User abnormal behavior detection method and device, equipment and storage medium

Abstract

The invention relates to the technical field of computers, particularly provides a user abnormal behavior detection method, device and equipment and a storage medium, and aims to solve the problems that an existing abnormal behavior detection method has a relatively high false alarm rate and missing report rate, is only specific to a security event and cannot detect new hidden risks. In order to achieve the purpose, the user abnormal behavior detection method comprises the steps of obtaining historical user behavior information within a preset time range, extracting user behavior characteristics of a target user in the historical user behavior information by using a pre-trained abnormal behavior detection model, calculating a behavior characteristic prediction deviation value based on the user behavior characteristics, and obtaining an abnormal result based on the behavior characteristic prediction deviation value. The abnormal behavior of the user is detected by calculating the behavior feature prediction deviation value of the user behavior features, and the accuracy of abnormal behavior detection can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment and storage medium for detecting abnormal user behavior. Background Art

[0002] With the development of Internet technology, while it brings convenience to people, it also brings data security risks to various industries. Internal threats are data security risks caused by improper behavior of employees within the industry in a network environment. Therefore, timely and accurate abnormal behavior detection is needed to help organizations discover and prevent internal threats and reduce losses caused by data security risks.

[0003] The main methods for detecting abnormal user behavior now include rule-based methods, statistical analysis-based methods, and machine learning-based methods. Among them, the rule-based method needs to rely on knowledge to continuously iterate and generate rules, and cannot automatically adapt to attacks; the statistical analysis-based method establishes a statistical model based on past data, does not use prior knowledge or rules, to predict potential malicious behavior, and constructs a network graph based on the correlation between data. By detecting the changing trend of the graph structure, it identifies threatening employees or suspicious behaviors, but cannot use data and structural analysis to better discover anomalies; the machine learning-based method continuously learns and iterates algorithms based on data, and does not require manual updates of the rule base, but machine learning is limited in terms of feature dimensions and other aspects, and has problems with false detection and missed detection. Therefore, the above existing methods all have the defects of high false alarm rates and missed detection rates, and they only target security incidents themselves and cannot detect new risks. Summary of the invention

[0004] To solve the above problems, the present application provides a method for detecting abnormal user behavior, including: obtaining historical user behavior information within a preset time range, using a pre-trained abnormal behavior detection model to extract user behavior features of a target user in the historical user behavior information, calculating a behavior feature prediction deviation value based on the user behavior features, and obtaining an abnormal result based on the behavior feature prediction deviation value. The present application detects abnormal behavior of a user by calculating the behavior feature prediction deviation value of the user behavior features, which can effectively improve the accuracy of abnormal behavior detection.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting abnormal user behavior, including: obtaining historical user behavior information within a preset time range; using a pre-trained abnormal behavior detection model to extract user behavior characteristics of a target user from the historical user behavior information, and based on the user behavior characteristics, calculating a behavior characteristic prediction deviation value, and obtaining an abnormal result based on the behavior characteristic prediction deviation value.

[0006] In the second aspect, an embodiment of the present application provides a user abnormal behavior detection device, including: an acquisition module, used to obtain historical user behavior information within a preset time range; a detection module, used to use a pre-trained abnormal behavior detection model to extract user behavior characteristics of a target user in the historical user behavior information, calculate a behavior characteristic prediction deviation value based on the user behavior characteristics, and obtain an abnormal result based on the behavior characteristic prediction deviation value.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method described in the first aspect above is implemented.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect above is implemented.

[0009] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages:

[0010] The user abnormal behavior detection method of the embodiment of the present application obtains historical user behavior information within a preset time range, uses a pre-trained abnormal behavior detection model, extracts user behavior features of the target user in the historical user behavior information, calculates a behavior feature prediction deviation value based on the user behavior features, and obtains an abnormal result based on the behavior feature prediction deviation value. The present application detects abnormal behavior of the user by calculating the behavior feature prediction deviation value of the user behavior features, which can effectively improve the accuracy of abnormal behavior detection.

[0011] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0013] Figure 1 A flowchart of a method for detecting abnormal user behavior provided by an embodiment of the present application is shown;

[0014] Figure 2 A schematic diagram of the structure of an abnormal behavior detection model provided in an embodiment of the present application is shown;

[0015] Figure 3 A schematic diagram showing the structure of a behavior sequence prediction module provided in an embodiment of the present application is shown;

[0016] Figure 4 A schematic diagram showing the structure of a behavior habit prediction module provided in an embodiment of the present application is shown;

[0017] Figure 5 A schematic diagram showing the structure of the comprehensive decision-making module provided in an embodiment of the present application is shown;

[0018] Figure 6 A schematic diagram showing the experimental results of the second deviation values ​​of the first prediction features corresponding to each individual behavior sequence feature provided in the embodiment of the present application;

[0019] Figure 7 A schematic diagram showing the experimental results of the third deviation value of each individual behavior habit feature and its corresponding second prediction feature provided in the embodiment of the present application;

[0020] Figure 8 The experimental result of the first deviation value between the overall behavior habit feature and the individual behavior habit feature provided by the embodiment of the present application is shown;

[0021] Fig. 9 A schematic diagram showing the distribution of a first deviation value, a second deviation value, and a third deviation value calculated by an abnormal behavior detection model provided in an embodiment of the present application is shown;

[0022] Fig.10 A schematic diagram of the structure of a user abnormal behavior detection device provided in an embodiment of the present application is shown;

[0023] Fig.11 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0025] With the development of Internet technology, while it brings convenience to people, it also brings data security risks to various industries. Internal threats are data security risks caused by improper behavior of employees within the industry in a network environment. Therefore, timely and accurate abnormal behavior detection is needed to help organizations discover and prevent internal threats and reduce losses caused by data security risks.

[0026] The main methods for detecting abnormal user behavior now include rule-based methods, statistical analysis-based methods, and machine learning-based methods. Among them, the rule-based method needs to rely on knowledge to continuously iterate and generate rules, and cannot automatically adapt to attacks; the statistical analysis-based method establishes a statistical model based on past data, does not use prior knowledge or rules, to predict potential malicious behavior, and constructs a network graph based on the correlation between data. By detecting the changing trend of the graph structure, it identifies threatening employees or suspicious behaviors, but cannot use data and structural analysis to better discover anomalies; the machine learning-based method continuously learns and iterates algorithms based on data, and does not require manual updates of the rule base, but machine learning is limited in terms of feature dimensions and other aspects, and has problems with false detection and missed detection. Therefore, the above existing methods all have the defects of high false alarm rates and missed detection rates, and they only target security incidents themselves and cannot detect new risks.

[0027] Based on this, the embodiment of the present application provides a method for detecting abnormal user behavior. The solution of the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0028] See also Figure 1 A flowchart of a method for detecting abnormal user behavior is shown, and the method specifically comprises the following steps:

[0029] Step 101: Obtain historical user behavior information within a preset time range.

[0030] Step 102: Utilize the pre-trained abnormal behavior detection model to extract the user behavior characteristics of the target user in the historical user behavior information, calculate the behavior characteristic prediction deviation value based on the user behavior characteristics, and obtain the abnormal result based on the behavior characteristic prediction deviation value.

[0031] User behavior information refers to the operation behaviors generated by users in various product systems and various data information generated by various operation behaviors. For example, when a user logs into a product system, the operation behaviors performed include login behavior, and the login time, login duration, number of logins, and other data information will be generated during the login behavior.

[0032] In one implementation, historical user behavior information within a preset time range can be obtained from multi-source heterogeneous log files in units of days, and the historical user behavior information can be sorted according to a preset data format. Then, a pre-trained abnormal behavior detection model is used to extract user behavior features of the target user from the sorted historical user behavior information. Based on the user behavior features, a behavior feature prediction deviation value is calculated, and based on the behavior feature prediction deviation value, an abnormal result is obtained.

[0033] The embodiment of the present application obtains historical user behavior information within a preset time range, uses a pre-trained abnormal behavior detection model, extracts user behavior features of the target user in the historical user behavior information, calculates a behavior feature prediction deviation value based on the user behavior features, and obtains an abnormal result based on the behavior feature prediction deviation value. The present application detects abnormal behavior of the user by calculating the behavior feature prediction deviation value of the user behavior features, which can effectively improve the accuracy of abnormal behavior detection.

[0034] See also Figure 2 As shown, on the basis of the above-mentioned implementation manner, in some modified implementation manners, the pre-trained abnormal behavior detection model includes a feature extraction module, a behavior prediction module and a comprehensive decision-making module. The pre-trained abnormal behavior detection model is used to extract the user behavior characteristics of the target user in the historical user behavior information, and based on the user behavior characteristics, the behavior characteristic prediction deviation value is calculated. Based on the behavior characteristic prediction deviation value, the abnormal result is obtained. Specifically, the feature extraction module can be used to extract the user behavior characteristics of the target user in the historical user behavior information, and the user behavior characteristics include multiple individual behavior sequence characteristics, multiple individual behavior habit characteristics and multiple overall behavior habit characteristics; the behavior prediction module is used to perform behavior prediction based on the user behavior characteristics of the target user to obtain the behavior prediction characteristics of the target user, and the behavior prediction characteristics include multiple first prediction characteristics and multiple second prediction characteristics; the comprehensive decision-making module is used to calculate the behavior characteristic prediction deviation value of the behavior prediction characteristics of the target user and the user behavior characteristics, and based on the behavior characteristic prediction deviation value, the abnormal result of the target user is obtained.

[0035] On the basis of the above implementation, in some modified implementations, a feature extraction module is used to extract user behavior features of a target user in historical user behavior information. Specifically, the feature extraction module can be used to extract each operation behavior of the target user and each user in the same organizational structure as the target user in the historical user behavior information, and then generate user behavior features of the target user based on each operation behavior.

[0036] On the basis of the above-mentioned implementation manner, in some modified implementation manners, a feature extraction module is used to generate user behavior features of the target user based on each operation behavior. Specifically, the feature extraction module may be used to sort each operation behavior of the target user in ascending order of the behavior operation time, and an operation number is generated for each sorted operation behavior to obtain a plurality of individual behavior sequence features, each individual behavior sequence feature includes the operation behavior and its operation number, and then each attribute information corresponding to each operation behavior of the target user is obtained to obtain a plurality of individual behavior habit features, each individual behavior habit feature includes the operation behavior and its corresponding attribute information, and finally the average value of each attribute information corresponding to each operation behavior is calculated to obtain a plurality of overall behavior habit features, each overall behavior habit feature includes the average value of the operation behavior and its corresponding attribute information.

[0037] It should be noted that the operation number can be generated according to the generation rules pre-set according to actual needs. For example, assuming that the operation behavior includes login behavior and modification of personal information, the individual behavior sequence feature can be expressed as: {'login behavior': 1, 'modification of personal information': 2}; assuming that the various attribute information corresponding to the login behavior includes login time, login duration, and number of logins, and the various attribute information corresponding to the modification of personal information includes modification time and number of modifications, then the individual behavior habit feature can be expressed as: {'login behavior': login time, login duration, number of logins; 'modification of personal information': modification time, number of modifications}.

[0038] On the basis of the above implementation, in some modified implementations, the behavior prediction module includes a behavior sequence prediction module and a behavior habit prediction module. The behavior prediction module is used to perform behavior prediction based on the user behavior characteristics of the target user to obtain the behavior prediction characteristics of the target user. Specifically, the behavior sequence prediction module can be used to perform prediction based on multiple individual behavior sequence characteristics to obtain multiple first prediction characteristics, each first prediction characteristic including the operation behavior and its first prediction value. Then, the behavior habit prediction module can be used to perform prediction based on multiple individual behavior habit characteristics to obtain multiple second prediction characteristics, each second prediction characteristic including the operation behavior and the second prediction value of its respective attributes.

[0039] See also Figure 3 As shown, in an embodiment of the present application, the behavior sequence prediction module may include a temporal convolutional network and a fully connected layer, the temporal convolutional network includes multiple residual blocks, each residual block includes a 1X1 convolutional layer and a multi-layer dilated causal convolutional layer.

[0040] Multiple individual behavior sequence features are input as input data into the behavior sequence prediction module, and a first output result is obtained after stacking multiple residual blocks in the time convolution network. The first output result is input into the first fully connected layer, and the first output result is reduced in dimension through the first fully connected layer to obtain multiple first prediction features.

[0041] Specifically, the final output result of each residual block is the sum of the actual output result of the residual block and the input data. When multiple individual behavior sequence features are input as input data to the residual block, the 1X1 convolution layer of the residual block appropriately adjusts the width of the residual tensor, and then passes through the first layer of dilated causal convolution layer for weight normalization, ReLU function and Dropout operation, outputs the first candidate result, and inputs the first candidate result as new input data to the second layer of dilated causal convolution layer for weight normalization, ReLU function and Dropout operation, outputs the second candidate result, and so on, until the input data is input to the last layer of dilated causal convolution layer for weight normalization, ReLU function and Dropout operation, outputs the actual output result, and adds the actual output result to the multiple individual behavior sequence features to obtain the final output result of the residual block.

[0042] Furthermore, each dilated causal convolutional layer samples every d points (dilation factor) as the input of the dilated causal convolutional layer, and then calculates the candidate results by the following formula (1):

[0043]

[0044] Among them, F(s) represents the candidate result, k represents the convolution kernel size of each dilated causal convolution layer, * represents the convolution operation, d represents the dilation factor, sd·i represents the offset of the i-th element relative to the current position s, and x1 represents multiple individual behavior sequence features.

[0045] Temporal Convolutional Network (TCN) is a deep learning model designed specifically for processing time series data.

[0046] By setting a temporal convolutional network in the behavior sequence prediction module, the behavior sequence prediction module can have a strict order in the individual behavior sequence during the prediction process. Only past information can affect future information, and the output only depends on the value of the previous moment and before, avoiding the early leakage of future data.

[0047] See also Figure 4As shown, in an embodiment of the present application, the behavior habit prediction module may include a convolutional neural network (CNN), a bidirectional long short-term memory network (Bidirectional LongShort-Term Memory, BiLSTM) and an attention mechanism (Attention).

[0048] Multiple individual behavior habit features are input into the behavior habit prediction module. The convolutional neural network automatically extracts the internal features of multiple individual behavior habit features. The one-dimensional convolutional layer of the convolutional neural network performs effective nonlinear local feature extraction of multiple individual behavior habit features. The pooling layer selects the maximum pooling method to compress the extracted features and generate more critical multiple second output results. The calculation process of the convolutional neural network can be expressed as formula (2):

[0049]

[0050] Among them, y oij Represents the behavior characteristics of the oth individual in the rectangular area R ij The second output of the maximum pooling, x opq Represents the rectangular area R ij The behavioral habit characteristics of the individual at (p,q) in .

[0051] Furthermore, each hidden layer of BiLSTM learns the internal dynamic change rules of the second output result extracted by CNN, fully considers past and future information, and iteratively extracts a more complex third output result from the second output result.

[0052] Furthermore, each third output result output by each hidden layer in the BiLSTM is used as an input of the Attention mechanism, and the attention mechanism is used to automatically distinguish the importance of the third output results extracted by the BiLSTM hidden layer in a weighted manner to obtain a fourth output result.

[0053] Finally, the fourth output result of the Attention layer is used as the input of the second fully connected layer, and the second fully connected layer outputs multiple second prediction features predicted by the behavior habit prediction module.

[0054] On the basis of the above implementation, in some modified implementations, a comprehensive decision module is used to calculate the behavior feature prediction deviation value between the behavior prediction feature of the target user and the user behavior feature, and based on the behavior feature prediction deviation value, the abnormal result of the target user is obtained. Specifically, the comprehensive decision module can be used to calculate the first deviation value of each overall behavior habit feature and the individual behavior habit feature, and the second deviation value of each individual behavior sequence feature and its corresponding first prediction feature, and the third deviation value of each individual behavior habit feature and its corresponding second prediction feature are calculated by the following formula (3), and then based on the first deviation value, the second deviation value and the third deviation value, the abnormal result of the target user is obtained, wherein formula (3) is as follows:

[0055]

[0056] Wherein, when degree represents the second deviation value, S represents the first feature set composed of each individual behavior sequence feature, s represents the operation behavior of any individual behavior sequence feature in the first feature set, and z represents the operation number of the operation behavior of the individual behavior sequence feature. The first prediction value of the operation behavior representing the individual behavior sequence characteristics, w i represents the weighted value of any preset individual behavior sequence feature; when degree represents the third deviation value, S represents the second feature set composed of individual behavior habit features, s represents the operation behavior of any individual behavior habit feature in the second feature set, and z represents the attribute information of the operation behavior of the individual behavior habit feature. The second predicted value of each attribute information of the operation behavior representing the individual behavior habit characteristics, w i Represents the weighted value of any preset individual behavior habit feature.

[0057] See also Figure 5 As shown, in the embodiment of the present application, the comprehensive decision module includes an input layer, a hidden layer and an output layer. The input layer is used to receive the first deviation value, the second deviation value and the third deviation value input to the comprehensive decision module. There can be multiple hidden layers, each of which contains a considerable number of neurons. The output layer will output the final abnormal result after the multi-layer neural network is processed. Assuming that the input layer is represented by a vector X, the final output can be shown as formula (4):

[0058] r=f(W (L) ·f(W (L-1) ·…·f(W (1) ·X+b (1) )+b (2) )+...+b (L) ) (4)

[0059] Among them, f represents the activation function, W (L) represents the weight matrix of the Lth layer, b (L) represents the bias vector of the Lth layer, X represents the input feature vector, and the output of each layer must undergo a linear transformation of the weight matrix and the bias vector and then be nonlinearly transformed using the activation function to finally obtain the output value of the abnormal result.

[0060] The user abnormal behavior detection method of the embodiment of the present application learns the temporal relationship of individual behavior sequence features through the temporal convolution network in the behavior sequence prediction module, and learns the intrinsic connection between individual behavior habit features through the convolutional attention mechanism and the bidirectional long short-term memory network of the behavior habit prediction module, which can fully consider the multi-dimensional behavior characteristics and correlation relationships of the target user, and then calculates the first deviation value of the overall behavior habit characteristics and the individual behavior habit characteristics, the second deviation value of each individual behavior sequence feature and its corresponding first prediction feature, and the third deviation value of each individual behavior habit feature and its corresponding second prediction feature through the comprehensive decision-making module. Finally, abnormal results are detected based on the first deviation value, the second deviation value and the third deviation value, which can effectively integrate the advantages of different modules, reduce the errors existing in a single module, and significantly improve the accuracy of user abnormal behavior detection.

[0061] In order to evaluate the user abnormal behavior detection method proposed in the embodiment of the present application, an experiment can be conducted based on the CERT dataset proposed by Carnegie Mellon University. The simulation includes fraud behaviors such as system destruction, information theft, and internal fraud implemented by malicious insiders, including 1,000 users, including 70 internal attackers, and the average number of activities per employee is about 10,000. The dataset contains 5 different categories of csv files: login data, device data, HTTP data, email data, and file data. The file description is shown in Table 1:

[0062]

[0063] Table 1 CERT dataset file description

[0064] The embodiments of the present application can be experimented in the environment of Tensorflow, and specifically, keras2.2 can be used for the experiment. In addition to extracting and obtaining historical user behavior information within a preset time range, the experimental data collection and processing part also needs to perform data preprocessing operations on the historical user behavior information and delete redundant data that is not related to this experiment (such as user ID number id_number, operation file content file_content, etc.). In addition, some missing values ​​must be filled with 0 to ensure the consistency of the feature vector dimension.

[0065] Furthermore, the historical user behavior information can be divided into a training set and a test set in a ratio of 8:2. In the process of training the abnormal behavior detection model, the features of the fourth day are used to predict the features of the fifth day, and the weighted deviation degree is used to calculate the deviation between the actual features and the predictions. In order to effectively alleviate the overfitting phenomenon and improve the generalization ability of the abnormal behavior detection model, a Dropout layer with a parameter of 0.5 can be added after the Dense layer in each hidden layer in the comprehensive decision-making module, and some nodes in each layer of the neural network can be deleted with a given probability to balance the weights of the nodes in the neural network so that the model will not be biased towards a certain node. Finally, the results of the anomaly detection can be expressed by the AUC score. By using other models to compare with the abnormal behavior detection model in the embodiment of the present application, the final experimental comparison results are shown in Table 2:

[0066]

[0067] Table 2 Comparison of experimental results of different models

[0068] It can be seen from Table 2 that the UBCFSM model of the embodiment of the present application achieved a score of 97.1%, which is significantly better than the HMM and SOM algorithms, and is 2.1% higher than the AUC score of the best performing AD-DNN model. The results can prove the competitiveness and effectiveness of the UBCFSM model.

[0069] Furthermore, in order to further verify the effectiveness of different modules in the UBCFSM model of the embodiment of the present application, the embodiment of the present application may also conduct an ablation experiment. The results of the ablation experiment are shown in Table 3:

[0070] TCN BiLSTM AC-BiLSTM AUC √ — — 0.912 — √ — 0.908 — — √ 0.919 √ √ — 0.927 — √ √ 0.932 √ — √ 0.971

[0071] Table 3 Comparison of ablation experiment results

[0072] As can be seen from Table 3, in order to verify the impact of TCN, we only consider using one or a combination of BiLSTM and AC-BiLSTM models without integrating the TCN model. When TCN is added, the AUC score of anomaly detection is higher than that of using BiLSTM and AC-BiLSTM alone or in combination, indicating that TCN can make full use of the individual behavior sequence characteristics of the target user to focus on the anomalies of some behaviors, thereby further improving the detection capability of the abnormal behavior detection model of the embodiment of the present application.

[0073] To verify the impact of AC-BiLSTM, we only consider using BiLSTM or a combination of BiLSTM and TCN models. The results show that when AC-BiLSTM is used alone, the AUC score is 1.1% higher than that of BiLSTM, and the fusion result with TCN shows a more significant performance improvement. This shows that AC-BiLSTM can make full use of the individual and overall behavioral habit characteristics of the target users to pay attention to some potential abnormal situations that do not conform to daily habits.

[0074] Furthermore, the embodiment of the present application also visualizes the experimental results of the second deviation value of each individual behavior sequence feature calculated by the UBCFSM model and its corresponding first prediction feature on the CERT test set, see Figure 6 As shown; a schematic diagram of the experimental results of the third deviation value of each individual behavior habit feature and its corresponding second prediction feature calculated by the UBCFSM model, see Figure 7 As shown; and the experimental results of the first deviation value of the overall behavior habit characteristics and individual behavior habit characteristics calculated by the UBCFSM model, see Figure 8 As shown; and the distribution diagram of the first deviation value, the second deviation value and the third deviation value calculated by the abnormal behavior detection model, see Fig. 9 shown.

[0075] Depend on Figure 6-9 It can be seen that the first deviation value, the second deviation value and the third deviation value 165 days ago were basically maintained within a certain range, but after 165 days, the first deviation value, the second deviation value and the third deviation value showed large fluctuations, that is, abnormal behavior occurred. Through the above experiments, it can be effectively verified that the UBCFSM model of the embodiment of the present application can better learn the normal operation behavior of the target user's individual behavior sequence characteristics, individual behavior habit characteristics and overall behavior habit characteristics, and can respond to abnormal operation behaviors.

[0076] See also Fig.10 The embodiment of the present application also provides a user abnormal behavior detection device, which is used to execute the user abnormal behavior detection method described in the above embodiment, and the device includes:

[0077] Acquisition module 201, used to acquire historical user behavior information within a preset time range;

[0078] The detection module 202 is used to use a pre-trained abnormal behavior detection model to extract the user behavior characteristics of the target user in the historical user behavior information, calculate the behavior characteristic prediction deviation value based on the user behavior characteristics, and obtain the abnormal result based on the behavior characteristic prediction deviation value.

[0079] The user abnormal behavior detection device provided in the embodiment of the present application and the user abnormal behavior detection method provided in the above embodiment are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0080] The present application also provides an electronic device corresponding to the user abnormal behavior detection method provided in the above embodiment. Fig.11 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Fig.11 As shown, the electronic device 30 may include: a processor 300, a memory 301, a bus 302 and a communication interface 303, wherein the processor 300, the communication interface 303 and the memory 301 are connected via the bus 302; the memory 301 stores a computer program that can be run on the processor 300, and when the processor 300 runs the computer program, the user abnormal behavior detection method provided in any of the aforementioned embodiments of the present application is executed.

[0081] The memory 301 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one physical port 303 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0082] The bus 302 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 301 is used to store programs, and the processor 300 executes the program after receiving an execution instruction. The user abnormal behavior detection method disclosed in any implementation of the embodiment of the present application may be applied to the processor 300, or implemented by the processor 300.

[0083] The processor 300 may be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 300 or an instruction in the form of software. The above processor 300 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 301, and the processor 300 reads the information in the memory 301 and completes the steps of the above method in combination with its hardware.

[0084] The electronic device provided in the embodiment of the present application and the user abnormal behavior detection method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0085] An embodiment of the present application also provides a computer-readable storage medium corresponding to the user abnormal behavior detection method provided in the aforementioned embodiment, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it will execute the user abnormal behavior detection method provided in any of the aforementioned embodiments.

[0086] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0087] An embodiment of the present application also provides a computer program product corresponding to the user abnormal behavior detection method provided in the aforementioned embodiment, including a computer program, which is executed by a processor to implement the user abnormal behavior detection method provided in the aforementioned embodiments.

[0088] The computer-readable storage medium and computer program product provided in the above-mentioned embodiments of the present application are based on the same inventive concept as the user abnormal behavior detection method provided in the embodiments of the present application, and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0089] It should be noted that:

[0090] The algorithm and display provided herein are not inherently related to any particular computer, virtual device or other equipment. Various general purpose devices can also be used together with the teachings based on this. According to the above description, it is obvious to construct the structure required for this type of device. In addition, the application is not directed to any specific programming language. It should be understood that the content of the application described herein can be realized using various programming languages, and the description of the specific language above is to disclose the best mode of implementation of the application.

[0091] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0092] Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following intention: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the claims below, the inventive aspects are less than all the features of the single embodiment disclosed above. Therefore, the claims following the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

[0093] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0094] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0095] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the creation device of the virtual machine according to the embodiment of the present application. The application can also be implemented as a device or device program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0096] It should be noted that the above embodiments illustrate the present application rather than limit the present application, and that those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets should not be constructed as a limitation to the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The present application may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names.

[0097] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting abnormal user behavior, characterized in that: include: Get historical user behavior information within a preset time range; Utilizing a pre-trained abnormal behavior detection model, user behavior features of the target user in the historical user behavior information are extracted, based on the user behavior features, behavior feature prediction deviation values ​​are calculated, and based on the behavior feature prediction deviation values, abnormal results are obtained.

2. The method for detecting abnormal user behavior according to claim 1, characterized in that: The abnormal behavior detection model includes a feature extraction module, a behavior prediction module and a comprehensive decision module. The pre-trained abnormal behavior detection model is used to extract the user behavior features of the target user in the historical user behavior information, and based on the user behavior features, the behavior feature prediction deviation value is calculated. Based on the behavior feature prediction deviation value, an abnormal result is obtained, including: Utilizing the feature extraction module, extracting user behavior features of the target user from the historical user behavior information, wherein the user behavior features include a plurality of individual behavior sequence features, a plurality of individual behavior habit features, and a plurality of overall behavior habit features; Using the behavior prediction module, behavior prediction is performed based on the user behavior characteristics of the target user to obtain behavior prediction characteristics of the target user, wherein the behavior prediction characteristics include a plurality of first prediction characteristics and a plurality of second prediction characteristics; The comprehensive decision-making module is used to calculate the behavior feature prediction deviation value between the behavior prediction feature of the target user and the user behavior feature, and the abnormal result of the target user is obtained based on the behavior feature prediction deviation value.

3. The method for detecting abnormal user behavior according to claim 2, characterized in that: The extracting the user behavior features of the target user from the historical user behavior information by using the feature extraction module includes: Utilizing the feature extraction module, extracting the operation behaviors of the target user and the users in the same organizational structure as the target user from the historical user behavior information; The feature extraction module is used to generate user behavior features of the target user based on each of the operation behaviors.

4. The method for detecting abnormal user behavior according to claim 3, characterized in that: The using the feature extraction module to generate the user behavior features of the target user based on each of the operation behaviors includes: Using the feature extraction module, sorting the target user's operation behaviors in ascending order of behavior operation time, generating an operation number for each sorted operation behavior, and obtaining the plurality of individual behavior sequence features, each of which includes the operation behavior and its operation number; Utilizing the feature extraction module, obtaining the attribute information corresponding to each of the operation behaviors of the target user, and obtaining the plurality of individual behavior habit features, each of which includes the operation behavior and the attribute information corresponding thereto; The feature extraction module is used to calculate the average values ​​of each attribute information corresponding to each operation behavior, and obtain the plurality of overall behavior habit features, each of which includes the operation behavior and the average value of each attribute information corresponding to it.

5. The method for detecting abnormal user behavior according to claim 2, characterized in that: The behavior prediction module includes a behavior sequence prediction module and a behavior habit prediction module. The behavior prediction module is used to perform behavior prediction based on the user behavior characteristics of the target user to obtain the behavior prediction characteristics of the target user, including: Using the behavior sequence prediction module, prediction is performed based on the multiple individual behavior sequence features to obtain the multiple first prediction features, each of the first prediction features including the operation behavior and its first prediction value; The behavior habit prediction module is used to perform prediction based on the multiple individual behavior habit features to obtain the multiple second prediction features, each of which includes a second prediction value of the operation behavior and its respective attributes.

6. The method for detecting abnormal user behavior according to claim 2, characterized in that: The feature prediction deviation value includes a first deviation value, a second deviation value, and a third deviation value. The comprehensive decision module is used to calculate the behavior feature prediction deviation value of the target user's behavior prediction feature and the user's behavior feature, and based on the behavior feature prediction deviation value, the abnormal result of the target user is obtained, including: The comprehensive decision-making module is used to calculate the first deviation value between each of the overall behavior habit features and the individual behavior habit features, and the second deviation value between each individual behavior sequence feature and the corresponding first prediction feature, and the third deviation value between each individual behavior habit feature and the corresponding second prediction feature are calculated by the following formulas; Using the comprehensive decision module, based on the first deviation value, the second deviation value and the third deviation value, obtain the abnormal result of the target user; Wherein, when degree represents the second deviation value, S represents the first feature set composed of individual behavior sequence features, s represents the operation behavior of any individual behavior sequence feature in the first feature set, and z represents the operation number of the operation behavior of the individual behavior sequence feature. The first prediction value of the operation behavior representing the individual behavior sequence characteristics, w i represents the weighted value of any preset individual behavior sequence feature; when degree represents the third deviation value, S represents the second feature set composed of each individual behavior habit feature, s represents the operation behavior of any individual behavior habit feature in the second feature set, and z represents each attribute information of the operation behavior of the individual behavior habit feature, The second predicted value of each attribute information of the operation behavior representing the individual behavior habit characteristics, w i Represents the weighted value of any preset individual behavior habit feature.

7. The method for detecting abnormal user behavior according to claim 2, characterized in that: The behavior prediction module includes a behavior sequence prediction module and a behavior habit prediction module; The behavior sequence prediction module includes a temporal convolutional network and a first fully connected layer; The behavior habit prediction module includes a convolutional neural network, a bidirectional long short-term memory network, an attention mechanism and a second fully connected layer.

8. A user abnormal behavior detection device, characterized in that: include: An acquisition module is used to obtain historical user behavior information within a preset time range; The detection module is used to use a pre-trained abnormal behavior detection model to extract the user behavior characteristics of the target user in the historical user behavior information, calculate the behavior characteristic prediction deviation value based on the user behavior characteristics, and obtain the abnormal result based on the behavior characteristic prediction deviation value.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images