior data to be predicted associated with the first user through page tracking and backend log collection. The login behavior data to be predicted may include one or more of the following: role-related data, resources accessed before login, resources accessed during login, login time, login device, login method, and login address.

[0133] Here, using role-related data, the electronic device can determine the first user's role; features are extracted from resources accessed before login, resources accessed during login, login time, login device, login method, and login address to obtain the fifth feature value, and the fifth feature value is normalized to obtain the feature vector to be predicted. Then, by inputting the feature vector to be predicted into the first model corresponding to the first user's role, the first model can predict the feature vector to be predicted based on the decision function and the first threshold to determine whether the first user's login behavior is normal or abnormal. The value of the first threshold can be set as needed; if the decision function value corresponding to the feature vector to be predicted is greater than or equal to the first threshold, it means that the first user's login behavior is normal; if the decision function value corresponding to the feature vector to be predicted is less than the first threshold, it means that the first user's login behavior is abnormal. At this time, the electronic device can trigger a multi-factor authentication process, that is, the first user needs to perform additional authentication through security methods such as verification code, face recognition, and multi-factor authentication (MFA).

[0134] In this embodiment of the application, for new users (which can also be understood as users logging in for the first time), the login behavior of new users can be predicted by a model of similar user roles, so as to achieve effective protection for new users and solve the cold start problem. In this way, it can avoid the situation that new users cannot be effectively protected due to the lack of historical data.

[0135] The model training and login behavior prediction method provided in this application includes the following steps: First, feature extraction is performed on first data to obtain a first feature value. The first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavioral features corresponding to the one or more user roles. A first parameter is determined, and the first parameter is used to remove related data from the first feature value to obtain a second feature value. The first parameter characterizes the degree of influence of random factors on the first feature value. The second feature value is used to train one or more first models, which are used to predict login behavior data to be predicted. Each first model is associated with a user role. The technical solution provided in this application analyzes the influence of unconventional factors on the behavioral features of user roles. When constructing the input parameters for model training, behavioral features affected by unconventional factors are removed based on the analysis results. This allows the model to better learn the difference between regular and abnormal login behaviors, effectively improving the accuracy of login behavior prediction and solving the problem of incorrect predictions caused by random unconventional factors.

[0136] The following section provides a more detailed description of this application with reference to application examples.

[0137] To address the challenges of accurately distinguishing between normal and abnormal login behavior and handling "cold starts" for new users in complex and ever-changing login scenarios, this application proposes a login anomaly behavior prediction system based on user role classification. Figure 3 As shown, the prediction system can include a data collection module, a data preprocessing module, a feature extraction module, a model training module, a model management module, a prediction module, and a response module. These modules interact through standardized interfaces to ensure the scalability and maintainability of the prediction system.

[0138] The data collection module is used to collect training data samples from multiple dimensions such as user roles, login behavior, and factors that influence user login behavior, thereby providing data for training the model. At the same time, it collects user login data when users log in, providing data for login behavior prediction.

[0139] The data preprocessing module is used to clean up abnormal data, remove duplicates and format the collected initial data according to requirements, and divide the collected training data samples into multiple datasets according to user roles;

[0140] The feature extraction module is used to extract meaningful feature values ​​that can represent user login behavior. Specifically, feature extraction is performed based on corresponding data characteristics (such as discrete features, time-series features, etc.) to obtain the behavioral characteristics of users with different roles. The impact of unconventional factors (such as marketing activities) on feature values ​​is considered, and the correlation coefficient representing the degree of impact is calculated. Based on the correlation coefficient, the feature values ​​affected by unconventional factors are subjected to correlation removal, and the feature values ​​after removing the correlation coefficient are combined using feature weighting to obtain combined feature values.

[0141] The model training module is used to train the optimal model corresponding to the user role based on the combined feature values ​​and according to a specific algorithm.

[0142] The model management module is used to manage trained models and provides a model validation interface.

[0143] The prediction module is used to preprocess and extract features from user login data, and then input the processed data into the trained model for prediction to determine user behavior.

[0144] The response module is used to initiate a multi-factor authentication process when the model predicts abnormal user behavior.

[0145] Specifically, the process of model training in the above prediction system is as follows: Figure 4 As shown, it includes the following steps:

[0146] Step 1: The data collection module collects user login sample data (i.e., the fourth data mentioned above), user role data (i.e., the fifth data mentioned above), and data affecting user login behavior (i.e., the sixth data mentioned above).

[0147] Step 2: The data preprocessing module cleans, deduplicates, and formats the collected data, and classifies and organizes the collected data by user role to obtain the datasets corresponding to different user roles (i.e., the first data mentioned above).

[0148] Step 3: The feature extraction module uses different extraction methods according to the data characteristics to extract features from the datasets corresponding to different user roles, obtaining feature values ​​(i.e., the first feature value mentioned above); according to the user role, the extracted feature values ​​are weighted to construct the corresponding feature vector;

[0149] Specifically, such as Figure 5As shown, the feature extraction module extracts features from discrete feature data (i.e., the second data mentioned above) using statistical methods according to user roles, obtaining corresponding feature values ​​(i.e., the third feature value mentioned above). It then extracts features from time-series feature data (i.e., the third data mentioned above) using a sliding window technique according to user roles, obtaining corresponding feature values ​​(i.e., the fourth feature value mentioned above). Finally, it determines the correlation between the above feature values ​​and unconventional factors (i.e., the first parameter mentioned above) using a multiple regression model according to user roles, and inputs feature values ​​and unconventional factors to remove feature values ​​affected by unconventional factors. Then, based on assigned weights, it weights the removed feature values ​​of different types (i.e., the second feature vector mentioned above) to obtain the corresponding feature vector.

[0150] It should be noted that during subsequent training, the feature extraction module can dynamically adjust the weights through methods such as gradient descent, regularization, and grid search to ensure that the model fits the training samples optimally and performs well on the validation samples, thus avoiding overfitting.

[0151] Step 4: The model training module uses the constructed feature vectors to train a model for predicting user login behavior (i.e., the first model mentioned above); where each user role corresponds to a model for predicting user login behavior.

[0152] In practical applications, the process of using models to predict anomalies in user login behavior, such as... Figure 6 As shown, it includes the following steps:

[0153] Step 1: The data collection module collects information such as the user's role, the resource URLs accessed before and during login, login time, and device, and combines this information with the user's selected login method and source IP address.

[0154] Step 2: After preprocessing the collected data, the data preprocessing module extracts features from the preprocessed data to generate normalized feature values ​​(i.e., the fifth feature value mentioned above).

[0155] Step 3: The prediction module selects the corresponding model based on the user's role and inputs the normalized feature values ​​into the selected model to calculate whether the decision function value is higher than the threshold.

[0156] Specifically, if the decision function value is higher than or equal to the threshold (i.e., the first threshold mentioned above), the local login behavior is considered normal; if the decision function value is lower than the threshold, the local login behavior is considered abnormal. In this case, step 4 is executed.

[0157] Step 4: The response module initiates the multi-factor authentication process to indicate the need for additional protective measures, such as mobile phone verification codes, facial recognition, or MFA. At the same time, the model is verified through the verification interface provided by the model management module to determine the accuracy of the model's predictions.

[0158] Step 5: If there is a problem with the model prediction accuracy (which can also be understood as poor model matching), the response module feeds back the model prediction accuracy results to the model training module, enabling the model training module to analyze the feedback data, readjust the algorithm parameters, and retrain the data to output a new model set.

[0159] In the application example of this application, since the model is trained on a dataset based on role classification, the model can make predictions based on the behavior of users with similar roles for first-time login users, thus solving the cold start problem.

[0160] Furthermore, by employing corresponding feature extraction methods for different characteristics, the characteristic values ​​of each feature can be extracted to the maximum extent. By applying feature weighting to all feature values ​​and adjusting the weights, the common characteristics of roles can be amplified, while the influence of individual features on changes in user behavior is preserved. In other words, when predicting individual behavior through common features, the differences in individual behavior can be preserved. This can improve the accuracy of model prediction and ultimately achieve accurate judgment and timely response to user login behavior.

[0161] To implement the model training method of this application embodiment, this application embodiment also provides a model training device, which is installed on an electronic device, such as... Figure 7 As shown, the device includes:

[0162] The first extraction unit 701 is used to extract features from the first data to obtain a first feature value. The first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavioral features corresponding to the one or more user roles.

[0163] Processing unit 702 is used to determine a first parameter and use the first parameter to perform relevant removal processing on the first feature value to obtain a second feature value. The first parameter characterizes the degree of influence of random factors on the first feature value.

[0164] Training unit 703 is used to train one or more first models using the second feature value, the one or more first models being used to predict login behavior data to be predicted, and each first model being associated with a user role.

[0165] In one embodiment, the processing unit 702 is configured to:

[0166] Using the first parameter, determine the behavioral features among the first feature values ​​that satisfy the first condition, where the first condition represents the change of the behavioral features under the influence of the random factor;

[0167] The determined behavioral characteristics are subjected to relevant removal processing to obtain the second feature value.

[0168] In one embodiment, the first extraction unit 701 is configured to:

[0169] Using the first data, second data is obtained, which includes sample data of discrete types of login behavior corresponding to the one or more user roles;

[0170] The first feature value is obtained by extracting features from the second data using statistical methods.

[0171] In one embodiment, the first extraction unit 701 is configured to:

[0172] In the case that the discrete login behavior sample data includes one or more of login time, login method and login device, the third feature value is obtained by extracting features from one or more of login time, login method and login device based on statistical methods. The third feature value includes the common behavioral features corresponding to the one or more user roles.

[0173] When discrete login behavior sample data contains one or more of login frequency, login behavior sequence and login time distribution, feature extraction is performed on one or more of login frequency, login behavior sequence and login time distribution based on statistical methods to obtain a fourth feature value. The fourth feature value contains the specific behavioral characteristics of one or more users corresponding to one or more user roles.

[0174] The first feature value is obtained by using the third feature value and the fourth feature value.

[0175] In one embodiment, the first extraction unit 701 is configured to:

[0176] Using the first data, third data is obtained, which includes time-related login behavior sample data corresponding to the one or more user roles;

[0177] The first feature value is obtained by extracting features from the third data based on a sliding window.

[0178] In one embodiment, the processing unit 702 is further configured to:

[0179] Obtain fourth data, which includes login behavior sample data of one or more users;

[0180] Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering related processing on the fourth data to obtain the first data.

[0181] In one embodiment, the processing unit 702 is further configured to:

[0182] Obtain fifth data, which includes role-related data of the one or more users, and the role-related data includes one or more of account type, industry data, and job data;

[0183] Using the fifth data, the user roles corresponding to the one or more users are determined.

[0184] In practical applications, the first extraction unit 701 and the training unit 703 can be implemented by the communication interface in the model training device, and the processing unit 702 can be implemented by the processor in the model training device in combination with the communication interface.

[0185] It should be noted that the model training device provided in the above embodiments is only illustrated by the division of the above-described program units during model training. In practical applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device can be divided into different program units to complete all or part of the processing described above. In addition, the model training device and the model training method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0186] To implement the login behavior prediction method of this application embodiment, this application embodiment also provides a login behavior prediction device, which is installed on an electronic device, such as... Figure 8 As shown, the device includes:

[0187] The acquisition unit 801 is used to acquire the login behavior data to be predicted associated with the first user;

[0188] The second extraction unit 802 is used to determine the first user role corresponding to the first user and to extract features from the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value contains the behavioral features of the first user.

[0189] The prediction unit 803 is used to predict the login behavior data to be predicted by using the fifth feature value and the first model corresponding to the first user role, and to obtain the prediction result. The first model is obtained based on the model training method provided in the embodiments of this application.

[0190] In practical applications, the acquisition unit 801 can be implemented by the communication interface in the login behavior prediction device; the second extraction unit 802 and the prediction unit 803 can be implemented by the processor in the login behavior prediction device.

[0191] It should be noted that the login behavior prediction device provided in the above embodiments is only illustrated by the division of the above-described program units. In practical applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device can be divided into different program units to complete all or part of the processing described above. In addition, the login behavior prediction device and the login behavior prediction method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0192] Based on the hardware implementation of the above program modules, and in order to implement the model training and login behavior prediction methods of the embodiments of this application, the embodiments of this application also provide an electronic device, such as... Figure 9 As shown, the electronic device 900 includes:

[0193] The communication interface 901 enables interaction with other devices;

[0194] The processor 902 is connected to the communication interface 901 to enable interaction with other devices and to execute the methods provided by one or more of the above-mentioned technical solutions when running computer programs;

[0195] The computer program is stored in memory 903.

[0196] Specifically, during the model training process provided in this application embodiment, the processor 902 is used for:

[0197] Feature extraction is performed on the first data to obtain a first feature value. The first data contains login behavior sample data corresponding to one or more user roles, and the first feature value contains behavioral features corresponding to the one or more user roles.

[0198] A first parameter is determined, and the first parameter is used to remove related information from the first feature value to obtain a second feature value. The first parameter represents the degree of influence of random factors on the first feature value.

[0199] Using the second feature value, one or more first models are trained, the one or more first models are used to predict login behavior data to be predicted, and each first model is associated with a user role;

[0200] In one embodiment, the processor 902 is configured to:

[0201] Using the first parameter, determine the behavioral features among the first feature values ​​that satisfy the first condition, where the first condition represents the change of the behavioral features under the influence of the random factor;

[0202] The determined behavioral characteristics are subjected to relevant removal processing to obtain the second feature value.

[0203] In one embodiment, the processor 902 is configured to:

[0204] Using the first data, second data is obtained, which includes sample data of discrete types of login behavior corresponding to the one or more user roles;

[0205] The first feature value is obtained by extracting features from the second data using statistical methods.

[0206] In one embodiment, the processor 902 is configured to:

[0207] In the case that the discrete login behavior sample data includes one or more of login time, login method and login device, the third feature value is obtained by extracting features from one or more of login time, login method and login device based on statistical methods. The third feature value includes the common behavioral features corresponding to the one or more user roles.

[0208] When discrete login behavior sample data contains one or more of login frequency, login behavior sequence and login time distribution, feature extraction is performed on one or more of login frequency, login behavior sequence and login time distribution based on statistical methods to obtain a fourth feature value. The fourth feature value contains the specific behavioral characteristics of one or more users corresponding to one or more user roles.

[0209] The first feature value is obtained by using the third feature value and the fourth feature value.

[0210] In one embodiment, the processor 902 is configured to:

[0211] Using the first data, third data is obtained, which includes time-related login behavior sample data corresponding to the one or more user roles;

[0212] The first feature value is obtained by extracting features from the third data based on a sliding window.

[0213] In one embodiment, the processor 902 is configured to:

[0214] The fourth data is obtained through communication interface 901, and the fourth data contains login behavior sample data of one or more users.

[0215] Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering related processing on the fourth data to obtain the first data.

[0216] In one embodiment, the processor 902 is configured to:

[0217] The fifth data is obtained through the communication interface 901. The fifth data includes role-related data of the one or more users. The role-related data includes one or more of account type, industry data and job data.

[0218] Using the fifth data, the user roles corresponding to the one or more users are determined.

[0219] In the login behavior prediction process provided in this application embodiment, the processor 902 is used for:

[0220] The login behavior data to be predicted associated with the first user is obtained through the communication interface 901;

[0221] The first user role corresponding to the first user is determined, and the login behavior data to be predicted is subjected to feature extraction to obtain a fifth feature value, which contains the behavioral features of the first user.

[0222] Using the fifth feature value and the first model corresponding to the first user role, the login behavior data to be predicted is predicted to obtain the prediction result. The first model is obtained based on the model training method provided in the embodiments of this application.

[0223] It should be noted that the specific processing procedures of the communication interface 901 and the processor 902 can be understood by referring to the above method.

[0224] Of course, in practical applications, the various components in electronic device 900 are coupled together through bus system 904. It can be understood that bus system 904 is used to realize the connection and communication between these components. In addition to a data bus, bus system 904 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 9 The general labeled all buses as Bus System 904.

[0225] The memory 903 in this embodiment is used to store various types of data to support the operation of the electronic device 900. Examples of such data include any computer program used to operate on the electronic device 900.

[0226] The methods disclosed in the embodiments of this application can be applied to, or implemented by, the processor 902. The processor 902 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware in the processor 902 or by instructions in software form. The processor 902 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 902 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically a memory 903. The processor 902 reads information from the memory 903 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0227] In an exemplary embodiment, the electronic device 900 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0228] It is understood that the memory (memory 903) in this embodiment of the application can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0229] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 903 storing a computer program. This computer program can be executed by the processor 902 of the electronic device 900 to complete the steps of the aforementioned model training method or the steps of the aforementioned login behavior prediction method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0230] In an exemplary embodiment, this application also provides a computer program product, including a computer program that can be executed by a processor 902 of an electronic device 900 to complete the steps of the aforementioned model training method or the steps of the aforementioned login behavior prediction method.

[0231] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0232] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0233] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A model training method, characterized in that, include: Obtain fourth data, which includes login behavior sample data of one or more users; Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering related processing on the fourth data to obtain the first data; Feature extraction is performed on the first data to obtain a first feature value. The first data contains login behavior sample data corresponding to one or more user roles, and the first feature value contains behavioral features corresponding to the one or more user roles. A first parameter is determined, and the first parameter is used to remove related information from the first feature value to obtain a second feature value. The first parameter represents the degree of influence of random factors on the first feature value. Using the second feature value, one or more first models are trained, which are used to predict login behavior data to be predicted, and each first model is associated with a user role.

2. The method according to claim 1, characterized in that, The step of using the first parameter to perform correlation removal processing on the first feature value to obtain the second feature value includes: Using the first parameter, determine the behavioral features among the first feature values ​​that satisfy the first condition, where the first condition represents the change of the behavioral features under the influence of the random factor; The determined behavioral characteristics are subjected to relevant removal processing to obtain the second feature value.

3. The method according to claim 1, characterized in that, The step of extracting features from the first data to obtain the first feature value includes: Using the first data, second data is obtained, which includes sample data of discrete types of login behavior corresponding to the one or more user roles; The first feature value is obtained by extracting features from the second data using statistical methods.

4. The method according to claim 3, characterized in that, The step of extracting features from the second data using statistical methods to obtain the first feature value includes: In the case that the discrete login behavior sample data includes one or more of login time, login method and login device, the third feature value is obtained by extracting features from one or more of login time, login method and login device based on statistical methods. The third feature value includes the common behavioral features corresponding to the one or more user roles. When discrete login behavior sample data contains one or more of login frequency, login behavior sequence and login time distribution, feature extraction is performed on one or more of login frequency, login behavior sequence and login time distribution based on statistical methods to obtain a fourth feature value. The fourth feature value contains the specific behavioral characteristics of one or more users corresponding to one or more user roles. The first feature value is obtained by using the third feature value and the fourth feature value.

5. The method according to claim 1, characterized in that, The step of extracting features from the first data to obtain the first feature value includes: Using the first data, third data is obtained, which includes time-related login behavior sample data corresponding to the one or more user roles; The first feature value is obtained by extracting features from the third data based on a sliding window.

6. The method according to claim 1, characterized in that, Determining the user role corresponding to the one or more users includes: Obtain fifth data, which includes role-related data of the one or more users, and the role-related data includes one or more of account type, industry data, and job data; Using the fifth data, the user roles corresponding to the one or more users are determined.

7. A login behavior prediction method, characterized in that, include: Obtain the login behavior data to be predicted associated with the first user; The first user role corresponding to the first user is determined, and the login behavior data to be predicted is subjected to feature extraction to obtain a fifth feature value, which contains the behavioral features of the first user. Using the fifth feature value and the first model corresponding to the first user role, the login behavior data to be predicted is predicted to obtain the prediction result. The first model is obtained by the method according to any one of claims 1 to 6.

8. A model training device, characterized in that, include: The processing unit is used to acquire fourth data, which includes login behavior sample data of one or more users; Determine the user roles corresponding to the one or more users, and use the determined user roles to perform clustering related processing on the fourth data to obtain the first data; The first extraction unit is used to extract features from the first data to obtain a first feature value. The first data includes login behavior sample data corresponding to one or more user roles, and the first feature value includes behavioral features corresponding to the one or more user roles. The processing unit is further configured to determine a first parameter and use the first parameter to perform relevant removal processing on the first feature value to obtain a second feature value, wherein the first parameter characterizes the degree of influence of random factors on the first feature value; A training unit is used to train one or more first models using the second feature value. The one or more first models are used to predict login behavior data to be predicted, and each first model is associated with a user role.

9. A login behavior prediction device, characterized in that, include: The acquisition unit is used to acquire login behavior data to be predicted associated with the first user; The second extraction unit is used to determine the first user role corresponding to the first user and to extract features from the login behavior data to be predicted to obtain a fifth feature value, wherein the fifth feature value contains the behavioral features of the first user. The prediction unit is used to predict the login behavior data to be predicted using the fifth feature value and the first model corresponding to the first user role, and to obtain the prediction result. The first model is obtained by the method according to any one of claims 1 to 6.

10. An electronic device, characterized in that, include: Processor and communication interface; among which, The processor is configured to: acquire fourth data through the communication interface, the fourth data including login behavior sample data of one or more users; determine the user roles corresponding to the one or more users, and perform clustering related processing on the fourth data using the determined user roles to obtain first data; extract features from the first data to obtain first feature values, the first data including login behavior sample data corresponding to one or more user roles, the first feature values ​​including behavioral features corresponding to the one or more user roles; determine a first parameter, and perform related removal processing on the first feature values ​​using the first parameter to obtain second feature values, the first parameter representing the degree of influence of random factors on the first feature values; and train one or more first models using the second feature values, the one or more first models being used to predict login behavior data to be predicted, each first model being associated with a user role. or, The processor is configured to acquire login behavior data to be predicted associated with a first user through the communication interface; determine a first user role corresponding to the first user; extract features from the login behavior data to be predicted to obtain a fifth feature value, the fifth feature value containing the behavioral features of the first user; and use the fifth feature value and a first model corresponding to the first user role to predict the login behavior data to be predicted to obtain a prediction result, wherein the first model is obtained by the method according to any one of claims 1 to 6.

11. An electronic device, characterized in that, include: The processor and the memory used to store computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 6, or implements the steps of the method according to claim 7.

12. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to claim 7.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to claim 7.

Images