User auditing method and device based on enterprise application log

Abstract

The invention provides a user auditing method and device based on an enterprise application log, and the method comprises the steps: collecting the basic data of different enterprise applications needing to access a target platform, calculating the local sensitive hash signature of a user of the enterprise application based on a preset local sensitive hash algorithm, the method comprises the steps of obtaining a training corpus and a to-be-trained word vector representation model, training the to-be-trained word vector representation model based on the training corpus to obtain a trained word vector representation model, performing word vector extraction on user information based on the trained word vector representation model to obtain a word vector corresponding to a user, after the basic data and the word vectors are stored in a preset database, a similar user set which is similar in pairs is inquired based on the database, and the final similarity of the two users is obtained based on the word vectors of the two users in the similar user set; and discriminating the two users in the similar user set based on a preset similarity threshold and the final similarity to obtain a corresponding discrimination result.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a user audit method and device based on enterprise application logs. Background Art

[0002] The safe operation of enterprise applications is under pressure from multiple aspects, both internally and externally. To combat security risks, the need for auditing has been expanded, but the separate operation of each application often brings many inconveniences to the audit.

[0003] At present, general enterprise applications will implement some of their own audit actions to ensure the security, operation and maintenance of the application.

[0004] However, as enterprises develop, there will be more and more enterprise application platforms, and the various platforms cannot be effectively linked, resulting in the fragmentation of audit content, making it difficult to confirm the identity of users in different enterprise applications, resulting in average accuracy of audit results. Summary of the invention

[0005] In view of this, the purpose of the present application is to provide a user audit method and device based on enterprise application logs, which extracts word vectors from user information in the basic data of different enterprise applications through a word vector representation model trained by a training corpus, obtains the word vectors corresponding to the users, and queries a set of similar users that are similar to each other, obtains the final similarity of the two users based on the word vectors of the two users for identification, and can effectively link between various enterprise application platforms, realize user uniqueness confirmation when aggregating multiple enterprise application platforms, improves the accuracy of user identity confirmation, and thus improves the accuracy of the audit results.

[0006] In a first aspect, an embodiment of the present application provides a user audit method based on an enterprise application log, the user audit method comprising:

[0007] Collect basic data of different enterprise applications that need to access the target platform, and calculate the local sensitive hash signature of the user of the enterprise application based on a preset local sensitive hash algorithm; wherein the basic data includes at least user information and operation log; the user information includes at least user name, login name, position, and organizational structure;

[0008] Acquire a training corpus and a word vector representation model to be trained, and train the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model;

[0009] Extracting word vectors from the user information based on the trained word vector representation model to obtain a word vector corresponding to the user; wherein the word vector includes at least a user name vector, a login name vector, a job title vector, and an organizational structure vector;

[0010] After storing the basic data and the word vectors in a preset database, querying a set of similar users that are similar to each other based on the database, and obtaining a final similarity between the two users based on the word vectors of the two users in the similar user set; each similar user set includes a first user and a second user;

[0011] Based on a preset similarity threshold and the final similarity, two users in the similar user set are identified to obtain a corresponding identification result; wherein the identification result indicates that the two users in the similar user set are the same user or different users.

[0012] In a possible implementation, obtaining a training corpus includes:

[0013] Obtain the company's own basic corpus and the preset Chinese name corpus;

[0014] A corresponding training corpus is formed based on the basic corpus, the Chinese name corpus and the user information.

[0015] In a possible implementation, obtaining the final similarity between the two users based on the word vectors of the two users in the similar user set includes:

[0016] Based on the word vectors of two users in the similar user set, the angle cosine similarity corresponding to each word vector is calculated, and the total angle cosine similarity is obtained according to the angle cosine similarity; wherein the angle cosine similarity includes the user name angle cosine similarity, the login name angle cosine similarity, the position angle cosine similarity and the organizational structure angle cosine similarity; the total angle cosine similarity includes the total name angle cosine similarity and the total work angle cosine similarity;

[0017] Calculate the local sensitive hash sensitivities of the two users based on the local sensitive hash signatures of the users; the local sensitive hash sensitivities include a first local sensitive hash sensitivity and a second local sensitive hash sensitivity;

[0018] Calculate the similarity distance and edit distance of the two users based on the word vectors of the two users;

[0019] The total angle cosine similarity, the local sensitive hashing sensitivity, the similarity distance and the edit distance are weightedly calculated based on a preset weight ratio to obtain a final similarity between the user and the similar user.

[0020] In a possible implementation manner, obtaining the total angle cosine similarity according to the angle cosine similarity includes:

[0021] Calculate the angle cosine similarity of the user name vector, login name vector, position vector and organizational structure vector of the two users respectively, and obtain the angle cosine similarity corresponding to each word vector;

[0022] Based on the integration of the user name angle cosine similarity and the login name angle cosine similarity, the corresponding total name angle cosine similarity is obtained; based on the integration of the position angle cosine similarity and the organizational structure angle cosine similarity, the corresponding total work angle cosine similarity is obtained.

[0023] In a possible implementation, before the new enterprise application is connected to the target platform, a first application log of the enterprise application connected to the target platform is collected, and a corpus model of the new enterprise application is obtained based on the first application log;

[0024] A user profile of the user is obtained based on the corpus model, and high-risk operations of the user are identified based on the user profile.

[0025] In a possible implementation, collecting a first application log of an enterprise application connected to the target platform, and acquiring a corpus model of the new enterprise application based on the first application log includes:

[0026] Collecting first application logs of enterprise applications that have been connected to the target platform within a preset period, and determining a log corpus of the new enterprise application based on the first application logs;

[0027] Segmenting the log corpus based on a preset segmentation algorithm to obtain a segmentation corpus that can be used for natural language processing training;

[0028] The word segmentation corpus is trained based on the word vector representation model to obtain a corpus model of the new enterprise application.

[0029] In a possible implementation, the acquiring the user portrait of the user based on the corpus model includes:

[0030] Collecting a second application log of an enterprise application that has been connected to the target platform;

[0031] Presetting basic portrait keywords for the user, and based on the portrait keywords, using the corpus model to perform similar word search in the second application log, so as to perform real-time search on the second application log;

[0032] In response to retrieving the portrait keyword in the second application log, the corresponding user is dynamically qualified and a user portrait of the user is constructed.

[0033] In a second aspect, an embodiment of the present application further provides a user auditing device based on an enterprise application log, the user auditing device comprising:

[0034] A calculation module, used to collect basic data of different enterprise applications that need to access the target platform, and calculate the local sensitive hash signature of the user of the enterprise application based on a preset local sensitive hash algorithm; wherein the basic data includes at least user information and operation log; the user information includes at least user name, login name, position, and organizational structure;

[0035] A training module, used to obtain a training corpus and a word vector representation model to be trained, and train the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model;

[0036] A first acquisition module is used to extract word vectors from the user information based on the trained word vector representation model to obtain a word vector corresponding to the user; wherein the word vector includes at least a user name vector, a login name vector, a job title vector, and an organizational structure vector;

[0037] A second acquisition module is used to query a set of similar users that are similar to each other based on the database after storing the basic data and the word vector in a preset database, and obtain a final similarity between the two users based on the word vectors of the two users in the similar user set; each similar user set includes a first user and a second user;

[0038] The first identification module is used to identify two users in the similar user set based on a preset similarity threshold and the final similarity to obtain a corresponding identification result; wherein the identification result indicates that the two users in the similar user set are the same user or different users.

[0039] In a possible implementation manner, the calculation module is specifically configured to:

[0040] Obtain the company's own basic corpus and the preset Chinese name corpus;

[0041] A corresponding training corpus is formed based on the basic corpus, the Chinese name corpus and the user information.

[0042] In a possible implementation manner, the second acquisition module is specifically configured to:

[0043] The obtaining the final similarity between the two users based on the word vectors of the two users in the similar user set includes:

[0044] Based on the word vectors of two users in the similar user set, the angle cosine similarity corresponding to each word vector is calculated, and the total angle cosine similarity is obtained according to the angle cosine similarity; wherein the angle cosine similarity includes the user name angle cosine similarity, the login name angle cosine similarity, the position angle cosine similarity and the organizational structure angle cosine similarity; the total angle cosine similarity includes the total name angle cosine similarity and the total work angle cosine similarity;

[0045] Calculate the local sensitive hash sensitivities of the two users based on the local sensitive hash signatures of the users; the local sensitive hash sensitivities include a first local sensitive hash sensitivity and a second local sensitive hash sensitivity;

[0046] Calculate the similarity distance and edit distance of the two users based on the word vectors of the two users;

[0047] The total angle cosine similarity, the local sensitive hashing sensitivity, the similarity distance and the edit distance are weightedly calculated based on a preset weight ratio to obtain a final similarity between the user and the similar user.

[0048] In a possible implementation manner, the second acquisition module is specifically configured to:

[0049] Calculate the angle cosine similarity of the user name vector, login name vector, position vector and organizational structure vector of the two users respectively, and obtain the angle cosine similarity corresponding to each word vector;

[0050] Based on the integration of the user name angle cosine similarity and the login name angle cosine similarity, the corresponding total name angle cosine similarity is obtained; based on the integration of the position angle cosine similarity and the organizational structure angle cosine similarity, the corresponding total work angle cosine similarity is obtained.

[0051] In a possible implementation manner, the user auditing device based on enterprise application logs further includes:

[0052] A third acquisition module is used to collect a first application log of the enterprise application connected to the target platform before the new enterprise application is connected to the target platform, and to acquire a corpus model of the new enterprise application based on the first application log;

[0053] The second identification module is used to obtain a user portrait of the user based on the corpus model, and identify high-risk operations of the user based on the user portrait.

[0054] In a possible implementation manner, the third acquisition module is specifically configured to:

[0055] Collecting first application logs of enterprise applications that have been connected to the target platform within a preset period, and determining a log corpus of the new enterprise application based on the first application logs;

[0056] Segmenting the log corpus based on a preset segmentation algorithm to obtain a segmentation corpus that can be used for natural language processing training;

[0057] The word segmentation corpus is trained based on the word vector representation model to obtain a corpus model of the new enterprise application.

[0058] In a possible implementation manner, the second identification module is specifically used to:

[0059] Collecting a second application log of an enterprise application that has been connected to the target platform;

[0060] Presetting basic portrait keywords for the user, and based on the portrait keywords, using the corpus model to perform similar word search in the second application log, so as to perform real-time search on the second application log;

[0061] In response to retrieving the portrait keyword in the second application log, the corresponding user is dynamically qualified and a user portrait of the user is constructed.

[0062] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the user audit method based on enterprise application logs as described in any one of the first aspects.

[0063] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the user audit method based on enterprise application logs described in any one of the first aspects are executed.

[0064] The embodiment of the present application provides a user audit method and device based on enterprise application logs, which collect basic data of different enterprise applications that need to access a target platform, and calculate the local sensitive hash signatures of users of the enterprise applications based on a preset local sensitive hash algorithm, obtain a training corpus and a word vector representation model to be trained, and train the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model, extract word vectors from user information based on the trained word vector representation model to obtain the word vector corresponding to the user, and after storing the basic data and the word vectors in a preset database, query a set of similar users that are similar to each other based on the database, and obtain the final similarity of the two users based on the word vectors of the two users in the similar user set, and identify the two users in the similar user set based on the preset similarity threshold and the final similarity to obtain the corresponding identification result. In this application, word vectors are extracted from user information in basic data of different enterprise applications by a word vector representation model trained by a training corpus, the word vectors corresponding to the users are obtained, and a set of similar users that are similar to each other are queried. The final similarity of the two users is obtained based on the word vectors of the two users for identification. This can effectively link between various enterprise application platforms, realize user uniqueness confirmation when aggregating multiple enterprise application platforms, improve the accuracy of user identity confirmation, and thus improve the accuracy of audit results.

[0065] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0067] Figure 1 is a flow chart of a user audit method based on enterprise application logs provided according to an embodiment of the present application;

[0068] Figure 2 is a flow chart of a user audit method based on enterprise application logs provided according to another embodiment of the present application;

[0069] Figure 3 is a flow chart of a user audit method based on enterprise application logs provided according to another embodiment of the present application;

[0070] Figure 4 It is a schematic diagram of user portrait generation and high-risk identification;

[0071] Figure 5 It is a structural diagram of a user audit device based on enterprise application logs provided according to an embodiment of the present application;

[0072] Figure 6 It is a structural schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0073] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0074] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0075] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0076] Considering the safe operation of enterprise applications, there are pressures from inside and outside the enterprise. In order to combat security risks, the need for auditing has been expanded, but the separate operation of each application often brings many inconveniences to the audit.

[0077] At present, general enterprise applications will implement some of their own audit actions to ensure the security, operation and maintenance of the application. However, as enterprises develop, there will be more and more enterprise application platforms, and the various platforms cannot be effectively linked, resulting in the fragmentation of audit content, making it difficult to confirm the identity of users in different enterprise applications, resulting in average accuracy of audit results.

[0078] To address this problem, the present application provides a user auditing method and device based on enterprise application logs. By using a word vector representation model trained by a training corpus, word vectors are extracted for user information in the basic data of different enterprise applications to obtain word vectors corresponding to the users, and a set of similar users that are similar to each other is queried. The final similarity of the two users is obtained based on the word vectors of the two users for identification. Effective linkage can be achieved between various enterprise application platforms, and user uniqueness confirmation is realized when aggregating multiple enterprise application platforms. The accuracy of user identity confirmation is improved, thereby improving the accuracy of the audit results.

[0079] Figure 1 is a flow chart of a user audit method based on enterprise application logs provided in an embodiment of the present application, such as Figure 1 As shown, the user audit method based on enterprise application logs in the embodiment of the present application may specifically include:

[0080] S101. Collect basic data of different enterprise applications that need to access the target platform, and calculate the local sensitive hash signature of users of the enterprise applications based on a preset local sensitive hash algorithm.

[0081] S102, obtaining a training corpus and a word vector representation model to be trained, and training the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model.

[0082] S103. Extract word vectors from user information based on the trained word vector representation model to obtain word vectors corresponding to the user.

[0083] S104: After storing the basic data and word vectors in a preset database, a set of similar users that are similar to each other is queried based on the database, and a final similarity between the two users is obtained based on the word vectors of the two users in the similar user set.

[0084] S105 . Identify two users in the similar user set based on a preset similarity threshold and a final similarity to obtain a corresponding identification result.

[0085] In the above-mentioned user audit method based on enterprise application logs, word vectors are extracted from user information in the basic data of different enterprise applications through the word vector representation model trained by the training corpus to obtain the word vectors corresponding to the users, and a set of similar users that are similar to each other is queried. The final similarity of the two users is obtained based on the word vectors of the two users for identification. This method can effectively link between various enterprise application platforms, realize the user uniqueness confirmation when aggregating multiple enterprise application platforms, improve the accuracy of user identity confirmation, and thus improve the accuracy of the audit results.

[0086] The above exemplary steps of the embodiment of the present application are described below with reference to specific examples:

[0087] S101, collecting basic data of different enterprise applications that need to access the target platform, and calculating the local sensitive hash signature of the user of the enterprise application based on a preset local sensitive hash algorithm.

[0088] In an embodiment of the present application, the target platform is the platform to which the enterprise application accesses, for example, LDAP (Lightweight Directory Access Protocol), that is, AD domain control; the basic data includes at least user information (that is, user information of the enterprise application) and operation log (that is, operation log of the enterprise application), and the user information includes at least user name, login name, position, and organizational structure; the local sensitive hash algorithm is a pre-set algorithm for obtaining the local sensitivity of the user's hash signature, and the local sensitive hash algorithm includes SimHash and MinHash, and the corresponding local sensitive hash signature includes a first local sensitive hash signature and a second local sensitive hash signature (SimHash and MinHash); the basic data of different enterprise applications that need to access the target platform are collected, and the local sensitive hash signatures of the users of the enterprise applications, that is, the first local sensitive hash signature and the second local sensitive hash signature, are calculated based on the local sensitive hash algorithm for subsequent processing.

[0089] Among them, basic data exists to enrich the content of user portraits. For special enterprise applications, such as security protection (anti-virus software, etc.), business information needs to be collected. Business information includes but is not limited to user members, machine equipment information, machine software information, machine virus library information, etc. That is, basic data should include user information, operation logs and business information.

[0090] It should be noted that, since the hash algorithm is a locally sensitive algorithm, the character content of the user information of the enterprise application needs to be expanded as much as possible. Optionally, when calculating the user's locally sensitive hash signature based on the preset locally sensitive hash algorithm, the character content of the user information is expanded. Specifically, the user name, login name, position, and organizational structure in the user information are spliced ​​into one character; based on the spliced ​​characters, the user's first locally sensitive hash signature and second locally sensitive hash signature are obtained. It should also be noted that after collecting the basic data of different enterprise applications that need to be connected to the target platform, the basic data is stored in a preset database.

[0091] S102, obtaining a training corpus and a word vector representation model to be trained, and training the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model.

[0092] In an embodiment of the present application, the training corpus is a corpus used to train the model, and the word vector representation model is described using the GloVe model as an example, but this does not constitute a limitation to this; the training corpus and the word vector representation model to be trained are acquired, and the word vector representation model is trained based on the training corpus to obtain the trained word vector representation model for subsequent processing.

[0093] Optionally, when obtaining a training corpus, the enterprise's own basic corpus and a preset Chinese name corpus are obtained, and a corresponding training corpus is formed based on the basic corpus, the Chinese name corpus and user information. The Chinese name corpus is a publicly collated corpus of Chinese names.

[0094] S103, extracting word vectors from user information based on the trained word vector representation model to obtain word vectors corresponding to the user.

[0095] In an embodiment of the present application, the word vector includes at least a user name vector, a login name vector, a position vector and an organizational structure vector. Based on the trained word vector representation model obtained in step S102, the user information collected in step S101 is extracted with a word vector to obtain the word vector corresponding to the user, namely, the user name vector, login name vector, position vector and organizational structure vector, for subsequent processing.

[0096] Optionally, when extracting word vectors for user information, vector extraction is performed on the user name to obtain the corresponding user name vector, and the user name vector is used as one of the feature values ​​of the user's fixed user name; vector extraction is performed on the login name corresponding to the user name to obtain the corresponding login name vector, and the login name vector is used as one of the feature values ​​of the user's fixed user name; vector extraction is performed on the user position and user organizational structure information to obtain the corresponding position vector and organizational structure vector, and the position vector and organizational structure vector are used as extended feature values ​​to characterize the uniqueness of the user.

[0097] For example, taking the fictitious user Zhang Zhiqiang as an example, a vector is extracted from the user name (Zhang Zhiqiang) and defined as CN. The extracted vector is stored in the database as one of the feature values ​​of the fixed user name; a vector is extracted from the login name of the user name (generally a standard set by the enterprise, such as "zhangzhiqiang", "pd.zhangzhiqiang") and defined as LN. The extracted vector is entered into the database as one of the feature values ​​of the fixed user name; the vectors of the user position and user organizational structure are extracted and defined as job and OM, which are entered into the database as extended feature values ​​for subsequent user uniqueness.

[0098] It should be noted that after obtaining the word vector corresponding to the user, the word vector is stored in the database.

[0099] S104, after storing the basic data and word vectors in a preset database, querying a set of similar users that are similar to each other based on the database, and obtaining a final similarity between the two users based on the word vectors of the two users in the similar user set.

[0100] In an embodiment of the present application, a similar user set is a set of two similar users, and a final similarity is the final similarity of two similar users. Each similar user set includes a first user and a second user. After storing basic data and word vectors in a database, a set of two similar users is queried based on the database, and based on the word vectors of the two users in the similar user set, the final similarity of the two users is obtained for subsequent processing.

[0101] It should be noted that the search capability of the database is utilized to find out roughly similar users, and the similarity is calculated for the obtained users.

[0102] S105, identifying two users in the similar user set based on a preset similarity threshold and a final similarity to obtain a corresponding identification result.

[0103] In the embodiment of the present application, the identification result indicates whether two users in the similar user set are the same user or different users, and the similarity threshold is a preset similarity threshold for determining whether two similar users are the same user. Based on the similarity threshold and the final similarity, the two users in the similar user set are identified to obtain the corresponding identification result. For example, if the similarity threshold is set to 80%, then when the final similarity of two users in the similar user set is greater than 80%, they can be determined to be the same user.

[0104] Furthermore, the similarity threshold can be refined, for example, the similarity threshold can be set to 50% and 80%. When the final similarity of two users in the similar user set is greater than 80%, they can be determined to be the same user. When the final similarity of two users in the similar user set is less than 50%, they can be determined to be different users. When the final similarity of two users in the similar user set is between 50% and 80%, it is an uncertain identification result, and other identifications can be performed to help judgment.

[0105] Therefore, the aggregate audit capability of multi-platform user operation logs realizes the application log collection of different enterprise applications and the user uniqueness confirmation when aggregating multiple enterprise application platforms.

[0106] The user audit method based on enterprise application logs provided in the embodiment of the present application collects basic data of different enterprise applications that need to access the target platform, and calculates the local sensitive hash signatures of users of the enterprise applications based on a preset local sensitive hash algorithm, obtains a training corpus and a word vector representation model to be trained, and trains the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model, extracts word vectors from user information based on the trained word vector representation model to obtain the word vector corresponding to the user, and after storing the basic data and the word vector in a preset database, queries a set of similar users that are similar to each other based on the database, and obtains the final similarity of the two users based on the word vectors of the two users in the similar user set, and identifies the two users in the similar user set based on the preset similarity threshold and the final similarity to obtain the corresponding identification result. The user audit method based on enterprise application logs of the present application extracts word vectors for user information in basic data of different enterprise applications through a word vector representation model trained by a training corpus, obtains word vectors corresponding to the users, and queries a set of similar users that are similar to each other. The final similarity of the two users is obtained based on the word vectors of the two users for identification. This method can effectively link between various enterprise application platforms, realize user uniqueness confirmation when aggregating multiple enterprise application platforms, improve the accuracy of user identity confirmation, and thus improve the accuracy of audit results.

[0107] Further, such as Figure 2 As shown, the step S104 in the above embodiment of “obtaining the final similarity between the two users based on the word vectors of the two users in the similar user set” may specifically include the following steps:

[0108] S201, based on the word vectors of two users in the similar user set, calculate the angle cosine similarity corresponding to each word vector, and obtain the total angle cosine similarity according to the angle cosine similarity.

[0109] In an embodiment of the present application, the angle cosine similarity is the angle cosine similarity between the word vectors of two users in a similar user set, and the angle cosine similarity includes the angle cosine similarity of user names, the angle cosine similarity of login names, the angle cosine similarity of positions, and the angle cosine similarity of organizational structures; the total angle cosine similarity includes the angle cosine similarity of total names and the angle cosine similarity of total work; based on the word vectors of two users in a similar user set, the angle cosine similarity corresponding to each word vector is calculated, namely, the angle cosine similarity of user names, the angle cosine similarity of login names, the angle cosine similarity of positions, and the angle cosine similarity of organizational structures, and the total angle cosine similarity, namely, the angle cosine similarity of total names and the angle cosine similarity of total work are obtained according to the angle cosine similarity for subsequent processing.

[0110] Optionally, when obtaining the total angle cosine similarity based on the angle cosine similarity, the angle cosine similarities of the user name vectors, login name vectors, position vectors and organizational structure vectors of the two users are calculated respectively to obtain the angle cosine similarity corresponding to each word vector; based on the user name angle cosine similarity and the login name angle cosine similarity, they are integrated to obtain the corresponding total name angle cosine similarity; based on the position angle cosine similarity and the organizational structure angle cosine similarity, they are integrated to obtain the corresponding total work angle cosine similarity.

[0111] For example, for two similar users, calculate their usernames Login Name Position Organizational Structure The angle cosine similarity of these vectors is Scos CN , Scos LN , Scos job , Scos OM , integrated user name Login Name The angle cosine similarity of the total name Scos name , combined with job Organizational Structure The angle cosine similarity of Scos is used to obtain the total working angle cosine similarity Scos job+OM .

[0112] S202, calculate the local sensitive hash sensitivity of the two users based on the local sensitive hash signature of the user. In the embodiment of the present application, the local sensitive hash sensitivity includes a first local sensitive hash sensitivity and a second local sensitive hash sensitivity, and the local sensitive hash sensitivity of the two users is calculated based on the local sensitive hash signature of the user obtained in the above embodiment. For example, the SimHash and MinHash similarity of the two users is calculated based on the local sensitive hash signature of the user, recorded as diff sim and diff min .

[0113] S203, calculate the similarity distance and edit distance of the two users based on the word vectors of the two users. In the embodiment of the present application, the similarity distance is the Jaccard distance, and the edit distance is the Levenshtein distance. The similarity distance and edit distance of the two users are calculated based on the word vectors of the two users in the above embodiment for subsequent processing.

[0114] As a possible implementation, the username, login name, position, and organizational structure of two users are concatenated into one character, and the similarity distance corresponding to the character is calculated; the username, login name, position, and organizational structure of two users are concatenated into one character, and the edit distance corresponding to the character is calculated. For example, the username, login name, position, and organizational structure of two users are concatenated into one character, and the Jaccard distance value is calculated to obtain the diff jaccard ; When calculating the edit distance (Levenshtein), just like Jaccard, the usernames, login names, positions, and organizational structures of the two users are concatenated into one character, and the Levenshtein distance value is calculated to obtain the diff levenshtein .

[0115] S204: Perform weighted calculation on the total angle cosine similarity, local sensitive hashing sensitivity, similarity distance and edit distance based on a preset weight ratio to obtain a final similarity between the user and similar users.

[0116] In the embodiment of the present application, the weight ratio is the weight percentage pre-set for the total angle cosine similarity, local sensitive hash sensitivity, similarity distance and edit distance, and the sum of all weight ratios is 1. The total angle cosine similarity, local sensitive hash sensitivity, similarity distance and edit distance are weighted based on the preset weight ratio to obtain the final similarity between the user and the similar users. For example, the total angle cosine similarity, local sensitive hash sensitivity, similarity distance and edit distance obtained above are weighted to obtain the final similarity between the two users, and D (a,b) It is represented as follows:

[0117] D( a,b )=p1*Scos name +p2*Scos job+OM +p3*diff sim +p4*diff min +p5*diff jaccard +p6*diff levenshtein

[0118] Among them, p5 and p6 are often larger based on work experience. It should be noted that the weight ratio can be adjusted with emphasis.

[0119] Further, such as Figure 3 As shown, the user audit method based on enterprise application logs in the embodiment of the present application may also include the following steps:

[0120] S301, before a new enterprise application is connected to a target platform, a first application log of the enterprise application connected to the target platform is collected, and a corpus model of the new enterprise application is obtained based on the first application log.

[0121] In the embodiment of the present application, when a new enterprise application is connected to the target platform, the first application log of the enterprise application connected to the target platform is collected, and the corpus model of the new enterprise application is obtained based on the first application log for subsequent processing. Figure 4 As shown, a log collector is built, logs are collected through the log collector, and the corpus model of the new enterprise application is obtained based on the logs.

[0122] As a possible implementation method, the first application log of the enterprise application that has been connected to the target platform is collected within a preset period, and the log corpus of the new enterprise application is determined based on the first application log; the log corpus is segmented based on a preset word segmentation algorithm to obtain a word segmentation corpus that can be trained for natural language processing; the word segmentation corpus is trained based on a word vector representation model to obtain a corpus model of the new enterprise application. Among them, the period is the preset collection period, for example, 10 days; the word segmentation algorithm is the preset algorithm for segmenting the log corpus, for example, the Nshort algorithm, and this application is described using this as an example.

[0123] For example, Figure 4 As shown in the figure, before the new enterprise application is officially connected, the log collector is used to collect 10 days of application logs, and these logs are marked as the corpus of the log corpus. A word segmenter is built to segment the log corpus of the new enterprise application. The Nshort algorithm is used here to produce a word segmentation corpus that can be used for NLP training. GloVe is used to train the produced corpus to produce the corpus model of the application.

[0124] S302, obtaining a user profile of the user based on the corpus model, and identifying high-risk operations of the user based on the user profile.

[0125] In the embodiment of the present application, a user profile of the user is obtained based on the corpus model obtained in step S301, and high-risk operations of the user are identified based on the user profile.

[0126] Optionally, when obtaining the user portrait of the user based on the corpus model, a second application log of the enterprise application that has been connected to the target platform is collected; basic portrait keywords are preset for the user, and based on the portrait keywords, the corpus model is used to perform approximate word search in the second application log to perform real-time search of the second application log; in response to retrieving the portrait keywords in the second application log, the corresponding user is dynamically qualified and a user portrait of the user is constructed.

[0127] For example, Figure 4As shown, the built log collector is expanded and used to start collecting the second application log (the second application log is the formal collection log for the subsequent generation of the portrait, and the above-mentioned first application log is for training the model), and basic portrait keywords are preset, such as login time, number of logins, etc. At the same time, an approximate word retriever is built. According to the preset portrait keywords, the generated corpus model is used to perform real-time search of the collected logs, retrieve the corresponding portrait keywords, label the users, and build portraits through labeling.

[0128] Furthermore, in response to real-time retrieval of the second application log using the corpus model, the user's operations are identified based on the user portrait to obtain the user's high-risk operations. Figure 4 As shown, a discriminator is constructed. Through the constructed portrait, the discriminator searches the newly formed log according to the portrait. While collecting logs through the log collector, the discriminator searches for logs. When searching logs in real time, high-risk operations are identified.

[0129] It should be noted that the log collector, word segmenter, and GloVe training model need to collect data from enterprise applications before they are connected. The purpose is to build a model corpus model and complete basic training. After training, it is necessary to search for similar words and implement dynamic portrait labeling to identify high-risk risks.

[0130] Therefore, by deeply analyzing the collected log data, the user portrait is automatically drawn, and dynamic portrait marking is performed according to the content of the user portrait to identify high-risk operations. In addition, by auditing according to the different usage habits (logs) of different users, high-risk operations are determined, making the judgment of the audit risk situation more reasonable.

[0131] Figure 5 is a schematic diagram of the structure of a user audit device based on enterprise application logs provided according to an embodiment of the present application, such as Figure 5 As shown, the user audit device 500 based on enterprise application logs in the embodiment of the present application may specifically include:

[0132] The calculation module 501 is used to collect the basic data of different enterprise applications that need to access the target platform, and calculate the local sensitive hash signature of the users of the enterprise applications based on the preset local sensitive hash algorithm; wherein the basic data includes at least user information and operation logs; the user information includes at least user name, login name, position, and organizational structure.

[0133] The training module 502 is used to obtain a training corpus and a word vector representation model to be trained, and train the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model.

[0134] The first acquisition module 503 is used to extract word vectors from user information based on the trained word vector representation model to obtain the word vector corresponding to the user; wherein the word vector at least includes a user name vector, a login name vector, a position vector and an organizational structure vector.

[0135] The second acquisition module 504 is used to query a set of similar users that are similar to each other based on the database after storing the basic data and word vectors in a preset database, and obtain the final similarity between the two users based on the word vectors of the two users in the similar user set; each similar user set includes a first user and a second user.

[0136] The first identification module 505 is used to identify two users in the similar user set based on a preset similarity threshold and a final similarity to obtain a corresponding identification result; wherein the identification result indicates whether the two users in the similar user set are the same user or different users.

[0137] In a possible implementation, the computing module is specifically configured to:

[0138] Obtain the company's own basic corpus and the preset Chinese name corpus;

[0139] A corresponding training corpus is formed based on the basic corpus, the Chinese name corpus and the user information.

[0140] In a possible implementation manner, the second acquisition module is specifically configured to:

[0141] Based on the word vectors of two users in the similar user set, the final similarity between the two users is obtained, including:

[0142] Based on the word vectors of two users in the similar user set, the angle cosine similarity corresponding to each word vector is calculated, and the total angle cosine similarity is obtained according to the angle cosine similarity; wherein the angle cosine similarity includes the angle cosine similarity of user name, the angle cosine similarity of login name, the angle cosine similarity of position and the angle cosine similarity of organizational structure; the total angle cosine similarity includes the total name angle cosine similarity and the total work angle cosine similarity;

[0143] Calculate the local sensitive hash sensitivities of two users based on the local sensitive hash signatures of the users; the local sensitive hash sensitivities include a first local sensitive hash sensitivity and a second local sensitive hash sensitivity;

[0144] Calculate the similarity distance and edit distance between two users based on their word vectors;

[0145] Based on the preset weight ratio, the total angle cosine similarity, local sensitive hashing sensitivity, similarity distance and edit distance are weightedly calculated to obtain the final similarity between the user and similar users.

[0146] In a possible implementation manner, the second acquisition module is specifically configured to:

[0147] Calculate the angle cosine similarity of the user name vector, login name vector, position vector and organizational structure vector of the two users respectively, and obtain the angle cosine similarity corresponding to each word vector;

[0148] Based on the integration of user name angle cosine similarity and login name angle cosine similarity, the corresponding total name angle cosine similarity is obtained. Based on the integration of position angle cosine similarity and organizational structure angle cosine similarity, the corresponding total work angle cosine similarity is obtained.

[0149] In a possible implementation, the user auditing device based on the enterprise application log further includes:

[0150] A third acquisition module is used to collect a first application log of the enterprise application connected to the target platform before the new enterprise application is connected to the target platform, and to obtain a corpus model of the new enterprise application based on the first application log;

[0151] The second identification module is used to obtain the user profile of the user based on the corpus model, and identify the user's high-risk operations based on the user profile.

[0152] In a possible implementation manner, the third acquisition module is specifically configured to:

[0153] Collecting first application logs of enterprise applications that have been connected to the target platform within a preset period, and determining a log corpus of a new enterprise application based on the first application logs;

[0154] The log corpus is segmented based on a preset segmentation algorithm to obtain a segmented corpus that can be used for natural language processing training;

[0155] The word segmentation corpus is trained based on the word vector representation model to obtain the corpus model of new enterprise applications.

[0156] In a possible implementation manner, the second identification module is specifically used to:

[0157] Collect the second application logs of the enterprise application that has been connected to the target platform;

[0158] Preset basic portrait keywords for the user, and based on the portrait keywords, use the corpus model to perform similar word search in the second application log, so as to perform real-time search on the second application log;

[0159] In response to retrieving the portrait keyword in the second application log, the corresponding user is dynamically qualified and a user portrait of the user is constructed.

[0160] The user audit device based on enterprise application logs provided in the embodiment of the present application collects basic data of different enterprise applications that need to access the target platform, and calculates the local sensitive hash signatures of users of the enterprise applications based on a preset local sensitive hash algorithm, obtains a training corpus and a word vector representation model to be trained, and trains the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model, extracts word vectors from user information based on the trained word vector representation model to obtain a word vector corresponding to the user, and after storing the basic data and the word vectors in a preset database, queries a set of similar users that are similar to each other based on the database, and obtains a final similarity of the two users based on the word vectors of the two users in the similar user set, and identifies the two users in the similar user set based on a preset similarity threshold and the final similarity to obtain a corresponding identification result. The user audit device based on enterprise application logs of the present application extracts word vectors for user information in basic data of different enterprise applications through a word vector representation model trained by a training corpus, obtains word vectors corresponding to the users, and queries a set of similar users that are similar to each other. The final similarity of the two users is obtained based on the word vectors of the two users for identification. It can effectively link between various enterprise application platforms, realize user uniqueness confirmation when aggregating multiple enterprise application platforms, improve the accuracy of user identity confirmation, and thus improve the accuracy of audit results.

[0161] like Figure 6 As shown, an electronic device 600 provided in an embodiment of the present application includes: a processor 601, a memory 602 and a bus, wherein the memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the user audit method based on enterprise application logs as described above.

[0162] Specifically, the above-mentioned memory 602 and processor 601 can be general-purpose memory and processor, which are not specifically limited here. When the processor 601 runs the computer program stored in the memory 602, the above-mentioned user audit method based on the enterprise application log can be executed.

[0163] Corresponding to the above-mentioned user audit method based on enterprise application logs, an embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned user audit method based on enterprise application logs are executed.

[0164] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0165] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0166] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0167] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the deployment method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0168] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A user audit method based on enterprise application logs, characterized in that: The user audit method comprises: Collect basic data of different enterprise applications that need to access the target platform, and calculate the local sensitive hash signature of the user of the enterprise application based on a preset local sensitive hash algorithm; wherein the basic data includes at least user information and operation log; the user information includes at least user name, login name, position, and organizational structure; Acquire a training corpus and a word vector representation model to be trained, and train the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model; Extracting word vectors from the user information based on the trained word vector representation model to obtain a word vector corresponding to the user; wherein the word vector includes at least a user name vector, a login name vector, a job title vector, and an organizational structure vector; After storing the basic data and the word vectors in a preset database, querying a set of similar users that are similar to each other based on the database, and obtaining a final similarity between the two users based on the word vectors of the two users in the similar user set; each similar user set includes a first user and a second user; Based on a preset similarity threshold and the final similarity, two users in the similar user set are identified to obtain a corresponding identification result; wherein the identification result indicates that the two users in the similar user set are the same user or different users.

2. The method according to claim 1, characterized in that The step of obtaining a training corpus comprises: Obtain the company's own basic corpus and the preset Chinese name corpus; A corresponding training corpus is formed based on the basic corpus, the Chinese name corpus and the user information.

3. The method according to claim 2, characterized in that The obtaining the final similarity between the two users based on the word vectors of the two users in the similar user set includes: Based on the word vectors of two users in the similar user set, the angle cosine similarity corresponding to each word vector is calculated, and the total angle cosine similarity is obtained according to the angle cosine similarity; wherein the angle cosine similarity includes the user name angle cosine similarity, the login name angle cosine similarity, the position angle cosine similarity and the organizational structure angle cosine similarity; the total angle cosine similarity includes the total name angle cosine similarity and the total work angle cosine similarity; Calculate the local sensitive hash sensitivities of the two users based on the local sensitive hash signatures of the users; the local sensitive hash sensitivities include a first local sensitive hash sensitivity and a second local sensitive hash sensitivity; Calculate the similarity distance and edit distance of the two users based on the word vectors of the two users; The total angle cosine similarity, the local sensitive hashing sensitivity, the similarity distance and the edit distance are weightedly calculated based on a preset weight ratio to obtain a final similarity between the user and the similar user.

4. The method according to claim 3, characterized in that The obtaining the total angle cosine similarity according to the angle cosine similarity comprises: Calculate the angle cosine similarity of the user name vector, login name vector, position vector and organizational structure vector of the two users respectively, and obtain the angle cosine similarity corresponding to each word vector; Based on the integration of the user name angle cosine similarity and the login name angle cosine similarity, the corresponding total name angle cosine similarity is obtained; based on the integration of the position angle cosine similarity and the organizational structure angle cosine similarity, the corresponding total work angle cosine similarity is obtained.

5. The method according to claim 4, characterized in that The method further comprises: Before the new enterprise application is connected to the target platform, a first application log of the enterprise application connected to the target platform is collected, and a corpus model of the new enterprise application is obtained based on the first application log; A user profile of the user is obtained based on the corpus model, and high-risk operations of the user are identified based on the user profile.

6. The method according to claim 5, characterized in that The collecting a first application log of an enterprise application connected to the target platform, and obtaining a corpus model of the new enterprise application based on the first application log, includes: Collecting first application logs of enterprise applications that have been connected to the target platform within a preset period, and determining a log corpus of the new enterprise application based on the first application logs; Segmenting the log corpus based on a preset segmentation algorithm to obtain a segmentation corpus that can be used for natural language processing training; The word segmentation corpus is trained based on the word vector representation model to obtain a corpus model of the new enterprise application.

7. The method according to claim 5, characterized in that The acquiring the user portrait of the user based on the corpus model includes: Collecting a second application log of an enterprise application that has been connected to the target platform; Presetting basic portrait keywords for the user, and based on the portrait keywords, using the corpus model to perform similar word search in the second application log, so as to perform real-time search on the second application log; In response to retrieving the portrait keyword in the second application log, the corresponding user is dynamically qualified and a user portrait of the user is constructed.

8. A user auditing device based on enterprise application logs, characterized in that: The user auditing device comprises: A calculation module, used to collect basic data of different enterprise applications that need to access the target platform, and calculate the local sensitive hash signature of the user of the enterprise application based on a preset local sensitive hash algorithm; wherein the basic data includes at least user information and operation log; the user information includes at least user name, login name, position, and organizational structure; A training module, used to obtain a training corpus and a word vector representation model to be trained, and train the word vector representation model to be trained based on the training corpus to obtain a trained word vector representation model; A first acquisition module is used to extract word vectors from the user information based on the trained word vector representation model to obtain a word vector corresponding to the user; wherein the word vector includes at least a user name vector, a login name vector, a job title vector, and an organizational structure vector; A second acquisition module is used to query a set of similar users that are similar to each other based on the database after storing the basic data and the word vector in a preset database, and obtain a final similarity between the two users based on the word vectors of the two users in the similar user set; each similar user set includes a first user and a second user; The first identification module is used to identify two users in the similar user set based on a preset similarity threshold and the final similarity to obtain a corresponding identification result; wherein the identification result indicates that the two users in the similar user set are the same user or different users.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the user audit method based on enterprise application logs as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the user audit method based on enterprise application logs as described in any one of claims 1 to 7.

Images