Abnormal behavior detection method and device, electronic equipment and computer program product

Abstract

The invention is suitable for the technical field of abnormal behavior detection, and provides an abnormal behavior detection method and device, electronic equipment and a computer program product, and the method comprises the steps: obtaining real-time user access data, and determining a real-time access result of the real-time user access data through a pre-trained user behavior model; the real-time access result at least comprises a real-time access behavior corresponding to the real-time user access data, the pre-trained user behavior model is obtained by training historical user access data, and a user corresponding to the historical user access data and a user corresponding to the real-time user access data have the same user portrait. And performing abnormal behavior detection on the real-time user access data according to the real-time access result and a historical access result corresponding to the historical user access data to obtain an abnormal behavior detection result. According to the invention, the accuracy of abnormal behavior detection can be improved.

Description

Technical Field

[0001] The present application belongs to the technical field of abnormal behavior detection, and in particular, relates to an abnormal behavior detection method, device, electronic equipment and computer program product. Background Art

[0002] With the continuous development of the Internet, Internet security issues are becoming more and more important. At present, Internet-based security management mainly relies on risk control rules for security detection, and screens risky user abnormal behaviors by presetting multiple fixed rules in the detection engine or manually setting rule thresholds based on expert experience. However, this rule management method is difficult to adapt to all users, especially when facing users from different regions and devices. There are usually high false alarm rates and low hit rates. For example, for some special users (such as those who often work overtime, travel on business, etc.), frequent alarms will be issued due to changes in region or equipment, which will cause a lot of trouble. Experienced attackers can easily avoid these risk control rules, resulting in inaccurate detection of user abnormal behavior. Summary of the invention

[0003] The embodiments of the present application provide an abnormal behavior detection method, device, and electronic device, which can improve the accuracy of abnormal behavior detection.

[0004] In a first aspect, an embodiment of the present application provides an abnormal behavior detection method, comprising:

[0005] Get real-time user access data;

[0006] Determine the real-time access result of the real-time user access data by using a pre-trained user behavior model; the real-time access result at least includes the real-time access behavior corresponding to the real-time user access data, the pre-trained user behavior model is trained based on historical user access data, wherein the user corresponding to the historical user access data and the user corresponding to the real-time user access data have the same user profile;

[0007] An abnormal behavior detection is performed on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data to obtain an abnormal behavior detection result.

[0008] In a second aspect, an embodiment of the present application provides an abnormal behavior detection device, including:

[0009] Real-time data acquisition module, used to obtain real-time user access data;

[0010] A real-time result determination module, used to determine the real-time access result of the real-time user access data using a pre-trained user behavior model; the real-time access result at least includes the real-time access behavior corresponding to the real-time user access data, the pre-trained user behavior model is trained based on historical user access data, wherein the user corresponding to the historical user access data and the user corresponding to the real-time user access data have the same user portrait;

[0011] The abnormal behavior detection module is used to perform abnormal behavior detection on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data to obtain an abnormal behavior detection result.

[0012] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the abnormal behavior detection method described in the first aspect when executing the computer program.

[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the abnormal behavior detection method described in the first aspect are implemented.

[0014] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the abnormal behavior detection method described in any one of the first aspects above.

[0015] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0016] The present application performs abnormal behavior detection on real-time user access data through real-time access results and historical user access data, which can improve the accuracy of abnormal behavior detection. Specifically, after obtaining the real-time user access data, the real-time access results of the above-mentioned real-time user access data are determined using a pre-trained user behavior model, and the above-mentioned real-time access results at least include the real-time access behavior corresponding to the real-time user access data. Since the above-mentioned pre-trained user behavior model is trained based on the historical user access data, that is, the above-mentioned pre-trained user behavior model does not require preset risk control rules, the flexibility of abnormal behavior detection can be improved. At the same time, the user corresponding to the above-mentioned historical user access data and the user corresponding to the above-mentioned real-time user access data have the same user portrait, which means that the above-mentioned pre-trained user behavior model can be more specifically adapted to the above-mentioned real-time user access data. Therefore, the above-mentioned real-time access results can be more accurately determined through the above-mentioned pre-trained user behavior model, thereby improving the accuracy of abnormal behavior detection of users through real-time access results and historical access results corresponding to historical user access data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 It is a flowchart of an abnormal behavior detection method provided by an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of the structure of an abnormal behavior detection device provided in an embodiment of the present application;

[0020] Figure 3 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0022] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0023] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0024] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0025] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0027] At present, the mainstream abnormal behavior detection solutions on the Internet mainly include three types: traffic analysis, security information event management (SIEM), and product integration. These three types of solutions have their own advantages and disadvantages, but in general, they are all done by security experts listing microscopic security event information (such as abnormal behavior events of users) and summarizing the associated risk control rules. In the subsequent abnormal behavior detection, the abnormal behavior of users is detected by matching these risk control rules. In addition, there is also abnormal behavior detection through multi-factor authentication (Multi-Factor Authentication, MFA), where the above-mentioned multi-factor authentication refers to combined verification through multiple factors such as passwords, gesture codes, mobile phone text messages, USB keys, fingerprints, facial features, etc.

[0028] However, with the rapid development of informatization in various industries, the above methods have the following defects: 1. The adaptability and flexibility of the risk control rule management method are poor, and the preset risk control rules are difficult to adapt to all users, especially for users from different regions and devices. At the same time, when the hacker's attack model changes, the risk control rules are difficult to adjust in time; 2. Risk control rules are difficult to reflect the comprehensive risk identification scope. For example, for terminal devices that have not obtained an identity but may have attack behaviors (such as a PC, mobile phone, or even just an IP), they are often not included in the risk identification dimension when constructing risk control rules; 3. In the multi-factor authentication (MFA) method, the cost of forging each authentication factor is not high. As the number of times the authentication factor is used increases, the probability of leakage also increases. At the same time, the authentication process is relatively cumbersome, which seriously affects the user experience and reduces the user's work efficiency.

[0029] Therefore, the above method may lead to inaccurate detection of abnormal user behavior.

[0030] In order to improve the accuracy of abnormal behavior detection, the present application provides an abnormal behavior detection method, in which a pre-trained user behavior model is used to determine a real-time baseline of real-time user access data, wherein the pre-trained user behavior model is trained based on historical user access data, and the users corresponding to the historical user access data and the users corresponding to the real-time user access data have the same user portrait, and the real-time baseline is used to indicate the average deviation level of the real-time user access data relative to the historical user access data; then, abnormal behavior detection is performed on the real-time user access data based on the real-time baseline to obtain an abnormal behavior detection result.

[0031] Figure 1 A flow chart of an abnormal behavior detection method provided by an embodiment of the present application is shown, and is described in detail as follows:

[0032] S11. Obtain real-time user access data.

[0033] The above-mentioned real-time user access data refers to the data generated during the user's access to the business system, including one or more of user identity information, access device information, access behavior information, and access business information. The above-mentioned user identity information may include: name, account number, mobile phone number, etc.; the above-mentioned access device information may include: device name, device IP, device user agent (User Agent, UA), etc.; the above-mentioned access behavior information may include: login behavior, authentication behavior, browsing behavior, etc.; the above-mentioned access business information may include: browsed business data, clicked business data, etc.

[0034] Specifically, when a user accesses a business system (such as an information system established and used within an enterprise to perform daily business operations) through a terminal device (such as a computer, mobile phone, etc.), real-time user access data generated during the user access process can be obtained through data embedding or data push, thereby obtaining real-time user access data in a timely manner.

[0035] S12. Determine the real-time access results of the real-time user access data using a pre-trained user behavior model; the real-time access results at least include the real-time access behavior corresponding to the real-time user access data, and the pre-trained user behavior model is trained based on historical user access data, wherein the users corresponding to the historical user access data and the users corresponding to the real-time user access data have the same user portrait.

[0036] The pre-trained user behavior model may be a machine learning model or a neural network model, and the pre-trained user behavior model is used to output the user's real-time access behavior. The user portrait is a virtual user model constructed based on the user access data, and the user portrait may include user attribute data such as user characteristics (such as age, gender, account number, education level, etc.) and user behavior (such as login behavior, access behavior, viewing behavior, etc.), and a certain type of users with the same characteristics or behavior patterns can be found through the user portrait.

[0037] Specifically, after obtaining the real-time user access data, the pre-trained user behavior model can be matched according to the real-time user access data, and the real-time access result corresponding to the real-time user access data can be obtained according to the matched pre-trained user behavior model. Since the pre-trained user behavior model is trained according to the historical user access data, and the user corresponding to the historical user access data and the user corresponding to the real-time user access data have the same user portrait, that is, the pre-trained user behavior model is trained according to the access data of users with the same user characteristics or behavior patterns, the pre-trained user behavior model can accurately output the real-time access behavior of the current user. Among them, the user access behavior can include various behavioral relationships generated during the user access process, and the behavioral relationship can include at least one of the following: user and access device, user and access IP, user and access time, user and access permission, user and access region, and user and usage time. Of course, the real-time access result can also include a quantitative value reflecting the real-time access behavior of the current user. For example, the quantitative value can be a user behavior value, a real-time baseline of the user, etc., which is not limited here.

[0038] It should be noted that in order to improve the accuracy of the prediction of the pre-trained user behavior model, the real-time user access data can be pre-processed, including data cleaning, data classification, data fusion, etc. Among them, the data cleaning is used to perform data standardization processing and data outlier filling on the real-time access data; the data classification is used to classify the data that cannot be quantified according to the actual situation. For example, if someone in a certain enterprise encounters an abnormal problem, similar problems encountered later will be graded according to the degree of difference between similar problems encountered by other people in the enterprise and the abnormal problem; the data fusion is used to fuse real-time user access data from different fields.

[0039] S13: Perform abnormal behavior detection on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data to obtain an abnormal behavior detection result.

[0040] Specifically, the real-time access result and the historical access result can be compared to determine whether they are consistent, and the degree of deviation of the real-time user access data can be determined based on the comparison result. If the degree of deviation is small based on the comparison result, the abnormal behavior detection result is normal behavior. Otherwise, the abnormal behavior detection result is abnormal behavior and an alarm is issued. It should also be noted that the historical access result can also be determined based on a pre-trained user behavior model. The historical access result is similar to the real-time access result and will not be described in detail here.

[0041] The present application performs abnormal behavior detection on real-time user access data through real-time access results and historical user access data, which can improve the accuracy of abnormal behavior detection. Specifically, after obtaining the real-time user access data, the real-time access results of the above-mentioned real-time user access data are determined using a pre-trained user behavior model, and the above-mentioned real-time access results at least include the real-time access behavior corresponding to the real-time user access data. Since the above-mentioned pre-trained user behavior model is trained based on the historical user access data, that is, the above-mentioned pre-trained user behavior model does not require preset risk control rules, the flexibility of abnormal behavior detection can be improved. At the same time, the user corresponding to the above-mentioned historical user access data and the user corresponding to the above-mentioned real-time user access data have the same user portrait, which means that the above-mentioned pre-trained user behavior model can be more specifically adapted to the above-mentioned real-time user access data. Therefore, the above-mentioned real-time access results can be more accurately determined through the above-mentioned pre-trained user behavior model, thereby improving the accuracy of abnormal behavior detection of users through real-time access results and historical access results corresponding to historical user access data.

[0042] In another optional embodiment of the present application, before using the pre-trained user behavior model to determine the real-time access result of the real-time user access data, the method further includes:

[0043] Collect the above historical user access data within a preset time period, and construct a knowledge graph based on the above historical user access data within the preset time period, wherein the above knowledge graph is used to indicate the corresponding relationship between different historical user access data within the preset time period;

[0044] Determine historical behavior data according to the above-mentioned knowledge graph and the preset behavior type, wherein the above-mentioned historical behavior data includes user attribute data of different behavior types;

[0045] Different types of user portraits are constructed according to the above historical behavior data, and the pre-constructed decision tree model is trained using the above different types of user portraits to obtain the above pre-trained user behavior models corresponding to the above different types of user portraits.

[0046] Specifically, historical user access data within a first preset time period can be obtained from the log of historical records, and then the historical user access data can be preprocessed to extract user attribute data and the relationship between user attribute data in the preprocessed historical user access data, and the above-mentioned knowledge graph can be constructed based on the above-mentioned user attribute data and the relationship between user attribute data, and then the above-mentioned knowledge graph can be divided into behaviors according to preset behavior types to obtain corresponding historical behavior data, and multiple types of user portraits can be constructed based on the above-mentioned historical behavior data, and pre-constructed decision tree models can be trained using different types of user portraits to obtain user behavior models corresponding to different types of user portraits. The above-mentioned data preprocessing can refer to the above embodiment and will not be repeated here.

[0047] For example, historical user access data within a first preset time period (e.g., within a week) can be obtained from structured and / or unstructured logs of historical records and data preprocessing can be performed to extract user attribute data (e.g., commonly used regions, accounts, device information, access systems, user behaviors, etc.) and the associations between user attribute data (e.g., if a device logs in in region A, then the IP corresponding to the device is associated with region A), and the above user attribute data is used as an entity, and the associations between the above user attribute data are used as relationship edges to construct a corresponding knowledge graph; then, the user attribute data and associations in the above knowledge graph are summarized according to the preset behavior types to obtain historical behavior data corresponding to different behavior types (e.g., the historical behavior data corresponding to behavior type A includes user attribute data such as commonly used regions, user device information, access systems, behavior types, and the associations corresponding to each user attribute data). Finally, the corresponding user behavior model is trained based on the user portrait constructed from the above historical behavior data to obtain different types of user portraits, wherein the user portrait constructed from the above historical behavior data includes: behavior type, user information, device information, and other data reflecting user characteristics or behavior patterns.

[0048] In the embodiment of the present application, through the knowledge graph and user portrait technology, the historical access data can be better summarized and concluded, and the training data (i.e., user portrait) that truly reflects the user characteristics and behavior patterns can be found, thereby improving the accuracy of the pre-built decision tree model training.

[0049] In an optional embodiment of the present application, the above-mentioned pre-constructed decision tree model can be one of the random forest model, XGBoost, lightGBM model, etc., which is not limited here.

[0050] Correspondingly, in the case where the user behavior model is trained by the user portrait, the above-mentioned determination of the real-time access result of the above-mentioned real-time user access data by using the pre-trained user behavior model includes:

[0051] Determine a user profile corresponding to the real-time user access data, and match the pre-trained user behavior model according to the user profile corresponding to the real-time user access data;

[0052] The real-time user access data is used as an input of the matched pre-trained user behavior model, and the real-time access result corresponding to the real-time user access data is output using the matched pre-trained user behavior model.

[0053] Specifically, the user portrait corresponding to the above real-time user access data can be determined by constructing a knowledge graph, and then the type of user portrait can be matched according to the user portrait corresponding to the above real-time user access data, and the corresponding pre-trained user behavior model can be determined according to the matched user portrait type, and the real-time access result corresponding to the above real-time user access data can be output using the matched pre-trained user behavior model. The process of determining the user portrait by constructing a knowledge graph can refer to the above embodiment, and will not be repeated here.

[0054] In the embodiment of the present application, by matching the pre-trained user behavior model with the user profile of the real-time user access data, a suitable pre-trained user behavior model can be matched more accurately.

[0055] In some embodiments, constructing different types of user portraits based on the historical behavior data and using the different types of user portraits to train a pre-constructed decision tree model includes:

[0056] Clustering the above historical behavior data, and obtaining different types of the above user portraits according to the clustering results, wherein the above user portraits include the association relationship between the user and the user attribute data;

[0057] For any type of the user portrait, user attribute data is selected from the user portrait as a root node according to the association relationship, a histogram corresponding to the root node is calculated, a split feature of the root node and a split point corresponding to the split feature are determined according to the histogram, and the root node is split according to the split feature and the split point corresponding to the split feature to obtain a leaf node after the split;

[0058] For any of the above leaf nodes, calculate the histogram corresponding to the above leaf node, and determine the new splitting feature and the new splitting point according to the histogram corresponding to the above leaf node, split the above leaf node using the new splitting feature and the new splitting point to obtain a new leaf node, and return to the above steps of calculating the histogram corresponding to the above leaf node, and determining the new splitting feature and the new splitting point according to the histogram corresponding to the above leaf node, as well as subsequent steps, until the preset splitting condition is met.

[0059] Specifically, the above historical behavior data can be clustered into clusters of different clustering types through a preset clustering algorithm, and then the user attribute data in the cluster cluster is associated with the user to obtain a user portrait under this cluster type, wherein the above cluster type includes one or more combinations of user type, region type, device type, enterprise type, behavior type, etc. Optionally, the above preset clustering algorithm can be one of the k-means clustering algorithm, hierarchical clustering algorithm, density clustering algorithm, etc., which are not limited here. For example, assuming that the above cluster type is enterprise type, the above historical behavior data is clustered to obtain user portraits of three enterprise types (enterprise type A, enterprise type B and enterprise type C). The user portrait of each enterprise type includes the association relationship between the user and different user attribute data. The above association relationship may include: the relationship between account and device, account and IP, account and commonly used region, account and user authority, account and usage time, etc.

[0060] When training the pre-built decision tree model, for any type of user portrait, first determine the optimal feature (i.e., the above-mentioned user attribute data) as the root node according to the preset decision tree algorithm and the association between the user and the user attribute, then discretize the feature value of the feature in the root node into a fixed number (e.g., k) of intervals (bins) to obtain a histogram of the same width (also k), use the discretized value in the interval as an index to obtain the cumulative statistics of the histogram, then find the splitting feature (i.e., new user attribute data) and splitting point of the user attribute data in the root node according to the cumulative statistics, use the found splitting feature as a leaf node, and split according to the corresponding splitting point; then for each leaf node, continue to determine a new splitting feature and a new splitting point according to the corresponding histogram, and determine a new leaf node according to the new splitting feature and the new splitting point, and iterate the above process continuously, determine the decision tree according to the iterated root node and leaf node, until the preset number of iterations is met, and use the iterated decision tree as the pre-trained user behavior model. It should also be noted that in the process of splitting leaf nodes, a leaf-first growth strategy can be adopted, that is, for each leaf node split out, a leaf node with the largest splitting gain (generally also the largest amount of data corresponding to the splitting feature) is found according to the histogram for splitting, thereby reducing the computational overhead. Optionally, the above-mentioned preset decision tree algorithm can be a classification and regression tree algorithm (Classification and Regression Tree, CART).

[0061] In the embodiment of the present application, the complexity and computational overhead of leaf node splitting calculations in the decision tree can be reduced by using a histogram and a leaf-first growth strategy, thereby improving the training efficiency of the decision tree model.

[0062] It should also be noted that for the trained user behavior model, the user behavior model can be retrained at regular intervals (for example, one week), so that the user behavior model can be continuously updated so that the user behavior model can be more in line with the actual business scenario.

[0063] In some embodiments, the historical access results include historical access behaviors, and the abnormal behavior detection is performed on the real-time user access data according to the real-time access results and the historical access results corresponding to the historical user access data to obtain the abnormal behavior detection results, including:

[0064] The real-time access behavior is compared with the historical access behavior to determine whether they are consistent, and the abnormal behavior detection result is determined based on the comparison result.

[0065] Specifically, the historical access behavior output by the user behavior model at the previous moment (or in a certain period of time) can be used as a comparison benchmark. If the real-time user behavior and the historical access behavior are compared to obtain less than n different comparison results, the abnormal behavior detection result can be determined to be normal behavior. Otherwise, the abnormal behavior detection result is determined to be abnormal behavior and an alarm is issued. Where n is a positive integer greater than or equal to 1.

[0066] For example, assuming that n is set to 2, after comparing the above real-time access behavior with the above historical access behavior, it is determined that the user's login device and login time are inconsistent, then it can be determined that the user behavior is abnormal and an alarm is issued.

[0067] In the embodiment of the present application, since the user access model is trained based on the same user profile, it can be ensured that the real-time access behavior and the above-mentioned historical access behavior are from users with the same user profile. Taking the historical access behavior previously output by the user behavior model as a comparison benchmark can improve the accuracy of abnormal behavior detection.

[0068] In another optional embodiment of the present application, since user behavior may suddenly change due to business needs (for example, a temporary business trip may cause changes in the access region, access time, etc.), the pre-trained user behavior model may not be updated in time. Therefore, before performing abnormal behavior detection on the real-time user access data according to the real-time access results and the historical access results corresponding to the historical user access data, it also includes:

[0069] The pre-trained user behavior model is model-verified according to the real-time verification data to obtain a real-time model verification result; wherein the real-time verification data includes the real-time user access data, and the real-time model verification result is used to reflect the performance of the pre-trained user behavior model.

[0070] Specifically, real-time user access data and historical user access data within a second preset time period before the real-time user access data can be selected as real-time verification data, and the user behavior model is verified by the real-time verification data, and the output of the user behavior model is used as the real-time model verification result. Since the real-time verification data includes the real-time user access data at the current moment and the historical user data within the second preset time period before the current moment, that is, the real business data closer to the current moment is used in the user behavior model verification, the above real-time model verification result can more accurately evaluate the model performance of the user behavior model at the current moment.

[0071] It should be noted that in order to improve the accuracy of user behavior model verification, the second preset time period of historical user access data selected during user behavior model verification can be less than or equal to the first preset time period of historical user access data selected during user behavior model training, thereby increasing the amount of data during user behavior model verification and avoiding inaccurate model performance verification caused by insufficient data. For example, when training a user behavior model, historical user access data from the past week can be selected, while when verifying a user behavior model, historical user access data from the past three days can be selected.

[0072] Optionally, the above model validation includes a Holdout test, a cross validation (eg, K-fold cross validation), etc., which is not limited here.

[0073] In some embodiments, the real-time access result further includes a real-time baseline corresponding to the real-time user access behavior, and the real-time baseline is used to indicate an average level of the real-time access behavior corresponding to the real-time user access data;

[0074] Correspondingly, the above-mentioned abnormal behavior detection on the above-mentioned real-time user access data according to the above-mentioned real-time access result and the historical access result corresponding to the above-mentioned historical user access data includes:

[0075] When the real-time model verification result indicates that the performance of the pre-trained user behavior model passes, determining the real-time baseline according to the real-time model verification result;

[0076] The real-time user access data is subjected to abnormal behavior detection based on the real-time baseline and the historical baseline corresponding to the historical user access data; the historical baseline is used to indicate the average level of historical access behaviors corresponding to the historical user access data.

[0077] Specifically, when the above real-time model verification result indicates that the performance of the pre-trained user behavior model has passed, since the user access data of a more recent time period can be used in the model verification process, a more accurate real-time baseline can be obtained according to the real-time model verification result, that is, a quantitative value reflecting the average level of the current user's real-time access behavior. At this time, the historical baseline of the previous moment can be obtained as a comparison benchmark, and the above real-time user access data can be detected for abnormal behavior based on the degree of deviation between the real-time baseline and the historical baseline. The higher the degree of deviation between the real-time baseline and the historical baseline, the greater the risk of abnormal user behavior.

[0078] It should be noted that, when the real-time model verification result indicates that the performance of the pre-trained user behavior model does not pass, an alarm may be issued and manual judgment may be made.

[0079] In some embodiments, the pre-trained user behavior model is validated according to the real-time validation data to obtain a real-time model validation result, including:

[0080] Dividing the real-time verification data into k verification data sets, and instantiating the pre-trained user behavior model into k identical user behavior models, where k is a positive integer greater than 1;

[0081] For any of the above user behavior models, one of the above verification data sets is sequentially combined as a verification set, and the remaining k-1 of the above verification data sets are combined as a training set, the above user behavior model is trained using the above training set, and the verification result corresponding to the above verification set is output using the trained user behavior model;

[0082] The real-time model verification result is determined based on the k verification results.

[0083] Specifically, the above real-time verification data is divided into k verification data sets, assuming that the obtained verification data sets are Y1~Yk, and the pre-trained user behavior model is instantiated into k identical user behavior models, where k≥1. For the first user behavior model, the verification data set Y1 is used as the verification set, and the verification data sets Y2~Yk are used as the training set; for the second user behavior model, the verification data set Y2 is used as the verification set, and the verification data sets Y1, Y3~Yk are used as the training set, and so on, and the corresponding user behavior model is trained using the training set, and the verification result corresponding to the verification set is output using the trained user behavior model, and then the average value of the k above verification results is used as the real-time model verification result.

[0084] In an embodiment of the present application, by expanding the above-mentioned real-time verification data into k verification data sets and verifying k user behavior models respectively, the amount of data during user behavior model verification can be increased and the accuracy of real-time model verification results can be improved.

[0085] In an optional embodiment of the present application, when determining the real-time baseline based on the real-time verification results, the mean square error of k of the above verification results can be calculated, and then the final score is calculated using a preset risk score formula, and the final score is the above real-time baseline. For example, the above preset risk score formula can be: Among them, Score is the calculated real-time baseline, and RMSE is the mean square error of the k verification results. Since the k verification results are also the output results of the user behavior model, they can reflect the real-time access behavior corresponding to the user access data at a more recent moment. Therefore, determining the real-time baseline based on the mean square error of the k verification results can more accurately determine the average level of the real-time access behavior corresponding to the real-time user access data. It should be noted that the real-time baseline obtained can be used as the historical baseline for subsequent verification.

[0086] In some embodiments, the abnormal behavior detection of the real-time user access data according to the real-time baseline and the historical baseline corresponding to the historical user access data includes:

[0087] Calculate the difference between the real-time baseline and the historical baseline;

[0088] The real-time user access data is subjected to abnormal behavior detection according to the preset threshold range within which the difference falls.

[0089] Specifically, the difference between the real-time baseline and the historical baseline is calculated, and then the preset threshold range in which the difference falls is determined, and the corresponding abnormal behavior strategy is determined according to the preset threshold range in which it falls, wherein the preset threshold range may be 1 or more than 1. In the case where the preset threshold range is 1, if the difference is within the preset threshold range, it indicates that there is no abnormal user behavior, and if the difference is not within the preset threshold range, it indicates that there is abnormal user behavior. In the case where there are more than 1 preset threshold range, each preset threshold range may be a continuous threshold interval, and different threshold intervals may correspond to different abnormal behavior detection results. For example, assuming that the preset threshold range is three consecutive threshold intervals, if the above difference falls into the first preset threshold range (for example, [0, 0.45)), it is determined that there is no abnormal user behavior; if the above difference falls into the second preset threshold range (for example, [0.45, 0.75)), it is determined that there may be abnormal user behavior, and a secondary verification is performed, that is, the pre-trained user behavior model is reused to determine the real-time baseline of the real-time user access data and perform subsequent judgments; if the above difference falls into the third preset threshold range (for example, [0.75, 1]), it is determined that there is abnormal user behavior, and an alarm is issued.

[0090] In the embodiment of the present application, different abnormal behavior strategies can be determined by the preset threshold range within which the difference between the real-time baseline and the historical baseline falls, thereby improving the flexibility of abnormal behavior detection.

[0091] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0092] Corresponding to the abnormal behavior detection method described in the above embodiment, Figure 2 A schematic diagram of the structure of an abnormal behavior detection device provided in an embodiment of the present application is shown. For the sake of convenience of explanation, only the parts related to the embodiment of the present application are shown.

[0093] Reference Figure 2 The device may be an abnormal behavior detection device 21, and the abnormal behavior detection device 21 may include a real-time data acquisition module 211, a real-time result determination module 212 and an abnormal behavior detection module 213.

[0094] Reference Figure 2 , the abnormal behavior detection device 21 comprises:

[0095] The above-mentioned real-time data acquisition module 211 is used to acquire real-time user access data;

[0096] The real-time result determination module 212 is used to determine the real-time access result of the real-time user access data using a pre-trained user behavior model; the real-time access result at least includes the real-time access behavior corresponding to the real-time user access data, and the pre-trained user behavior model is trained based on historical user access data, wherein the user corresponding to the historical user access data and the user corresponding to the real-time user access data have the same user profile;

[0097] The abnormal behavior detection module 213 is used to perform abnormal behavior detection on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data to obtain an abnormal behavior detection result.

[0098] In another optional embodiment of the present application, the abnormal behavior detection device 21 further includes a model training module, which is used to use a pre-trained user behavior model to determine the real-time access result of the real-time user access data, including:

[0099] Collect the above historical user access data within a preset time period, and construct a knowledge graph based on the above historical user access data within the preset time period, wherein the above knowledge graph is used to indicate the corresponding relationship between different historical user access data within the preset time period;

[0100] Determine historical behavior data according to the above-mentioned knowledge graph and the preset behavior type, wherein the above-mentioned historical behavior data includes user attribute data of different behavior types;

[0101] Different types of user portraits are constructed according to the above historical behavior data, and the pre-constructed decision tree model is trained using the above different types of user portraits to obtain the above pre-trained user behavior models corresponding to the above different types of user portraits.

[0102] Correspondingly, in the case where the user behavior model is trained by the user portrait, the real-time result determination module 212 determines the real-time access result of the real-time user access data by using the pre-trained user behavior model, including:

[0103] Determine a user profile corresponding to the real-time user access data, and match the pre-trained user behavior model according to the user profile corresponding to the real-time user access data;

[0104] The real-time user access data is used as an input of the matched pre-trained user behavior model, and the real-time access result corresponding to the real-time user access data is output using the matched pre-trained user behavior model.

[0105] In some embodiments, when the model training module constructs different types of user portraits according to the historical behavior data and uses the different types of user portraits to train a pre-constructed decision tree model, it includes:

[0106] Clustering the above historical behavior data, and obtaining different types of the above user portraits according to the clustering results, wherein the above user portraits include the association relationship between the user and the user attribute data;

[0107] For any type of the user portrait, user attribute data is selected from the user portrait as a root node according to the association relationship, a histogram corresponding to the root node is calculated, a split feature of the root node and a split point corresponding to the split feature are determined according to the histogram, and the root node is split according to the split feature and the split point corresponding to the split feature to obtain a leaf node after the split;

[0108] For any of the above leaf nodes, calculate the histogram corresponding to the above leaf node, and determine the new splitting feature and the new splitting point according to the histogram corresponding to the above leaf node, split the above leaf node using the new splitting feature and the new splitting point to obtain a new leaf node, and return to the above steps of calculating the histogram corresponding to the above leaf node, and determining the new splitting feature and the new splitting point according to the histogram corresponding to the above leaf node, as well as subsequent steps, until the preset splitting condition is met.

[0109] In some embodiments, the historical access results include historical access behaviors. When the abnormal behavior detection module 213 performs abnormal behavior detection on the real-time user access data according to the real-time access results and the historical access results corresponding to the historical user access data, and obtains the abnormal behavior detection results, it includes:

[0110] The real-time access behavior is compared with the historical access behavior to determine whether they are consistent, and the abnormal behavior detection result is determined based on the comparison result.

[0111] In another optional embodiment of the present application, since each time the user behavior model is trained, historical user access data before the real-time user access data is selected for training, the user behavior model training may be inaccurate, so the abnormal behavior detection device 21 further includes a model verification module, and the model verification module is used to, before performing abnormal behavior detection on the real-time user access data according to the real-time baseline, include:

[0112] The pre-trained user behavior model is verified according to the real-time verification data to obtain a real-time model verification result; wherein the real-time verification data includes the real-time user access data, and the real-time model verification result is used to reflect the performance of the pre-trained user behavior model.

[0113] Correspondingly, the real-time access result also includes a real-time baseline corresponding to the real-time user access behavior, and the real-time baseline is used to indicate the average level of the real-time access behavior corresponding to the real-time user access data; when the abnormal behavior detection module 213 performs abnormal behavior detection on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data, it includes:

[0114] When the real-time model verification result indicates that the performance of the pre-trained user behavior model passes, determining the real-time baseline according to the real-time model verification result;

[0115] The real-time user access data is subjected to abnormal behavior detection based on the real-time baseline and the historical baseline corresponding to the historical user access data; the historical baseline is used to indicate the average level of historical access behaviors corresponding to the historical user access data.

[0116] In some embodiments, in order to further improve the accuracy of user behavior model verification, the model verification module performs model verification on the pre-trained user behavior model according to real-time verification data to obtain a real-time model verification result, including:

[0117] Dividing the real-time verification data into k verification data sets, and instantiating the pre-trained user behavior model into k identical user behavior models, where k is a positive integer greater than 1;

[0118] For any of the above user behavior models, one of the above verification data sets is sequentially combined as a verification set, and the remaining k-1 of the above verification data sets are combined as a training set, the above user behavior model is trained using the above training set, and the verification result corresponding to the above verification set is output using the trained user behavior model;

[0119] The real-time model verification result is determined based on the k verification results.

[0120] In some embodiments, when the abnormal behavior detection module 213 performs abnormal behavior detection on the real-time user access data according to the real-time baseline and the historical baseline corresponding to the historical user access data, the abnormal behavior detection module 213 includes:

[0121] Calculate the difference between the real-time baseline and the historical baseline;

[0122] The real-time user access data is subjected to abnormal behavior detection according to the preset threshold range within which the difference falls.

[0123] It should be noted that the information interaction, execution process, etc. between the devices / units are based on the same concept as the method embodiments of the present application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0124] Figure 3 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Figure 3 As shown, the electronic device 3 of this embodiment includes: at least one processor 30 ( Figure 3 The at least one processor 30 includes a memory 31 and a computer program 32 stored in the memory 31 and executable on the at least one processor 30. When the processor 30 executes the computer program 32, the steps in any of the method embodiments are implemented.

[0125] The electronic device 3 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The electronic device may include, but is not limited to, a processor 30 and a memory 31. Those skilled in the art will appreciate that Figure 3 It is only an example of the electronic device 3 and does not constitute a limitation of the electronic device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include an input sending device, a network access device, a bus, etc.

[0126] The processor 30 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0127] In some embodiments, the memory 31 may be an internal storage unit of the electronic device 3, such as a hard disk or memory of the electronic device 3. The memory 31 may also be an external storage device of the electronic device 3, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 3. Further, the memory 31 may also include both an internal storage unit of the electronic device 3 and an external storage device. The memory 31 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 31 may also be used to temporarily store data that has been sent or is to be sent.

[0128] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the functional units and modules is used as an example. In practical applications, the function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0129] An embodiment of the present application also provides a network device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps in any of the method embodiments when executing the computer program.

[0130] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the various method embodiments can be implemented.

[0131] An embodiment of the present application provides a computer program product. When the computer program product runs on an electronic device, the electronic device can implement the steps in the various method embodiments when executing the computer program product.

[0132] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process in the embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera / electronic device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0133] In the embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0134] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0135] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0136] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for detecting abnormal behavior, characterized in that: include: Get real-time user access data; Determine the real-time access result of the real-time user access data by using a pre-trained user behavior model; The real-time access result at least includes the real-time access behavior corresponding to the real-time user access data, and the pre-trained user behavior model is trained based on the historical user access data, wherein the user corresponding to the historical user access data and the user corresponding to the real-time user access data have the same user portrait; An abnormal behavior detection is performed on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data to obtain an abnormal behavior detection result.

2. The abnormal behavior detection method according to claim 1, characterized in that: Before determining the real-time access result of the real-time user access data by using the pre-trained user behavior model, the method further includes: Collect the historical user access data within a preset time period, and construct a knowledge graph based on the historical user access data within the preset time period, wherein the knowledge graph is used to indicate the corresponding relationship between different historical user access data within the preset time period; Determining historical behavior data according to the knowledge graph and the preset behavior type, wherein the historical behavior data includes user attribute data of different behavior types; Constructing different types of user portraits according to the historical behavior data, and using the different types of user portraits to train the pre-constructed decision tree model to obtain the pre-trained user behavior models corresponding to the different types of user portraits; The determining the real-time access result of the real-time user access data by using the pre-trained user behavior model includes: Determine a user profile corresponding to the real-time user access data, and match the pre-trained user behavior model according to the user profile corresponding to the real-time user access data; The real-time user access data is used as an input of the matched pre-trained user behavior model, and the matched pre-trained user behavior model is used to output the real-time access result corresponding to the real-time user access data.

3. The abnormal behavior detection method according to claim 2, characterized in that: The constructing different types of user portraits according to the historical behavior data, and using the different types of user portraits to train a pre-constructed decision tree model, includes: Clustering the historical behavior data, and obtaining different types of user portraits according to the clustering results, wherein the user portraits include associations between users and the user attribute data; For any type of the user portrait, user attribute data is selected from the user portrait as a root node according to the association relationship, a histogram corresponding to the root node is calculated, a split feature of the root node and a split point corresponding to the split feature are determined according to the histogram, and the root node is split according to the split feature and the split point corresponding to the split feature to obtain leaf nodes after the split; For any of the leaf nodes, the histogram corresponding to the leaf node is calculated, and a new splitting feature and a new splitting point are determined according to the histogram corresponding to the leaf node, the leaf node is split using the new splitting feature and the new splitting point to obtain a new leaf node, and the steps of calculating the histogram corresponding to the leaf node and determining the new splitting feature and the new splitting point according to the histogram corresponding to the leaf node and subsequent steps are returned until the preset splitting condition is met.

4. The abnormal behavior detection method according to any one of claims 1 to 3, characterized in that: The historical access result includes historical access behavior, and abnormal behavior detection is performed on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data to obtain the abnormal behavior detection result, including: The real-time access behavior is compared with the historical access behavior to determine whether they are consistent, and the abnormal behavior detection result is determined according to the comparison result.

5. The abnormal behavior detection method according to any one of claims 1 to 3, characterized in that: The real-time access result also includes a real-time baseline corresponding to the real-time user access behavior, and the real-time baseline is used to indicate an average level of the real-time access behavior corresponding to the real-time user access data; Before performing abnormal behavior detection on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data, the method further includes: Performing model verification on the pre-trained user behavior model according to the real-time verification data to obtain a real-time model verification result; wherein the real-time verification data includes the real-time user access data, and the real-time model verification result is used to reflect the performance of the pre-trained user behavior model; The performing abnormal behavior detection on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data includes: In a case where the real-time model verification result indicates that the performance of the pre-trained user behavior model passes, determining the real-time baseline according to the real-time model verification result; The real-time user access data is subjected to abnormal behavior detection according to the real-time baseline and the historical baseline corresponding to the historical user access data; the historical baseline is used to indicate the average level of historical access behaviors corresponding to the historical user access data.

6. The abnormal behavior detection method according to claim 5, characterized in that: The performing model verification on the pre-trained user behavior model according to the real-time verification data to obtain a real-time model verification result includes: Dividing the real-time verification data into k verification data sets, and instantiating the pre-trained user behavior model into k identical user behavior models, where k is a positive integer greater than 1; For any of the user behavior models, one of the verification data sets is sequentially combined as a verification set, and the remaining k-1 verification data sets are combined as a training set, the user behavior model is trained using the training set, and the verification result corresponding to the verification set is output using the trained user behavior model; The real-time model verification result is determined according to the k verification results.

7. The abnormal behavior detection method according to claim 5, characterized in that: The performing abnormal behavior detection on the real-time user access data according to the real-time baseline and the historical baseline corresponding to the historical user access data includes: Calculating the difference between the real-time baseline and the historical baseline; Abnormal behavior detection is performed on the real-time user access data according to a preset threshold range within which the difference falls.

8. An abnormal behavior detection device, characterized in that: include: Real-time data acquisition module, used to obtain real-time user access data; A real-time result determination module, used to determine the real-time access result of the real-time user access data using a pre-trained user behavior model; the real-time access result at least includes the real-time access behavior corresponding to the real-time user access data, the pre-trained user behavior model is trained based on historical user access data, wherein the user corresponding to the historical user access data and the user corresponding to the real-time user access data have the same user portrait; The abnormal behavior detection module is used to perform abnormal behavior detection on the real-time user access data according to the real-time access result and the historical access result corresponding to the historical user access data to obtain an abnormal behavior detection result.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed.

Images