Data processing method, device and equipment

Abstract

The embodiment of the invention provides a data processing method, device and equipment, and the method comprises the steps: receiving a risk detection request for a target user; in response to the risk detection request, obtaining log data including an operation behavior of the target user; based on the operation behaviors of the target user contained in the log data, target graph structure data is determined, and the target graph structure data comprises target nodes determined according to the operation behaviors and edges between the nodes determined according to the logic relation between the operation behaviors; performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; and according to a large language model, based on the target map embedding vector and the target information, determining whether the target user is a risk user.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a data processing method, device and equipment. Background Art

[0002] As people pay more and more attention to their private data, in order to protect user privacy and ensure data security, it is necessary to detect whether users are risky users to ensure data security during business execution. For example, security personnel can manually analyze user data to detect whether users are risky users.

[0003] However, as the data structure of user data becomes more and more complex and the amount of data becomes larger and larger, the detection efficiency and accuracy of risk detection by manual analysis are low. To this end, the embodiments of this specification provide a better technical solution for risk detection of users. Summary of the invention

[0004] The purpose of the embodiments of this specification is to provide a better technical solution for risk detection of users.

[0005] In order to implement the above technical solution, the embodiments of this specification are implemented as follows: A data processing method provided by an embodiment of the present specification includes: receiving a risk detection request for a target user; in response to the risk detection request, obtaining log data containing the operation behavior of the target user; determining target graph structure data based on the operation behavior of the target user contained in the log data, the target graph structure data including target nodes determined according to the operation behavior, and edges between nodes determined according to logical relationships between the operation behaviors; performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; determining whether the target user is a risky user based on the target graph embedding vector and the target information according to a large language model.

[0006] A data processing device provided by an embodiment of the present specification includes: a request receiving module, which is used to receive a risk detection request for a target user; a first acquisition module, which is used to obtain log data containing the operation behavior of the target user in response to the risk detection request; a first determination module, which is used to determine target graph structure data based on the operation behavior of the target user contained in the log data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; a first extraction module, which is used to perform feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and perform key information extraction processing on the log data to obtain target information; a risk detection module, which is used to determine whether the target user is a risky user based on a large language model, the target graph embedding vector and the target information.

[0007] A data processing device provided in an embodiment of the present specification includes: a processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to: receive a risk detection request for a target user; obtain log data containing the operation behavior of the target user in response to the risk detection request; determine target graph structure data based on the operation behavior of the target user contained in the log data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; perform feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and perform key information extraction processing on the log data to obtain target information; determine whether the target user is a risky user based on the target graph embedding vector and the target information according to a large language model.

[0008] An embodiment of the present specification also provides a storage medium, which is used to store computer-executable instructions, and the executable instructions implement the following process when executed by a processor: receiving a risk detection request for a target user; in response to the risk detection request, obtaining log data containing the operation behavior of the target user; determining target graph structure data based on the operation behavior of the target user contained in the log data, the target graph structure data containing target nodes determined according to the operation behavior, and edges between nodes determined according to the logical relationship between the operation behaviors; performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; determining whether the target user is a risky user based on the target graph embedding vector and the target information according to a large language model.

[0009] The embodiments of the present specification also provide a computer program product, including a computer program, which implements the following process when executed by a processor: receiving a risk detection request for a target user; in response to the risk detection request, obtaining log data containing the operation behavior of the target user; determining target graph structure data based on the operation behavior of the target user contained in the log data, the target graph structure data containing target nodes determined according to the operation behavior, and edges between nodes determined according to the logical relationship between the operation behaviors; performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; determining whether the target user is a risky user based on the target graph embedding vector and the target information according to a large language model. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the drawings required for use in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative labor. Figure 1 This is an embodiment of a data processing method of this specification; Figure 2 A schematic diagram of a data processing process of this specification; Figure 3 This is another data processing method embodiment of the present specification; Figure 4 This is another data processing method embodiment of the present specification; Figure 5 A schematic diagram of a data processing process of this specification; Figure 6 This is an embodiment of a data processing device of the present specification; Figure 7 This is an embodiment of a data processing device in this specification. DETAILED DESCRIPTION

[0011] The embodiments of this specification provide a data processing method, device and equipment.

[0012] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0013] The embodiments of this specification provide a detection mechanism for whether a user is a risky user. As people pay more and more attention to their own privacy data, in order to protect user privacy and ensure data security, it is necessary to detect whether the user is a risky user to ensure data security during business execution. For example, security personnel can manually analyze user data to detect whether the user is a risky user. However, as the data structure of user data becomes more and more complex and the amount of data becomes larger and larger, the detection efficiency and accuracy of risk detection through manual analysis are low. To this end, the embodiment of this specification provides a better technical solution for risk detection of users, in which, by receiving a risk detection request for a target user, in response to the risk detection request, log data containing the target user's operation behavior is obtained, and based on the target user's operation behavior contained in the log data, the target graph structure data is determined, wherein the target graph structure data may include a target node determined according to the operation behavior, and an edge between nodes determined according to the logical relationship between the operation behaviors, feature extraction processing is performed on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and key information extraction processing is performed on the log data to obtain target information, and based on the target graph embedding vector and the target information, it is determined whether the target user is a risk user according to a large language model. In this way, on the one hand, since the log data contains a lot of content, the target user's operation behavior can be extracted from the log data, and a target graph structure data with a small volume and clear structure can be constructed to improve the subsequent detection efficiency and detection accuracy of risk detection based on the target graph structure data. On the other hand, since the target information containing key information is a natural language that can be understood by the large language model, and the target graph embedding vector determined according to the target graph structure data contains the logical relationship between the operation behaviors, the accuracy and efficiency of risk detection for users can be improved through the large language model based on the target information and the target graph embedding vector. For specific processing, please refer to the specific content in the following embodiment.

[0014] like Figure 1As shown, the embodiment of this specification provides a data processing method, the execution subject of the method can be a server, wherein the server can be an independent server, or a server cluster composed of multiple servers, etc. The server can be a background server for financial services or online shopping services, or a background server for an application, etc. In this embodiment, the execution subject is taken as an example for detailed description, and the method can specifically include the following steps: In step S102, a risk detection request for a target user is received.

[0015] Among them, the target user can be any user to be detected, for example, the target user can be the user who triggers the execution of a certain business, or the target user can also be a user related to the execution of a certain business. Specifically, the target user can be the user who triggers the execution of a resource transfer business, or the target user can also be the resource transfer object in the resource transfer business.

[0016] In implementation, upon receiving a trigger execution instruction for a certain service, the server may determine a user corresponding to the service and determine the user as a target user, that is, the server may receive a risk detection request for the target user.

[0017] For example, when the server receives a trigger execution instruction from user 1 for a resource transfer service for user 2, the server may determine user 1 and / or user 2 as target users.

[0018] Alternatively, when the server receives a trigger execution instruction from user 1 for the information sharing service of user 2, the server may also determine user 1 and / or user 2 as target users.

[0019] Alternatively, when the server receives a trigger execution instruction from user 1 for a database access service, the server may determine user 1 as a target user.

[0020] The above-mentioned method for determining the target user is an optional and feasible determination method. In addition, there may be multiple determination methods. Different determination methods can be selected according to different actual application scenarios. The embodiments of this specification do not make specific limitations on this.

[0021] In step S104, in response to the risk detection request, log data including the operation behavior of the target user is obtained.

[0022] In implementation, in response to a risk detection request, the server may obtain log data containing the target user's operation behavior within a preset detection period, wherein the preset detection period may be any detection period such as the past one day or the past three days.

[0023] Alternatively, the server may also obtain log data related to the target user triggering the execution of a certain service. For example, taking the target user as the user triggering the execution of a resource transfer service, the server may obtain log data of the target user triggering the execution of the resource transfer service.

[0024] In step S106 , target graph structure data is determined based on the operation behavior of the target user included in the log data.

[0025] Among them, the target graph structure data may include target nodes determined according to the operation behavior, and edges between nodes determined according to the logical relationship between the operation behaviors. The target graph structure data may be knowledge graph data, that is, the target graph structure data may be graph structure data for representing and organizing knowledge, which may include entities, attributes and relationships, and can be used to describe the association between things. The target graph structure data may be NEO4J (high-performance image database) graph data.

[0026] In implementation, the server can preprocess the log data and determine the target graph structure data based on the operation behavior of the target user contained in the preprocessed log data, wherein the preprocessing may include regularization processing, redundant information removal processing, etc. In this way, by preprocessing the log data, the efficiency of subsequent data processing can be improved.

[0027] Specifically, the server can unify the format of the log data based on a preset format, and then remove redundant sentences and redundant behavior information in the log data. Finally, the server can rearrange and divide the log data according to different processes, the thread identifiers contained in each process, and the logical relationship of the operation behavior, so as to construct the target graph structure data.

[0028] The logical relationship between the operation behaviors may include a trigger sequence relationship, a data call relationship, a behavior association relationship, etc. between the operation behaviors.

[0029] In step S108, feature extraction processing is performed on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and key information extraction processing is performed on the log data to obtain target information.

[0030] During implementation, the server can perform feature extraction processing on the target graph structure data through a pre-trained feature extraction model to obtain a target graph embedding vector corresponding to the target graph structure data, wherein the feature extraction model can be a model built based on a preset deep learning algorithm.

[0031] For example, the server can construct a feature extraction model through an encoder and a decoder, and train the feature extraction model through the historical graph structure data and the corresponding historical graph embedding vector to obtain a trained feature extraction model. Then, the server can perform feature extraction processing on the target graph structure data according to the encoder in the trained feature extraction model to obtain the target graph embedding vector corresponding to the target graph structure data.

[0032] In addition, the above is to obtain the target graph embedding vector by performing feature extraction processing on the target graph structure data according to the feature extraction model constructed by the deep learning algorithm. In actual application scenarios, there can be multiple methods for determining the target graph embedding vector, and different determination methods can be selected according to different actual application scenarios. The embodiments of this specification do not make specific limitations on this.

[0033] The server can extract key information from the log data using a pre-trained information extraction model to obtain target information, wherein the information extraction model can be a model built based on a preset machine learning algorithm.

[0034] Alternatively, the server may also perform key information extraction and processing on the log data through a large language model to obtain target information. In addition, there may be a variety of different key information extraction and processing methods. Different key information extraction methods may be selected according to different actual application scenarios. The embodiments of this specification do not make specific limitations on this.

[0035] In step S110, according to the large language model, based on the target graph embedding vector and the target information, it is determined whether the target user is a risky user.

[0036] Among them, large language models (LLMs) can be advanced natural language processing (NLP) models built on the basis of deep learning technology. Large language models have a large number of parameters and a wide range of training data sets. They have strong capabilities in language understanding and generation tasks and can be effectively applied to text generation, machine translation, content summarization, question-answering systems and a variety of complex dialogue scenarios. Large language models can capture the richness and subtle differences of language expressions, and can display the captured information through powerful computing capabilities of billions to trillions of parameters.

[0037] In implementation, the server may integrate the target embedding vector and the target information, and then determine whether the target user is a risky user based on the large language model, preset prompt information and the information obtained through the integration process.

[0038] In fact, the preset prompt information can be determined according to the detection requirements of the target user. For example, taking the target user as the user who triggers the execution of a database access business, it is possible to detect whether the access behavior of the target user has risks, that is, the corresponding preset prompt information can be "Please describe whether the access behavior of the target user is an attack behavior. If it is an attack behavior, please describe the attack source, attack range and attack description."

[0039] The embodiment of this specification provides a data processing method, which receives a risk detection request for a target user, responds to the risk detection request, obtains log data containing the target user's operation behavior, determines target graph structure data based on the target user's operation behavior contained in the log data, wherein the target graph structure data may include a target node determined according to the operation behavior, and an edge between nodes determined according to a logical relationship between the operation behaviors, performs feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, performs key information extraction processing on the log data to obtain target information, and determines whether the target user is a risk user based on the target graph embedding vector and the target information according to a large language model. In this way, on the one hand, since the log data contains a lot of content, the target user's operation behavior can be extracted from the log data, and a target graph structure data with a small volume and clear structure can be constructed to improve the detection efficiency and detection accuracy of subsequent risk detection based on the target graph structure data. On the other hand, since the target information containing key information is a natural language that can be understood by the large language model, and the target graph embedding vector determined according to the target graph structure data contains the logical relationship between the operation behaviors, the accuracy and efficiency of risk detection for users can be improved through the large language model based on the target information and the target graph embedding vector.

[0040] In practical applications, there are various specific processing methods for determining the target graph structure data based on the target user's operation behavior contained in the log data in step S106. An optional processing method is provided below, such as Figure 2 As shown, the processing may specifically include the following steps S1062 to S1064.

[0041] In step S1062, clustering is performed on the operation behaviors of the target user contained in the log data to obtain a first clustering result, and events contained in the log data are determined based on the first clustering result.

[0042] In implementation, the server may determine each class included in the first clustering result as an event.

[0043] In practical applications, in the above step S1062, the operation behaviors of the target user contained in the log data are clustered, and the specific processing method for obtaining the first clustering result can be various. The following provides an optional processing method, which can specifically include the following steps A1 to A3.

[0044] In step A1, first graph structure data is determined based on thread information corresponding to the operation behavior of the target user contained in the log data.

[0045] The first graph structure data may include a first node determined according to thread information, and edges between nodes determined according to logical relationships between threads.

[0046] In step A2, the second node in the first node is determined according to the out-degree information and / or in-degree information of each first node in the first graph structure data.

[0047] In implementation, the server can determine the node association between the first node and other first nodes based on the out-degree information and / or in-degree information of the first node, and then the server can filter out the nodes with higher association between the first nodes and other first nodes as the second nodes based on a preset association threshold.

[0048] In step A3, clustering is performed on the second nodes to obtain a second clustering result, and the first clustering result is determined based on the second clustering result.

[0049] In implementation, the server may perform clustering processing on the second nodes according to a preset clustering algorithm (such as a k-means algorithm, etc.) to obtain a second clustering result.

[0050] The server may determine the second clustering result as the first clustering result, or the server may filter the second clustering result and determine the first clustering result according to the filtered second clustering result.

[0051] For example, the server may filter the second clustering results according to the number of second nodes contained in each class in the second clustering results. Specifically, the server may filter out classes in the second clustering results whose number of second nodes is greater than a preset number threshold, for determining the first clustering results.

[0052] In step S1064, target nodes in the target graph structure data are constructed according to the events, and edges between nodes in the target graph structure data are determined according to the logical relationships between the events.

[0053] In practical applications, in step S108, the target graph structure data is subjected to feature extraction processing to obtain a target graph embedding vector corresponding to the target graph structure data. There are many specific processing methods. An optional processing method is provided below, such as Figure 2 As shown, the processing may specifically include the following step S1082.

[0054] In step S1082, feature extraction is performed on the target graph structure data according to the pre-trained feature extraction model to obtain a target graph embedding vector corresponding to the target graph structure data, and key information extraction is performed on the log data to obtain target information.

[0055] Among them, the feature extraction model can be a model built based on the Heterogeneous Graph Attention Network (HAN) algorithm. The HAN algorithm can fully capture the rich semantic information in the heterogeneous graph by introducing node-level attention and semantic-level attention.

[0056] In implementation, the server can build a feature extraction model based on the HAN algorithm and the Graph Neural Network (GNN) algorithm. In this way, feature extraction processing can be performed through the feature extraction model built by the HAN algorithm, so that when the nodes have multiple types, the GNN network can fully understand the relationship between the nodes.

[0057] In practical applications, before determining the risk type corresponding to the operation behavior based on the target graph embedding vector and the target information according to the large language model, the large language model can also be fine-tuned. The specific processing methods of the fine-tuning processing can be various. The following is an optional processing method, such as Figure 3 As shown, the processing may specifically include the following steps S302 to S312.

[0058] In step S302, a pre-trained large language model is obtained.

[0059] During implementation, the server may pre-train the large language model using sample data with a large amount of data to obtain a pre-trained large language model.

[0060] In step S304, historical log data and a first risk type corresponding to the user's operation behavior contained in the historical log data are obtained.

[0061] In step S306, second graph structure data is determined based on the user's operation behavior included in the historical log data.

[0062] The second graph structure data may include nodes determined according to the operation behaviors in the historical log data, and edges between the nodes determined according to the logical relationships between the operation behaviors in the historical log data.

[0063] In step S308, feature extraction processing is performed on the second graph structure data to obtain a first graph embedding vector corresponding to the second graph structure data, and key information extraction processing is performed on the historical log data to obtain first key information.

[0064] In implementation, the specific processing procedure of the above step S308 can refer to the processing procedure of the above step S108, which will not be repeated here.

[0065] In step S310, according to the pre-trained large language model, based on preset prompt information, the first graph embedding vector and the first key information, a second risk type corresponding to the user's operation behavior contained in the historical log data is determined.

[0066] In actual applications, in step S310, according to the pre-trained large language model, based on the preset prompt information, the first graph embedding vector and the first key information, the specific processing method for determining the second risk type corresponding to the user's operation behavior contained in the historical log data can be varied. An optional processing method is provided below, which can specifically include the processing of the following steps B1~B2.

[0067] In step B1, a plurality of sub-prompt information having a logical reasoning relationship and corresponding to the preset prompt information is generated according to the detection requirements corresponding to the target user.

[0068] In implementation, the server can use the Chain of Thought (CoT) idea to decompose the preset prompt information into multiple sub-prompt information, and gradually guide the large language model to solve these sub-prompt information, thereby improving the reasoning and adaptability of the large language model, and enabling the large language model to detect risks while being able to answer questions such as the source of the attack, the characteristics of the attack behavior, etc.

[0069] In step B2, according to the pre-trained large language model, based on multiple sub-prompt information, the first graph embedding vector and the first key information, a second risk type corresponding to the user's operation behavior contained in the historical log data is determined.

[0070] In step S312, the pre-trained large language model is fine-tuned according to the first risk type and the second risk type to obtain a trained large language model.

[0071] In practical applications, the specific processing methods for extracting key information from log data in step S108 to obtain target information can be varied. An optional processing method is provided below, such as Figure 4 As shown, the processing may specifically include the following step S1084.

[0072] In step S1084, feature extraction is performed on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and key information extraction is performed on the log data according to a preset summary generation algorithm to obtain summary information of the log data, and the summary information of the log data is determined as the target information.

[0073] In actual applications, log data may include audit log data and / or operation log data, wherein audit log data may be log file data that records information such as system operating status, user operation behavior, security events, etc., and may include data such as log time, source, level, specific operation behavior, etc., and is a system behavior description data.

[0074] In implementation, Figure 5 As shown, the server can obtain audit log data, convert the audit log data into a unified format, remove redundant sentences and redundant behaviors in the audit log data, and finally, rearrange and divide the audit log data according to different processes, thread identifiers, and the logical order of operation behaviors to construct NEO4J graph data (i.e., target graph structure data).

[0075] It solves the problem that the log data content is chaotic and it is difficult to directly extract information and divide events during information extraction, and it can construct graph data with smaller volume and clear structure through audit log data.

[0076] In addition, the server can train the feature extraction model constructed by GNN and HAN through the second graph structure constructed by historical log data, and then perform feature extraction processing on the target graph structure data through the trained feature extraction model to obtain the target graph embedding vector (Graph Embedding).

[0077] At the same time, the server can generate summaries through natural language processing technology, that is, it can extract key information from log data through a preset summary generation algorithm to obtain summary information of the log data, so as to determine the target information based on the summary information of the log data. Then, the server can integrate the target information and Graph Embedding to generate integrated detection data as data for attack detection.

[0078] Among them, when fine-tuning the large language model, the server can use the Chain-Of-Thought principle to fine-tune the large language model to perform efficient reasoning detection on log summaries and Graph Embedding, achieve high-accuracy and low-false-alarm attack behavior detection, and solve the problem of poor universality of Advanced Persistent Threat (APT) attack detection.

[0079] In addition, the server can also flexibly design large model fine-tuning solutions based on actual needs. For example, it can design prompt information (attack source point, attack range, attack story description, etc.) as needed to implement a question-and-answer function tailored to the needs.

[0080] In practical applications, in the above step S110, according to the large language model, based on the target graph embedding vector and the target information, the specific processing method for determining whether the target user is a risky user can be varied. The following is an optional processing method, such as Figure 4 As shown, the process may specifically include the following step S1102.

[0081] In step S1102, according to the large language model, based on the target graph embedding vector and the target information, the risk type corresponding to the operation behavior is determined, and according to the risk type corresponding to the operation behavior, it is determined whether the target user is a risky user.

[0082] Among them, risk types may include high risk, medium risk, low risk, no risk and other types.

[0083] During implementation, the server may determine whether the target user is a risky user according to the behavior type and risk type of each operation behavior.

[0084] For example, the server can determine the risk score corresponding to each operation behavior based on the behavior type and risk type of each operation behavior, and then determine the risk score corresponding to the target user based on the risk score corresponding to each operation behavior, so as to determine whether the target user is a risky user based on the risk score corresponding to the target user.

[0085] In addition, when the target user is determined to be a risky user, preset warning information and target operation behaviors whose risk scores in the operation behaviors are greater than a preset score threshold may be sent to a preset processing party.

[0086] The embodiment of this specification provides a data processing method, which receives a risk detection request for a target user, responds to the risk detection request, obtains log data containing the target user's operation behavior, determines target graph structure data based on the target user's operation behavior contained in the log data, wherein the target graph structure data may include a target node determined according to the operation behavior, and an edge between nodes determined according to a logical relationship between the operation behaviors, performs feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, performs key information extraction processing on the log data to obtain target information, and determines whether the target user is a risk user based on the target graph embedding vector and the target information according to a large language model. In this way, on the one hand, since the log data contains a lot of content, the target user's operation behavior can be extracted from the log data, and a target graph structure data with a small volume and clear structure can be constructed to improve the detection efficiency and detection accuracy of subsequent risk detection based on the target graph structure data. On the other hand, since the target information containing key information is a natural language that can be understood by the large language model, and the target graph embedding vector determined according to the target graph structure data contains the logical relationship between the operation behaviors, the accuracy and efficiency of risk detection for users can be improved through the large language model based on the target information and the target graph embedding vector.

[0087] The above is a data processing method provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a data processing device, such as Figure 6 shown.

[0088] The data processing device includes: a request receiving module 601, a first obtaining module 602, a first determining module 603, a first extracting module 604 and a risk detecting module 605, wherein: A request receiving module 601 is used to receive a risk detection request for a target user; A first acquisition module 602 is used to obtain log data containing operation behaviors of the target user in response to the risk detection request; A first determination module 603 is used to determine target graph structure data based on the operation behavior of the target user contained in the log data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; The first extraction module 604 is used to perform feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and perform key information extraction processing on the log data to obtain target information; The risk detection module 605 is used to determine whether the target user is a risky user based on the target graph embedding vector and the target information according to the large language model.

[0089] In the embodiment of this specification, the first determining module 603 is used to: Performing clustering processing on the operation behaviors of the target user contained in the log data to obtain a first clustering result, and determining the events contained in the log data according to the first clustering result; A target node in the target graph structure data is constructed according to the event, and edges between nodes in the target graph structure data are determined according to the logical relationship between the events.

[0090] In the embodiment of this specification, the first determining module 603 is used to: Determine first graph structure data based on thread information corresponding to the operation behavior of the target user contained in the log data, wherein the first graph structure data includes a first node determined according to the thread information and edges between the nodes determined according to the thread information; Determine a second node among the first nodes according to the out-degree information and / or in-degree information of each of the first nodes in the first graph structure data; Clustering is performed on the second nodes to obtain a second clustering result, and the first clustering result is determined based on the second clustering result.

[0091] In the embodiment of this specification, the first extraction module 604 is used to: According to a pre-trained feature extraction model, feature extraction processing is performed on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, wherein the feature extraction model is a model constructed based on a heterogeneous graph attention network algorithm.

[0092] In the embodiment of this specification, the device further includes: Model acquisition module, used to obtain pre-trained large language models; A second acquisition module is used to acquire historical log data and a first risk type corresponding to the user's operation behavior contained in the historical log data, wherein the amount of the historical log data is smaller than the amount of the sample data; A second determination module, configured to determine second graph structure data based on the user's operation behavior included in the historical log data; A second extraction module is used to perform feature extraction processing on the second graph structure data to obtain a first graph embedding vector corresponding to the second graph structure data, and perform key information extraction processing on the historical log data to obtain first key information; a risk determination module, configured to determine, according to the pre-trained large language model, based on preset prompt information, the first graph embedding vector and the first key information, a second risk type corresponding to the user's operation behavior contained in the historical log data; The model training module is used to fine-tune the pre-trained large language model according to the first risk type and the second risk type to obtain a trained large language model.

[0093] In the embodiment of this specification, the type determination module is used to: According to the detection requirements corresponding to the target user, generating a plurality of sub-prompt information having a logical reasoning relationship corresponding to the preset prompt information; According to the pre-trained large language model, based on the multiple sub-prompt information, the first graph embedding vector and the first key information, a second risk type corresponding to the user's operation behavior contained in the historical log data is determined.

[0094] In the embodiment of this specification, the first extraction module 604 is used to: According to a preset summary generation algorithm, key information extraction processing is performed on the log data to obtain summary information of the log data, and the summary information of the log data is determined as the target information.

[0095] In the embodiment of this specification, the log data includes audit log data and / or operation log data, and the risk detection module 605 is used to: According to the large language model, based on the target graph embedding vector and the target information, the risk type corresponding to the operation behavior is determined, and according to the risk type corresponding to the operation behavior, whether the target user is a risky user is determined.

[0096] The embodiment of the present specification provides a data processing device, which receives a risk detection request for a target user, responds to the risk detection request, obtains log data containing the target user's operation behavior, determines target graph structure data based on the target user's operation behavior contained in the log data, wherein the target graph structure data may include a target node determined according to the operation behavior, and an edge between nodes determined according to a logical relationship between the operation behaviors, performs feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, performs key information extraction processing on the log data to obtain target information, and determines whether the target user is a risk user based on the target graph embedding vector and the target information according to a large language model. In this way, on the one hand, since the log data contains a lot of content, the target user's operation behavior can be extracted from the log data, and a target graph structure data with a small volume and clear structure can be constructed to improve the detection efficiency and detection accuracy of subsequent risk detection based on the target graph structure data. On the other hand, since the target information containing key information is a natural language that can be understood by the large language model, and the target graph embedding vector determined according to the target graph structure data contains the logical relationship between the operation behaviors, the accuracy and efficiency of risk detection for users can be improved through the large language model based on the target information and the target graph embedding vector.

[0097] The above is a data processing device provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a data processing device, such as Figure 7 shown.

[0098] The data processing device may provide a terminal device or a server, etc. for the above-mentioned embodiments.

[0099] The data processing device may have relatively large differences due to different configurations or performances, and may include one or more processors 701 and memory 702, and the memory 702 may store one or more storage applications or data. Among them, the memory 702 may be a short-term storage or a persistent storage. The application stored in the memory 702 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the data processing device. Furthermore, the processor 701 may be configured to communicate with the memory 702 and execute a series of computer executable instructions in the memory 702 on the data processing device. The data processing device may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input and output interfaces 705, and one or more keyboards 706.

[0100] Specifically in this embodiment, the data processing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the data processing device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following: Receive risk detection requests for target users; In response to the risk detection request, obtaining log data including operation behavior of the target user; Based on the operation behavior of the target user contained in the log data, determine target graph structure data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; Performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; According to the large language model, based on the target graph embedding vector and the target information, it is determined whether the target user is a risky user.

[0101] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the data processing device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0102] The embodiment of the present specification provides a data processing device, which receives a risk detection request for a target user, responds to the risk detection request, obtains log data containing the target user's operation behavior, determines target graph structure data based on the target user's operation behavior contained in the log data, wherein the target graph structure data may include a target node determined according to the operation behavior, and an edge between nodes determined according to a logical relationship between the operation behaviors, performs feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, performs key information extraction processing on the log data to obtain target information, and determines whether the target user is a risk user based on the target graph embedding vector and the target information according to a large language model. In this way, on the one hand, since the log data contains a lot of content, the target user's operation behavior can be extracted from the log data, and a target graph structure data with a small volume and clear structure can be constructed to improve the detection efficiency and detection accuracy of subsequent risk detection based on the target graph structure data. On the other hand, since the target information containing key information is a natural language that can be understood by the large language model, and the target graph embedding vector determined according to the target graph structure data contains the logical relationship between the operation behaviors, the accuracy and efficiency of risk detection for users can be improved through the large language model based on the target information and the target graph embedding vector.

[0103] Furthermore, based on the above Figures 1 to 5 In one embodiment, the present specification further provides a storage medium for storing computer executable instruction information. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instruction information stored in the storage medium is executed by the processor, the following process can be implemented: Receive risk detection requests for target users; In response to the risk detection request, obtaining log data including operation behavior of the target user; Based on the operation behavior of the target user contained in the log data, determine target graph structure data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; Performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; According to the large language model, based on the target graph embedding vector and the target information, it is determined whether the target user is a risky user.

[0104] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above-mentioned storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0105] The embodiment of this specification provides a storage medium, which receives a risk detection request for a target user, responds to the risk detection request, obtains log data containing the target user's operation behavior, determines target graph structure data based on the target user's operation behavior contained in the log data, wherein the target graph structure data may include a target node determined according to the operation behavior, and an edge between nodes determined according to a logical relationship between the operation behaviors, performs feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, performs key information extraction processing on the log data to obtain target information, and determines whether the target user is a risk user based on the target graph embedding vector and the target information according to a large language model. In this way, on the one hand, since the log data contains a lot of content, the target user's operation behavior can be extracted from the log data, and a target graph structure data with a small volume and clear structure can be constructed to improve the detection efficiency and detection accuracy of subsequent risk detection based on the target graph structure data. On the other hand, since the target information containing key information is a natural language that can be understood by the large language model, and the target graph embedding vector determined according to the target graph structure data contains the logical relationship between the operation behaviors, the accuracy and efficiency of risk detection for users can be improved through the large language model based on the target information and the target graph embedding vector.

[0106] Furthermore, based on the above Figures 1 to 5 In one or more embodiments of the present specification, a computer program product is provided, including a computer program. When the computer program in the computer program product is executed by a processor, the following process can be implemented: Receive risk detection requests for target users; In response to the risk detection request, obtaining log data including operation behavior of the target user; Based on the operation behavior of the target user contained in the log data, determine target graph structure data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; Performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; According to the large language model, based on the target graph embedding vector and the target information, it is determined whether the target user is a risky user.

[0107] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above-mentioned computer program product embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0108] The embodiment of the present specification provides a computer program product, which receives a risk detection request for a target user, responds to the risk detection request, obtains log data containing the target user's operation behavior, determines target graph structure data based on the target user's operation behavior contained in the log data, wherein the target graph structure data may include a target node determined according to the operation behavior, and an edge between nodes determined according to a logical relationship between the operation behaviors, performs feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, performs key information extraction processing on the log data to obtain target information, and determines whether the target user is a risk user based on the target graph embedding vector and the target information according to a large language model. In this way, on the one hand, since the log data contains a lot of content, the target user's operation behavior can be extracted from the log data, and a target graph structure data with a small volume and clear structure can be constructed to improve the detection efficiency and detection accuracy of subsequent risk detection based on the target graph structure data. On the other hand, since the target information containing key information is a natural language that can be understood by the large language model, and the target graph embedding vector determined according to the target graph structure data contains the logical relationship between the operation behaviors, the accuracy and efficiency of risk detection for users can be improved through the large language model based on the target information and the target graph embedding vector.

[0109] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0110] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0111] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0112] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0113] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0114] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0115] The embodiments of this specification are described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable fraud case serial and parallel device to produce a machine, so that the instructions executed by the processor of the computer or other programmable fraud case serial and parallel device generate instructions for implementing the processes in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable fraud case serial and parallel device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0117] These computer program instructions may also be loaded onto a computer or other programmable device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0118] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0119] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0120] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0121] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0122] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, one or more embodiments of this specification may be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0123] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0124] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0125] The above description is only an embodiment of this specification and is not intended to limit this document. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims of this specification.

Claims

1. A data processing method, comprising: Receive risk detection requests for target users; In response to the risk detection request, obtaining log data including operation behavior of the target user; Based on the operation behavior of the target user contained in the log data, determine target graph structure data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; Performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; According to the large language model, based on the target graph embedding vector and the target information, it is determined whether the target user is a risky user.

2. According to the method of claim 1, determining the target graph structure data based on the operation behavior of the target user contained in the log data comprises: Performing clustering processing on the operation behaviors of the target user contained in the log data to obtain a first clustering result, and determining the events contained in the log data according to the first clustering result; A target node in the target graph structure data is constructed according to the event, and edges between nodes in the target graph structure data are determined according to the logical relationship between the events.

3. The method according to claim 2, wherein clustering the operation behaviors of the target user contained in the log data to obtain a first clustering result comprises: Determine first graph structure data based on thread information corresponding to the operation behavior of the target user contained in the log data, wherein the first graph structure data includes a first node determined according to the thread information and edges between the nodes determined according to the thread information; Determine a second node among the first nodes according to the out-degree information and / or in-degree information of each of the first nodes in the first graph structure data; Clustering is performed on the second nodes to obtain a second clustering result, and the first clustering result is determined based on the second clustering result.

4. According to the method of claim 3, the step of performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data comprises: According to a pre-trained feature extraction model, feature extraction processing is performed on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, wherein the feature extraction model is a model constructed based on a heterogeneous graph attention network algorithm.

5. The method according to claim 1, before determining the risk type corresponding to the operation behavior based on the target graph embedding vector and the target information according to the large language model, further comprises: Get a pre-trained large language model; Acquire historical log data, and a first risk type corresponding to the user's operation behavior contained in the historical log data; Determining second graph structure data based on the user's operation behavior included in the historical log data; Performing feature extraction processing on the second graph structure data to obtain a first graph embedding vector corresponding to the second graph structure data, and performing key information extraction processing on the historical log data to obtain first key information; Determine, according to the pre-trained large language model, a second risk type corresponding to the user's operation behavior contained in the historical log data based on preset prompt information, the first graph embedding vector, and the first key information; According to the first risk type and the second risk type, the pre-trained large language model is fine-tuned to obtain a trained large language model.

6. The method according to claim 5, wherein determining, based on the pre-trained large language model, preset prompt information, the first graph embedding vector and the first key information, the second risk type corresponding to the user's operation behavior contained in the historical log data comprises: According to the detection requirements corresponding to the target user, generating a plurality of sub-prompt information having a logical reasoning relationship corresponding to the preset prompt information; According to the pre-trained large language model, based on the multiple sub-prompt information, the first graph embedding vector and the first key information, a second risk type corresponding to the user's operation behavior contained in the historical log data is determined.

7. According to the method of claim 1, the step of extracting key information from the log data to obtain target information comprises: According to a preset summary generation algorithm, key information extraction processing is performed on the log data to obtain summary information of the log data, and the summary information of the log data is determined as the target information.

8. The method according to claim 1, wherein the log data comprises audit log data and / or operation log data, and the determining whether the target user is a risky user based on the target graph embedding vector and the target information according to the large language model comprises: According to the large language model, based on the target graph embedding vector and the target information, the risk type corresponding to the operation behavior is determined, and according to the risk type corresponding to the operation behavior, whether the target user is a risky user is determined.

9. A data processing device, comprising: A request receiving module, used to receive a risk detection request for a target user; A first acquisition module, configured to acquire log data containing operation behaviors of the target user in response to the risk detection request; A first determination module is used to determine target graph structure data based on the operation behavior of the target user contained in the log data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; A first extraction module is used to perform feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and perform key information extraction processing on the log data to obtain target information; The risk detection module is used to determine whether the target user is a risky user based on the target graph embedding vector and the target information according to the large language model.

10. A data processing device, comprising: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: Receive risk detection requests for target users; In response to the risk detection request, obtaining log data including operation behavior of the target user; Based on the operation behavior of the target user contained in the log data, determine target graph structure data, wherein the target graph structure data includes target nodes determined according to the operation behavior and edges between nodes determined according to logical relationships between the operation behaviors; Performing feature extraction processing on the target graph structure data to obtain a target graph embedding vector corresponding to the target graph structure data, and performing key information extraction processing on the log data to obtain target information; According to the large language model, based on the target graph embedding vector and the target information, it is determined whether the target user is a risky user.

Images