An abnormal behavior management system for small programs that integrates artificial intelligence

Abstract

The present invention belongs to the technical field of mini-programs, and discloses a mini-program abnormal behavior management system that integrates artificial intelligence; the system comprises: real-time collection of multi-dimensional data streams, spatiotemporal slicing of the multi-dimensional data streams, extraction of behavioral feature vectors within each time window, and construction of a dynamic behavior baseline model bound to the user identity; calculation of the deviation between the behavioral feature vectors and the dynamic behavior baseline model, and generation of a real-time abnormality confidence coefficient based on the similarity matching degree with a preset historical abnormal event library; identification of hidden correlations of cross-interface call links, and subsequent construction of an abnormality propagation probability graph; dynamic correction of the weights of nodes in the abnormality propagation probability graph using the real-time abnormality confidence coefficient to obtain the corrected weights of the nodes in the abnormality propagation probability graph; and calculation of a comprehensive risk entropy value. When the comprehensive risk entropy value exceeds a risk threshold, a multi-level management and control strategy is dynamically triggered, thereby comprehensively detecting and managing complex mini-program abnormal behaviors.

Description

Technical Field

[0001] The present invention relates to the field of mini-program technology, and more specifically, to a mini-program abnormal behavior management system integrating artificial intelligence. Background Art

[0002] With the rapid development of mobile Internet, mini programs have gradually emerged as a new form of application and have been widely used. Mini programs do not require installation and are readily available, providing users with an excellent user experience. However, with the popularization of mini programs, their security issues have become increasingly prominent. The openness of mini programs exposes them to various potential security threats, such as malicious code injection, sensitive information theft, resource abuse, cheating, etc. Once a mini program is attacked or exhibits abnormal behavior, it will not only affect the user experience, but may also lead to serious consequences such as privacy leakage and economic losses.

[0003] However, existing technologies often only focus on single-dimensional data, such as user operation events or API call frequency, making it difficult to fully grasp the multiple aspects of abnormal behavior, which limits the accuracy and coverage of anomaly detection. Taking an e-commerce mini-program as an example, if only user click behavior is monitored while ignoring data such as network requests and resource consumption, some potential anomalies such as order-padding behavior or program vulnerabilities may be missed. Secondly, traditional methods are mostly based on static rules or thresholds for anomaly judgment, lacking adaptability and intelligence, and cannot effectively respond to the continuous evolution of abnormal behavior. Furthermore, existing systems find it difficult to explore and utilize the inherent correlations between abnormal behaviors and cannot comprehensively assess the propagation risk and impact range of anomalies. In addition, after discovering an anomaly, traditional systems usually take a single processing measure and lack refined, multi-level anomaly control strategies. Finally, existing systems lack the ability to trace the causes and root causes of anomalies, making it difficult to accurately locate the abnormal code area and take targeted repair measures. If the specific occurrence path of the anomaly cannot be traced, it is difficult to efficiently repair the related vulnerabilities or defects.

[0004] In view of this, the present invention proposes a mini-program abnormal behavior management system that integrates artificial intelligence to solve the above problems. Summary of the Invention

[0005] In order to overcome the above-mentioned shortcomings of the prior art and achieve the above-mentioned objectives, the present invention provides the following technical solutions: a mini-program abnormal behavior management system integrated with artificial intelligence, comprising: a data acquisition module for real-time acquisition of multi-dimensional data streams during the mini-program operation, the multi-dimensional data streams including user operation event sequences, API call frequency matrices, resource consumption fluctuation curves, and network request and response graphs;

[0006] A behavior modeling module is used to slice the multi-dimensional data stream into time and space according to preset time windows, extract the behavior feature vectors within each time window, and build a dynamic behavior baseline model bound to the user identity;

[0007] A preliminary matching module is used to calculate the deviation between the behavior feature vector and the dynamic behavior baseline model, and generate a real-time anomaly confidence coefficient based on the similarity matching with the preset historical anomaly event library;

[0008] A graph construction module is used to identify hidden correlations in cross-interface call links based on topological changes in the network request-response graph, and then construct an anomaly propagation probability graph. The weights of the nodes in the anomaly propagation probability graph are dynamically modified using the real-time anomaly confidence coefficient to obtain modified weights of the nodes in the anomaly propagation probability graph.

[0009] The comprehensive management and control module is used to integrate the deviation, real-time anomaly confidence coefficient and the corrected weights of the nodes in the anomaly propagation probability graph, calculate the comprehensive risk entropy value, preset the risk threshold, and dynamically trigger the multi-level management and control strategy when the comprehensive risk entropy value exceeds the risk threshold: according to the business module where the anomaly peak is located in the API call frequency matrix, locate the code hot zone and inject behavioral interception probes, and at the same time generate an encrypted audit log containing the traceability path of resource consumption fluctuations; each module is connected by wired and / or wireless means.

[0010] Furthermore, the method of obtaining the user operation event sequence includes:

[0011] Inject a lightweight event capture hook into the mini-program framework layer to obtain comprehensive data on user operation events. The comprehensive data includes type, occurrence timestamp, event source component ID, and event parameters. This comprehensive data is serialized into binary or compressed format to obtain a user event information sequence.

[0012] In the view layer of the mini program, a front-end framework that supports virtual DOM trees is used. After the view layer rendering is completed, the differences between the new virtual DOM tree and the old virtual DOM tree are compared to obtain only the changed DOM node paths. These DOM node paths are associated with the corresponding user event information sequences, and these changed DOM node paths and the corresponding user event information sequences are serialized and uploaded to obtain the user operation event sequence.

[0013] Furthermore, the method for obtaining the API call frequency matrix includes:

[0014] An API call monitoring agent is implanted in the mini-program runtime environment. By modifying the mini-program runtime context object, all API methods that need to be monitored are rewritten. In the rewritten API methods, the timestamp and call parameters of the API call are first recorded; then the logic of the original API method is executed and the return result is recorded. A unique ID is assigned to each API, and the API call timestamp, call parameters, and return result are serialized into a binary format to obtain a call record. Using the API ID as the key, the corresponding call record is stored in the ring buffer in the memory.

[0015] Maintain a configuration table to store the importance score of each API and dynamically calculate a sampling rate benchmark value for each API ;in, and is the weight parameter; is the current CPU usage, is the current memory usage;

[0016] Preset an importance threshold. For APIs with an importance score greater than the importance threshold, multiply their sampling rate baseline value by a random number in the interval (1, 2] to obtain the corresponding sampling rate. For APIs with an importance score less than or equal to the importance threshold, use the sampling rate baseline value as the corresponding sampling rate. Generate a random floating-point number between 0 and 1. If the sampling rate corresponding to the API is greater than or equal to the random floating-point number, record the call record of this API. If the sampling rate corresponding to the API is less than the random floating-point number, do not record the call record of this API and directly execute the API logic.

[0017] With a fixed time window as the period, the ring buffer in the memory is scanned, the number of calls of each API in the time window is counted, and the API call frequency matrix is constructed.

[0018] Furthermore, the network request response graph is obtained in the following manner:

[0019] By modifying the context object of the network library during the mini-program runtime, all network request sending and response receiving methods are rewritten. In the rewritten methods, the original data packets of each HTTP / HTTPS request and response are intercepted and recorded as request packets and response packets; the intercepted request packets are parsed to identify the basic information of the request, including the URL path, query parameters, and request body;

[0020] Pre-train a semantic classification model to perform semantic content classification on the basic information of the request and label the request type. For each request packet, construct the basic information into a request vector. For each response packet, extract the response status code and response body and construct a response vector.

[0021] Use the pre-trained BERT semantic model to embed the request vector and response vector, map each request vector / response vector to an m-dimensional semantic vector, calculate the cosine similarity between the request vector / response vector and the semantic vector as the corresponding semantic score, i.e., the request semantic score and response semantic score; set the request semantic score threshold t1 and the response semantic score threshold t2. If the request semantic score is greater than or equal to t1, create a request node; if the response semantic score is greater than or equal to t2, create a response node. The node attributes of the response node and the request node include the request URL, request body hash, response status code, and the corresponding semantic vector; if the initiation time of the request node A is before the arrival time of the response node B, and the URL of A is the same as the URL of B, create a directed edge from A to B, and the attributes of the directed edge include the response delay; calculate the cosine similarity between the semantic vectors of the request node A and the response node B, recorded as the semantic similarity; set the relevance threshold t3. If the semantic similarity is greater than or equal to t3, create a directed edge from A to B, and the attributes of the directed edge include this cosine similarity;

[0022] Set the path compression threshold t4 and the similarity compression threshold t5. If the path length from request node A to response node B is greater than t4, and the product of the semantic similarity from request node to response node in the path length is greater than t5, then directly create a dependency edge from A to B and mark it as a compressed edge. This is how the network request-response graph is obtained.

[0023] Furthermore, the behavior feature vector is extracted in the following manner:

[0024] Perform sliding window statistics on the user operation event sequence within the time window to calculate the event type distribution entropy and the standard deviation of the intervals between adjacent operations. Perform singular value decomposition on the API call frequency matrix and extract the first k principal components to form the call pattern characteristics. Perform wavelet packet transform on the resource consumption fluctuation curve to extract the coefficients of the three frequency bands with the highest energy share. Normalize and concatenate the event type distribution entropy, the standard deviation of the intervals between adjacent operations, the call pattern characteristics, and the frequency band coefficients to form a dimensionally configurable feature vector, which is the behavior feature vector.

[0025] Furthermore, the dynamic behavior baseline model is constructed in the following ways:

[0026] The user's unique identifier is obtained through the login status and device identification of the mini program; the user's behavioral feature vector is collected for a period of time, which is then recorded as the historical behavioral feature vector. The historical behavioral feature vector is reversely decomposed in the order of normalization and splicing to obtain the corresponding vector elements, and each vector element is used as a corresponding feature view; for each feature view, different unsupervised encoding methods are used to perform feature transformation in the corresponding encoding feature space; in the encoding feature space of each feature view, different clustering algorithms are used to obtain the clustering results under each feature view, and the results of different clustering algorithms under the same feature view are fused to obtain the final clustering result, and the main cluster center in the clustering result is used as the dynamic behavior baseline model of the corresponding user.

[0027] Furthermore, the method of fusing the results of different clustering algorithms under the same feature view includes: sampling a certain number of instance pairs from each feature view, the instance pairs including similar positive example pairs and dissimilar negative example pairs; constructing a The triples of , For example, Label the similarity; build a deep metric network, which consists of two sub-networks, each of which inputs an instance of a feature view, and the weights of the two sub-networks are shared; set a contrast loss function ;

[0028] ;

[0029] in, is the set of positive example pairs, is the set of counterexample pairs; for The index of the instance in , for The index of the instance in , Index The instances in the index Examples in For the depth metric network instance The embedding map of For the depth metric network instance The embedding map of For example and examples The attention weight coefficient between For example and The attention weight coefficient between For the depth metric network instance The embedding map of is the Gaussian kernel function, is a polynomial kernel function, is the L2 norm, is the regularization coefficient, is the comprehensive regularization term; is the set of all attention weights;

[0030] Comprehensive regularization term The calculation method is:

[0031] The state transition probability matrix PL is constructed based on the similarity annotations between instances. The elements in the state transition probability matrix ;in, For example Hedi Instances The similarity between them is marked; then ;in, is the Frobenius norm;

[0032] The trained deep metric network is used to generate compact embedding representations of instances of feature views. The mean distance between the compact embedding representations of instance pairs under the same feature view is calculated as the internal correlation measure of the feature view. The mean distance between the compact embedding representations of instance pairs under different feature views is calculated as the correlation measure between different feature views.

[0033] Normalize the internal correlation measure of the feature view into the intra-view weight, and normalize the correlation measure between different feature views into the inter-view weight. Then define the final view weight of the feature view = intra-view weight × inter-view weight. For the same feature view, perform a weighted average of the results obtained by different clustering algorithms, and the weight is the corresponding view weight.

[0034] Furthermore, the method of generating the real-time anomaly confidence coefficient includes:

[0035] The dynamic behavior baseline model is modeled as a Gaussian mixture model. The probability density values of the current behavior feature vector under each sub-model in the Gaussian mixture model are calculated. The probability density values are logarithmically transformed and then weighted summed to obtain the deviation. The dynamic time warping distance between the current behavior feature vector and each record in the historical abnormal event database is calculated. The smallest dynamic time warping distance is recorded as the similarity matching degree. The similarity matching degree and the deviation degree are weighted and fused to generate a real-time anomaly confidence coefficient.

[0036] The method for constructing the anomaly propagation probability map includes:

[0037] In time window t, obtain a snapshot G(t) of the network request-response graph. In the subsequent time window t+1, obtain a new snapshot G(t+1) of the network request-response graph. Compare G(t) and G(t+1) to extract the changed nodes and edges, including additions, deletions, and modifications.

[0038] For newly added nodes, based on their semantic vectors and the relevance threshold t3, similar nodes are searched in G(t) and directed edges are established. For modified nodes, their semantic similarity is recalculated and the association relationship is updated based on the semantic similarity, that is, directed edges are connected to other nodes, that is, hidden associations of cross-interface call links are identified. Based on the topological structure of G(t+1), an initial anomaly propagation probability graph PU is constructed. For each pair of associated request node A and response node B, the shortest path length d from A to B is calculated, and the initial propagation probability of the directed edge from A to B is set to ; Record the initial propagation probabilities of all edges in PU, and then obtain the final abnormal propagation probability graph.

[0039] Furthermore, the method of dynamically correcting the weights of nodes in the abnormal propagation probability graph includes:

[0040] If the node is a request node and the API corresponding to its URL has an abnormal peak in the API call frequency matrix, the real-time abnormal confidence coefficient of the API is defined as the preliminary adjustment coefficient of the corresponding node; if the node is a response node and its associated request node has a preliminary adjustment coefficient defined, the response node inherits the value of the same preliminary adjustment coefficient; otherwise, the preliminary adjustment coefficient of the response node is calculated based on the abnormality of the response status code = f(abnormality of response status code × Ct_gin), where f() is a preset linear function and Ct_gin is a preset baseline preliminary adjustment coefficient;

[0041] For each node, its initial weight is defined as the normalized value of its API importance score, based on the initial weight of each node x , calculate its initial revised weight ;in, is the gain coefficient, is the preset control threshold, is the preliminary adjustment coefficient corresponding to the node; the Sigmoid function is restricted on the preliminary modified weight w'_x to obtain the corresponding node The middle weight w''_x of the directed edge is then adjusted to obtain the adjusted propagation probability. The adjustment formula is:

[0042] ;in, For nodes and nodes The adjusted propagation probability of the directed edges between them; For nodes and nodes The initial propagation probability of the directed edge between nodes, w''_y is the ... The middle weight of For nodes Initial weight; is the difference attenuation factor, For nodes The corresponding preliminary adjustment coefficient, For nodes The corresponding preliminary adjustment coefficient is obtained; based on the adjusted propagation probability of the directed edge, the mid-segment weights of the adjacent nodes are back-propagated and corrected, and the update is iterated until the change value of the mid-segment weight is less than the preset change threshold, and the update is stopped to obtain the final node correction weight.

[0043] Furthermore, the calculation method of the comprehensive risk entropy value includes:

[0044] Construct a three-dimensional risk space, where the three coordinate axes correspond to the deviation, the real-time anomaly confidence coefficient, and the node correction weight respectively;

[0045] Calculate the Shannon entropy value of each coordinate axis, and analyze the coupling relationship between the coordinate axes through the covariance matrix to obtain the coupling coefficient; use the entropy weight method to determine the weight of each coordinate axis, recorded as the dimension weight; then calculate the comprehensive risk entropy value ;in, For the coordinate axis The dimension weight of For the coordinate axis The Shannon entropy value of is the covariance matrix The determinant value of is the coupling coefficient.

[0046] The technical effects and advantages of the present invention's mini-program abnormal behavior management system integrating artificial intelligence are as follows:

[0047] The present invention can comprehensively monitor and intelligently control complex abnormal behaviors to ensure the safe and reliable operation of mini-programs; it integrates multi-source heterogeneous data, automatically learns users' normal behavior patterns through artificial intelligence, accurately identifies abnormal deviations, and deeply explores the inherent correlations between abnormal behaviors to assess the scope of risk propagation; according to the comprehensive risk score, the level of the control strategy can be dynamically adjusted to achieve refined and graded abnormal management; it can not only detect anomalies in a timely manner, but also automatically track the root causes of anomalies, generate traceability path audit logs, provide direct clues for abnormal diagnosis and repair, and improve response efficiency; at the same time, it can accurately locate abnormal code areas, inject behavior interception mechanisms, actively block potential threats, curb the spread of abnormal behaviors from the source, and maximize the protection of the healthy operation of mini-programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a schematic diagram of an abnormal behavior management system for mini-programs that integrates artificial intelligence according to the present invention;

[0049] Figure 2 This is a schematic diagram of a method for managing abnormal behavior of mini-programs that integrates artificial intelligence. DETAILED DESCRIPTION

[0050] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0051] Example 1

[0052] See also Figure 1 As shown, the embodiment of the invention provides an artificial intelligence-integrated mini-program abnormal behavior management system, including: a data acquisition module for real-time acquisition of multi-dimensional data streams during mini-program operation, the multi-dimensional data streams including user operation event sequences, API call frequency matrices, resource consumption fluctuation curves, and network request response graphs;

[0053] The behavior modeling module is used to slice the multi-dimensional data stream into time and space according to preset time windows, extract the behavior feature vector within each time window, and build a dynamic behavior baseline model bound to the user identity;

[0054] The preliminary matching module is used to calculate the deviation between the behavior feature vector and the dynamic behavior baseline model, and generate a real-time anomaly confidence coefficient based on the similarity matching with the preset historical anomaly event library;

[0055] The graph construction module is used to identify the hidden correlations of cross-interface call links based on the topological changes of the network request-response graph, and then construct an anomaly propagation probability graph. The weights of the nodes in the anomaly propagation probability graph are dynamically modified using the real-time anomaly confidence coefficient to obtain the modified weights of the nodes in the anomaly propagation probability graph.

[0056] The comprehensive management and control module is used to integrate the deviation degree, real-time anomaly confidence coefficient and the corrected weights of the nodes in the anomaly propagation probability graph, calculate the comprehensive risk entropy value, preset the risk threshold, and dynamically trigger the multi-level management and control strategy when the comprehensive risk entropy value exceeds the risk threshold: according to the business module where the anomaly peak is located in the API call frequency matrix, the code hot zone is located and the behavior interception probe is injected, and at the same time, an encrypted audit log containing the traceability path of resource consumption fluctuations is generated; each module is connected by wired and / or wireless means to realize data transmission between modules.

[0057] Methods for obtaining user operation event sequences include:

[0058] A lightweight event capture hook is injected into the mini-program framework layer to obtain comprehensive data of user operation events; the comprehensive data includes type (click, slide, input, etc.), occurrence timestamp, event source component ID and event parameters, and these comprehensive data are serialized into an efficient binary format or compressed format to reduce the amount of data transmission and obtain a user event information sequence.

[0059] In the view layer of the mini-program, a front-end framework that supports virtual DOM trees, such as React and Vue, is used. After the view layer is rendered, the new virtual DOM tree is compared with the old virtual DOM tree to obtain only the changed DOM node paths. These DOM node paths are then associated with the corresponding user event information sequences. These changed DOM node paths and the corresponding user event information sequences are serialized and uploaded without having to transmit the entire page data, thereby obtaining the user operation event sequence.

[0060] Methods for obtaining the API call frequency matrix include:

[0061] An API call monitoring agent is implanted in the mini-program runtime environment. By modifying the context object (such as the wx object) during the mini-program runtime, all API methods that need to be monitored are rewritten. In the rewritten API method, the timestamp and call parameters of the API call are first recorded; then the logic of the original API method is executed and the return result is recorded. In this way, the call status of each API can be intercepted and recorded non-invasively.

[0062] Assign a unique ID to each API, serialize the API call timestamp, call parameters, and return results into an efficient binary format to obtain a call record; use the API ID as the key and store the corresponding call record in a ring buffer in memory.

[0063] Maintain a configuration table to store the importance score of each API. Specifically, assign an importance score of 0-10 to each API based on factors such as the API category, function, and corresponding business value. For example, the importance score of network request-related APIs is 9; the importance score of data storage-related APIs is 8; the importance score of media-related APIs is 7; the importance score of UI rendering-related APIs is 6; and the importance score of other tool APIs is 4.

[0064] Dynamically calculate a sampling rate baseline for each API ;in, and is the weight parameter, which is adjusted according to the actual situation, and the sum of the two is 1. is the current CPU usage, The current memory usage.

[0065] Preset an importance threshold. For APIs with an importance score greater than the importance threshold, multiply their sampling rate baseline value by a random number in the interval (1, 2] to obtain the corresponding sampling rate. For APIs with an importance score less than or equal to the importance threshold, use the sampling rate baseline value as the corresponding sampling rate. Generate a random floating-point number between 0 and 1. If the sampling rate corresponding to the API is greater than or equal to the random floating-point number, record the call record of this API. If the sampling rate corresponding to the API is less than the random floating-point number, do not record the call record of this API and directly execute the API logic.

[0066] Using a fixed time window (e.g., 1 minute) as a cycle, the ring buffer in memory is scanned, the number of calls to each API within the time window is counted, and an API call frequency matrix is constructed for subsequent analysis. While accurately obtaining the call frequency of each API, the sampling granularity is dynamically adjusted to ensure data quality while reducing performance overhead.

[0067] A lightweight resource collection agent is deployed in the mini-program container. The resource collection agent periodically collects comprehensive indicators of the current mini-program through the interface provided by the operating system, including CPU usage, memory usage, and network traffic. The collected comprehensive indicators are serialized by time, and a fluctuation trend chart of the indicators is drawn, which is the resource consumption fluctuation curve.

[0068] The methods for obtaining the network request and response graph include:

[0069] By modifying the context object of the network library when the mini program is running, all methods of sending network requests and receiving responses are rewritten. In the rewritten methods, the original data packets of each HTTP / HTTPS request and response are intercepted and recorded as request packets and response packets; the intercepted request packets are parsed to identify the basic information of the request, including the URL path, query parameters and request body.

[0070] A semantic classification model is pre-trained to perform semantic content classification on the basic information of the request and label the request type (such as login, query, and payment). For each request packet, the basic information is constructed into a request vector (vector concatenation). For each response packet, the response status code and response body are extracted and constructed into a response vector. The dimension of both the request and response vectors is n, which is configurable and typically ranges from 20 to 50.

[0071] Use a pre-trained semantic model such as BERT to embed the request and response vectors, and map each request / response vector into an m-dimensional semantic vector. m is usually 512-768. Calculate the cosine similarity between the request / response vector and the semantic vector as the corresponding semantic score, namely the request semantic score and the response semantic score.

[0072] Set the request semantic score threshold t1 and the response semantic score threshold t2. If the request semantic score is greater than or equal to t1, create a request node. If the response semantic score is greater than or equal to t2, create a response node. The node attributes of the response node and the request node include the request URL, request body hash, response status code, and the corresponding semantic vector. If the initiation time of the request node A is before the arrival time of the response node B, and the URL (target) of A is the same as the URL (source) of B, create a directed edge from A to B. The attributes of the directed edge include the response latency.

[0073] Calculate the cosine similarity between the semantic vectors of the request node A and the response node B, which is recorded as semantic similarity; set the relevance threshold t3. If the semantic similarity is greater than or equal to t3, create a directed edge from A to B. The attributes of the directed edge include this cosine similarity.

[0074] Set the path compression threshold t4 and the similarity compression threshold t5. If the path length (number of intermediate nodes) from request node A to response node B is greater than t4, and the product of the semantic similarity from request node to response node in the path length is greater than t5, then directly create a dependency edge from A to B and mark it as a compressed edge. This results in a network request-response graph. Use the graph database Neo4j to store the constructed network request-response graph, create node and edge indexes, speed up subsequent query operations, and periodically take snapshots of the graph for time-tracing analysis.

[0075] The methods for performing time-space slicing include:

[0076] Set a fixed time window size, such as 1 minute, 5 minutes, etc. The time window size can be dynamically adjusted according to the real-time requirements of the data and the computing resources. Starting from the start time of the multi-dimensional data stream, a series of non-overlapping time slices are generated according to the set time window size. Each time slice is represented by a tuple (start time, end time). The original multi-dimensional data stream is distributed. For each tuple, all the data in it is collected and stored in the corresponding data storage nodes, such as distributed file systems, databases, etc.

[0077] The methods for extracting behavioral feature vectors include:

[0078] Perform sliding window statistics on the user operation event sequence within the time window to calculate the event type distribution entropy and the standard deviation of the intervals between adjacent operations. Perform singular value decomposition on the API call frequency matrix and extract the first k principal components to form the call pattern characteristics. Perform wavelet packet transform on the resource consumption fluctuation curve to extract the coefficients of the three frequency bands with the highest energy share. Normalize and concatenate the event type distribution entropy, the standard deviation of the intervals between adjacent operations, the call pattern characteristics, and the frequency band coefficients to form a dimensionally configurable feature vector, which is the behavior feature vector.

[0079] The dynamic behavior baseline model is constructed in the following ways:

[0080] The user's unique identifier is obtained through the login status and device identification of the mini program, which can be obtained by quantifying the login status and device identification and adding them together; the user's behavioral feature vector is collected for a period of time (for example, 2 weeks), which is then recorded as a historical behavioral feature vector. The historical behavioral feature vector is decomposed in reverse according to the order of normalization and splicing to obtain the corresponding vector elements, and each vector element is used as a corresponding feature view; for example, the event type distribution view (event type distribution entropy value), API call pattern view (call pattern feature), etc.

[0081] For each feature view, different unsupervised encoding methods are used to perform feature transformation in the corresponding encoding feature space. For example, the event type distribution view can use Word2Vec encoding; the API call pattern view can use autoencoder encoding, etc.

[0082] In the encoded feature space of each feature view, different clustering algorithms (such as Gaussian mixture model, DBSCAN, spectral clustering, etc.) are used to obtain the clustering results under each feature view. The results of different clustering algorithms under the same feature view are fused to obtain the final clustering result. The main cluster center in the clustering result is used as the dynamic behavior baseline model of the corresponding user; the main cluster center is evaluated by the silhouette coefficient, and clusters with higher silhouette coefficients are usually more representative.

[0083] Specifically, a certain number of instance pairs are sampled from each feature view, and the instance pairs include similar positive pairs and dissimilar negative pairs; construct a The triples of , For example, It is a similarity label (a random number between 0 and 1). It should be noted that for each feature view (such as the event type distribution view and the API call pattern view), some sample instances are randomly selected from the historical data and paired with each other to form instance pairs. For each instance pair, their similarity is calculated based on a similarity metric (such as Euclidean distance and cosine similarity). Based on the similarity, the instance pairs are divided into similar positive pairs and dissimilar negative pairs.

[0084] Construct a deep metric network, which consists of two sub-networks. Each sub-network inputs an instance of a feature view. The weights of the two sub-networks are shared to ensure symmetry. The sub-network can be a convolutional network, a recursive network, etc., and a contrast loss function is set according to the characteristics of the view data. ;

[0085] ;

[0086] in, is the set of positive example pairs, is the set of counterexample pairs; for The index of the instance in , for The index of the instance in , Index The instances in the index Examples in For the depth metric network instance The embedding map of For the depth metric network instance The embedding map of For example and examples The attention weight coefficient between For example and The attention weight coefficients between can all be randomly generated random numbers. For the depth metric network instance The embedding map of is the Gaussian kernel function, is a polynomial kernel function, is the L2 norm, is the regularization coefficient, which controls the weight of the regularization term. is the comprehensive regularization term; is the set of all attention weights.

[0087] Comprehensive regularization term The calculation method is:

[0088] The state transition probability matrix PL is constructed based on the similarity annotations between instances. The elements in the state transition probability matrix ;in, For example Hedi Instances The similarity between them is marked; then ;in, is the Frobenius norm;

[0089] The goal of the contrastive loss function is to minimize the distance between positive pairs and maximize the distance between negative pairs. The deep metric network is iteratively trained using instance pairs and the parameters of the deep metric network are optimized using the optimizer until the preset maximum number of iterations is reached to obtain the trained deep metric network.

[0090] The trained deep metric network can be used to generate compact embedding representations of instances of feature views. The mean distance between the compact embedding representations of instance pairs under the same feature view is calculated as the internal correlation measure of the feature view; the mean distance between the compact embedding representations of instance pairs under different feature views is calculated as the correlation measure between different feature views.

[0091] Normalize the internal correlation measure of the feature view into the intra-view weight, and normalize the correlation measure between different feature views into the inter-view weight. Then define the final view weight of the feature view = intra-view weight × inter-view weight. High-weight views have a greater impact on the results, while low-weight views have a smaller impact. For the same feature view, perform a weighted average of the results obtained by different clustering algorithms, and the weight is the corresponding view weight.

[0092] Deep metric learning is used to automatically capture the correlation between views and adaptively learn the weight of each view based on this correlation. Within the same view, the results of different clustering algorithms are weighted and fused based on their quality. Ultimately, we obtain a robust ensemble clustering model that combines the advantages of multiple views and multiple algorithms, accurately capturing normal user behavior patterns.

[0093] The dynamic behavior baseline model is modeled as a Gaussian mixture model, and the probability density value of the current behavior feature vector under each sub-model in the Gaussian mixture model is calculated; the probability density value is logarithmically transformed and then weighted summed to obtain the deviation; the dynamic time warping distance between the current behavior feature vector and each record in the historical abnormal event library is calculated, and the smallest dynamic time warping distance is recorded as the similarity matching degree. The similarity matching degree and the deviation degree are weightedly fused to generate a real-time anomaly confidence coefficient.

[0094] During the operation of a mini-program, different network interface calls often have inherent associations and dependencies, but these associations may be implicit and not easy to observe directly. By analyzing the topological changes in the network request-response graph, these hidden associations can be discovered and mined.

[0095] Specifically, a cross-interface call chain refers to a situation where the response of one interface A triggers a call to another interface B, which may also cascade calls to other interfaces. In the network request-response graph, this situation may appear as follows:

[0096] There is a path between A's response node and B's request node, but there is no direct edge connecting A's response node and B's request node. This indirect call relationship needs to be identified and an association edge from A's response to B's request needs to be constructed to reveal the hidden call link association between them.

[0097] In time window t, obtain a snapshot G(t) of the network request and response graph. In the subsequent time window t+1, obtain a new snapshot G(t+1) of the network request and response graph, compare G(t) and G(t+1), and extract the changed nodes (request nodes, response nodes) and edges (directed edges, compressed edges), including additions, deletions, and modifications. For newly added nodes, based on their semantic vectors and the relevance threshold t3, search for similar nodes in G(t) and establish directed edges. For modified nodes, recalculate their semantic similarity and update the association relationship based on the semantic similarity, that is, connect directed edges with other nodes, that is, identify the hidden associations of cross-interface call links. The adjustment process is the same as the construction method of the network request and response graph.

[0098] Based on the topological structure of G(t+1), an initial anomaly propagation probability graph PU is constructed. For each pair of associated request node A and response node B, the shortest path length d from A to B is calculated, and the initial propagation probability of the directed edge from A to B is set to ; The initial propagation probabilities of all edges are recorded in the PU, and then the final anomaly propagation probability graph is obtained; through the anomaly propagation probability graph, the propagation path and impact range of anomalies starting from any node in the entire request response process can be simulated, laying the foundation for subsequent risk warning and precise control.

[0099] The following steps are used for dynamic weight correction:

[0100] If the node is a request node and the API corresponding to its URL has an abnormal peak in the API call frequency matrix, the real-time abnormality confidence coefficient of the API is defined as the preliminary adjustment coefficient of the corresponding node; if the node is a response node and its associated request node has a preliminary adjustment coefficient defined, the response node inherits the value of the same preliminary adjustment coefficient; otherwise, the preliminary adjustment coefficient of the response node is calculated based on the abnormality of the response status code (such as 5xx error) = f(abnormality of response status code × Ct_gin), where f() is a preset linear function, such as a linear function or a quadratic function; Ct_gin is a preset baseline preliminary adjustment coefficient, usually 0.8.

[0101] It should be noted that the way to quantify the abnormality of the response status code is:

[0102] Categorize status codes:

[0103] 1xx: informational status code;

[0104] 2xx: Success status code;

[0105] 3xx: redirect status code;

[0106] 4xx: client error status code;

[0107] 5xx: server error status code;

[0108] Each type of status code is assigned a basic anomaly score, which is a quantitative value of the abnormality of the response status code; for example,

[0109] 1xx: 0.1;

[0110] 2xx: 0;

[0111] 3xx: 0.3;

[0112] 4xx: 0.7;

[0113] 5xx:1.0.

[0114] For each node, its initial weight is defined as the normalized value of its API importance score, based on the initial weight of each node x , calculate its initial revised weight ;in, is the gain coefficient (default 0.5), which controls the correction amplitude. is the preset control threshold, is the preliminary adjustment coefficient corresponding to the node; the Sigmoid function is restricted on the preliminary modified weight w'_x to obtain the corresponding node The mid-segment weight w''_x.

[0115] Then adjust the initial propagation probability of the directed edge to obtain the adjusted propagation probability; the adjustment formula is:

[0116] ;in, For nodes and nodes The adjusted propagation probability of the directed edges between them; For nodes and nodes The initial propagation probability of the directed edge between nodes, w''_y is the ... The middle weight of For nodes Initial weight; is the difference attenuation factor (default is 0.9). The greater the difference in the initial adjustment coefficients of the two end nodes, the more significant the propagation probability attenuation. For nodes The corresponding preliminary adjustment coefficient, For nodes the corresponding preliminary adjustment coefficient;

[0117] Based on the adjusted propagation probability of the directed edge, the mid-segment weights of the adjacent nodes are back-propagated and corrected, and the update is iterated until the change value of the mid-segment weight is less than the preset change threshold. The update is stopped to obtain the corrected weight of the final node.

[0118] Construct a three-dimensional risk space, where the three coordinate axes correspond to the deviation, the real-time anomaly confidence coefficient, and the node correction weight, respectively. Calculate the Shannon entropy value of each coordinate axis, and analyze the coupling relationship between the coordinate axes through the covariance matrix to obtain the coupling coefficient (such as the mean absolute correlation coefficient). The coupling coefficient usually ranges from 0 to 1. Create an M×3 matrix accordingly, with each row representing a sample and each column representing a dimension. The covariance matrix is constructed as the covariance of this M×3 matrix.

[0119] The entropy weight method is used to determine the weight of each coordinate axis, which is recorded as the dimension weight; then the comprehensive risk entropy value is calculated ;in, For the coordinate axis The dimension weight of For the coordinate axis The Shannon entropy value of is the covariance matrix The determinant value of is the coupling coefficient;

[0120] Analyze the API call frequency matrix to identify APIs with abnormal peaks. Specifically, you can establish a normal call frequency baseline by counting their historical call frequencies. The baseline can be a fixed value or a range, depending on whether the API call pattern is periodic or otherwise regular. Exceeding the baseline indicates an abnormal peak.

[0121] Based on the mapping relationship between API and business modules, determine the business module where the anomaly is located, use code coverage tools to analyze the code execution of the abnormal business module, find the code block with the highest execution frequency, define it as the code hot zone, and insert lightweight behavior interception probes at key locations in the code hot zone. The code of the behavior interception probe contains behavior detection and interception logic, which can limit the frequency of API calls, resource usage, etc.; collect resource consumption fluctuation curves, and use time series data mining algorithms such as DTW (dynamic time warping) to analyze and obtain the resource consumption fluctuation traceability path. The resource consumption fluctuation traceability path, abnormal API call information, and the location of the code hot zone are integrated, and the audit log is encrypted using an asymmetric encryption algorithm.

[0122] The multi-level control strategy is as follows:

[0123] Level 1: Increase monitoring frequency and shorten data collection cycle;

[0124] Level 2: Limit the frequency of abnormal API calls;

[0125] Level 3: Temporarily disable some non-core functions;

[0126] Level 4: Force the user to log in again for authorization;

[0127] Level 5: Temporarily ban the user account;

[0128] Continuously monitor the effectiveness of management and control, and dynamically adjust the level of management and control based on the anomaly mitigation situation (comprehensive risk entropy value and threshold distance assessment). If the anomaly persists, gradually increase the intensity of the control level. After the anomaly is eliminated, gradually relax the control measures.

[0129] This embodiment can comprehensively monitor and intelligently control complex abnormal behaviors to ensure the safe and reliable operation of the mini program; it integrates multi-source heterogeneous data, automatically learns users' normal behavior patterns through artificial intelligence, accurately identifies abnormal deviations, and deeply explores the inherent correlation between abnormal behaviors to assess the scope of risk propagation; based on the comprehensive risk score, the level of the control strategy can be dynamically adjusted to achieve refined and hierarchical abnormality management; not only can anomalies be discovered in a timely manner, but the root cause of the anomaly can also be automatically tracked, and a traceability path audit log can be generated to provide direct clues for anomaly diagnosis and repair, thereby improving response efficiency; at the same time, the abnormal code area can be accurately located, and a behavior interception mechanism can be injected to actively block potential threats, curb the spread of abnormal behavior from the source, and maximize the protection of the healthy operation of the mini program.

[0130] Example 2

[0131] See also Figure 2 As shown, for the parts not described in detail in this embodiment, please refer to the description of Example 1. A method for managing abnormal behavior of mini-programs integrating artificial intelligence is provided, including:

[0132] Step 1: Collect multi-dimensional data streams in real time during the operation of the mini program. The multi-dimensional data streams include user operation event sequences, API call frequency matrices, resource consumption fluctuation curves, and network request and response graphs.

[0133] Step 2: Spatiotemporally slice the multi-dimensional data stream according to preset time windows, extract the behavioral feature vectors within each time window, and build a dynamic behavioral baseline model bound to the user identity;

[0134] Step 3: Calculate the deviation between the behavior feature vector and the dynamic behavior baseline model, combine it with the similarity matching degree with the preset historical abnormal event library, and generate a real-time abnormality confidence coefficient;

[0135] Step 4: Based on the topological changes of the network request-response graph, the hidden correlations of cross-interface call links are identified, and then an anomaly propagation probability graph is constructed. The weights of the nodes in the anomaly propagation probability graph are dynamically modified using the real-time anomaly confidence coefficient to obtain the modified weights of the nodes in the anomaly propagation probability graph;

[0136] Step 5: Integrate the deviation degree, real-time anomaly confidence coefficient, and the modified weights of the nodes in the anomaly propagation probability graph to calculate the comprehensive risk entropy value and preset the risk threshold. When the comprehensive risk entropy value exceeds the risk threshold, a multi-level control strategy is dynamically triggered: based on the business module where the anomaly peak is located in the API call frequency matrix, the code hotspot is located and a behavior interception probe is injected. At the same time, an encrypted audit log containing the traceability path of resource consumption fluctuations is generated.

[0137] Example 3

[0138] This embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the operation mode of the above-mentioned method for managing abnormal behavior of a mini-program integrating artificial intelligence is implemented.

[0139] Since the electronic device introduced in this embodiment is an electronic device used to implement a method for managing abnormal behavior of a small program that integrates artificial intelligence in the embodiment of this application, based on the method for managing abnormal behavior of a small program that integrates artificial intelligence introduced in the embodiment of this application, those skilled in the art can understand the specific implementation of the electronic device of this embodiment and its various variations, so how the electronic device implements the method in the embodiment of this application will not be described in detail here. As long as those skilled in the art implement the electronic device used in the method for managing abnormal behavior of a small program that integrates artificial intelligence in the embodiment of this application, it falls within the scope of protection of this application.

[0140] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters and thresholds in the formulas are set by technicians in this field according to actual conditions.

[0141] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that for users of ordinary skill in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A small program abnormal behavior management system integrating artificial intelligence, characterized by: include: A data collection module is used to collect multi-dimensional data streams in real time during the operation of the mini-program. The multi-dimensional data streams include user operation event sequences, API call frequency matrices, resource consumption fluctuation curves, and network request response graphs. A behavior modeling module is used to slice the multi-dimensional data stream into time and space according to preset time windows, extract the behavior feature vectors within each time window, and build a dynamic behavior baseline model bound to the user identity; A preliminary matching module is used to calculate the deviation between the behavior feature vector and the dynamic behavior baseline model, and generate a real-time anomaly confidence coefficient based on the similarity matching with the preset historical anomaly event library; A graph construction module is used to identify hidden correlations in cross-interface call links based on topological changes in the network request-response graph, and then construct an anomaly propagation probability graph. The weights of the nodes in the anomaly propagation probability graph are dynamically modified using the real-time anomaly confidence coefficient to obtain modified weights of the nodes in the anomaly propagation probability graph. The comprehensive management and control module is used to integrate the deviation, real-time anomaly confidence coefficient and the corrected weights of the nodes in the anomaly propagation probability graph, calculate the comprehensive risk entropy value, preset the risk threshold, and dynamically trigger the multi-level management and control strategy when the comprehensive risk entropy value exceeds the risk threshold: according to the business module where the anomaly peak is located in the API call frequency matrix, locate the code hot zone and inject behavioral interception probes, and at the same time generate an encrypted audit log containing the traceability path of resource consumption fluctuations; each module is connected by wired and / or wireless means.

2. According to the artificial intelligence-integrated mini-program abnormal behavior management system of claim 1, it is characterized in that: The method for obtaining the user operation event sequence includes: Inject a lightweight event capture hook into the mini-program framework layer to obtain comprehensive data on user operation events. The comprehensive data includes type, occurrence timestamp, event source component ID, and event parameters. This comprehensive data is serialized into binary or compressed format to obtain a user event information sequence. In the view layer of the mini program, a front-end framework that supports virtual DOM trees is used. After the view layer rendering is completed, the differences between the new virtual DOM tree and the old virtual DOM tree are compared to obtain only the changed DOM node paths. These DOM node paths are associated with the corresponding user event information sequences, and these changed DOM node paths and the corresponding user event information sequences are serialized and uploaded to obtain the user operation event sequence.

3. The artificial intelligence-integrated mini-program abnormal behavior management system according to claim 2 is characterized in that: Methods for obtaining the API call frequency matrix include: An API call monitoring agent is implanted in the mini-program runtime environment. By modifying the mini-program runtime context object, all API methods that need to be monitored are rewritten. In the rewritten API methods, the timestamp and call parameters of the API call are first recorded; then the logic of the original API method is executed and the return result is recorded. A unique ID is assigned to each API, and the API call timestamp, call parameters, and return result are serialized into a binary format to obtain a call record. Using the API ID as the key, the corresponding call record is stored in the ring buffer in the memory. Maintain a configuration table to store the importance score of each API and dynamically calculate a sampling rate benchmark value for each API ;in, and is the weight parameter; is the current CPU usage, is the current memory usage; Preset an importance threshold. For APIs with an importance score greater than the importance threshold, multiply their sampling rate baseline value by a random number in the interval (1, 2] to obtain the corresponding sampling rate. For APIs with an importance score less than or equal to the importance threshold, use the sampling rate baseline value as the corresponding sampling rate. Generate a random floating point number between 0 and 1. If the sampling rate corresponding to the API is greater than or equal to the random floating point number, the API call record is recorded. If the sampling rate corresponding to the API is less than the random floating point number, the API call record is not recorded and the API logic is executed directly. With a fixed time window as the period, the ring buffer in the memory is scanned, the number of calls of each API in the time window is counted, and the API call frequency matrix is constructed.

4. The artificial intelligence-integrated mini-program abnormal behavior management system according to claim 3 is characterized in that: Methods for obtaining the network request response graph include: By modifying the context object of the network library during the mini-program runtime, all network request sending and response receiving methods are rewritten. In the rewritten methods, the original data packets of each HTTP / HTTPS request and response are intercepted and recorded as request packets and response packets; the intercepted request packets are parsed to identify the basic information of the request, including the URL path, query parameters, and request body; Pre-train a semantic classification model to perform semantic content classification on the basic information of the request and label the request type. For each request packet, construct the basic information into a request vector. For each response packet, extract the response status code and response body and construct a response vector. Use the pre-trained BERT semantic model to embed the request vector and response vector, map each request vector / response vector to an m-dimensional semantic vector, calculate the cosine similarity between the request vector / response vector and the semantic vector as the corresponding semantic score, i.e., the request semantic score and response semantic score; set the request semantic score threshold t1 and the response semantic score threshold t2. If the request semantic score is greater than or equal to t1, create a request node; if the response semantic score is greater than or equal to t2, create a response node. The node attributes of the response node and the request node include the request URL, request body hash, response status code, and the corresponding semantic vector; if the initiation time of the request node A is before the arrival time of the response node B, and the URL of A is the same as the URL of B, create a directed edge from A to B, and the attributes of the directed edge include the response delay; calculate the cosine similarity between the semantic vectors of the request node A and the response node B, recorded as the semantic similarity; set the relevance threshold t3. If the semantic similarity is greater than or equal to t3, create a directed edge from A to B, and the attributes of the directed edge include this cosine similarity; Set the path compression threshold t4 and the similarity compression threshold t5. If the path length from request node A to response node B is greater than t4, and the product of the semantic similarity from request node to response node in the path length is greater than t5, then directly create a dependency edge from A to B and mark it as a compressed edge. This is how the network request-response graph is obtained.

5. The artificial intelligence-integrated mini-program abnormal behavior management system according to claim 4 is characterized in that: The method of extracting the behavior feature vector includes: Perform sliding window statistics on the user operation event sequence within the time window to calculate the event type distribution entropy and the standard deviation of the intervals between adjacent operations. Perform singular value decomposition on the API call frequency matrix and extract the first k principal components to form the call pattern characteristics. Perform wavelet packet transform on the resource consumption fluctuation curve to extract the coefficients of the three frequency bands with the highest energy share. Normalize and concatenate the event type distribution entropy, the standard deviation of the intervals between adjacent operations, the call pattern characteristics, and the frequency band coefficients to form a dimensionally configurable feature vector, which is the behavior feature vector.

6. The artificial intelligence-integrated mini-program abnormal behavior management system according to claim 5 is characterized in that: The dynamic behavior baseline model is constructed in the following ways: The user's unique identifier is obtained through the login status and device identification of the mini program; the user's behavioral feature vector is collected for a period of time, which is then recorded as the historical behavioral feature vector. The historical behavioral feature vector is reversely decomposed in the order of normalization and splicing to obtain the corresponding vector elements, and each vector element is used as a corresponding feature view; for each feature view, different unsupervised encoding methods are used to perform feature transformation in the corresponding encoding feature space; in the encoding feature space of each feature view, different clustering algorithms are used to obtain the clustering results under each feature view, and the results of different clustering algorithms under the same feature view are fused to obtain the final clustering result, and the main cluster center in the clustering result is used as the dynamic behavior baseline model of the corresponding user.

7. The artificial intelligence-integrated mini-program abnormal behavior management system according to claim 6 is characterized in that: The method of fusing the results of different clustering algorithms under the same feature view includes: sampling a certain number of instance pairs from each feature view, the instance pairs including similar positive example pairs and dissimilar negative example pairs; constructing a The triples of , For example, Label the similarity; build a deep metric network, which consists of two sub-networks, each of which inputs an instance of a feature view, and the weights of the two sub-networks are shared; set a contrast loss function ; ； in, is the set of positive example pairs, is the set of counterexample pairs; for The index of the instance in , for The index of the instance in , Index The instances in the index Examples in For the depth metric network instance The embedding map of For the depth metric network instance The embedding map of For example and examples The attention weight coefficient between For example and The attention weight coefficient between For the depth metric network instance The embedding map of is the Gaussian kernel function, is a polynomial kernel function, is the L2 norm, is the regularization coefficient, is the comprehensive regularization term; is the set of all attention weights; Comprehensive regularization term The calculation method is: The state transition probability matrix PL is constructed based on the similarity annotations between instances. The elements in the state transition probability matrix ;in, For example Hedi Instances The similarity between them is marked; then ;in, is the Frobenius norm; The trained deep metric network is used to generate compact embedding representations of instances of feature views. The mean distance between the compact embedding representations of instance pairs under the same feature view is calculated as the internal correlation measure of the feature view. The mean distance between the compact embedding representations of instance pairs under different feature views is calculated as the correlation measure between different feature views. Normalize the internal correlation measure of the feature view into the intra-view weight, and normalize the correlation measure between different feature views into the inter-view weight. Then define the final view weight of the feature view = intra-view weight × inter-view weight. For the same feature view, perform a weighted average of the results obtained by different clustering algorithms, and the weight is the corresponding view weight.

8. The artificial intelligence-integrated mini-program abnormal behavior management system according to claim 7 is characterized in that: The method of generating the real-time anomaly confidence coefficient includes: The dynamic behavior baseline model is modeled as a Gaussian mixture model. The probability density values of the current behavior feature vector under each sub-model in the Gaussian mixture model are calculated. The probability density values are logarithmically transformed and then weighted summed to obtain the deviation. The dynamic time warping distance between the current behavior feature vector and each record in the historical abnormal event database is calculated. The smallest dynamic time warping distance is recorded as the similarity matching degree. The similarity matching degree and the deviation degree are weighted and fused to generate a real-time anomaly confidence coefficient. The method of constructing the abnormal propagation probability map includes: In time window t, obtain a snapshot G(t) of the network request-response graph. In the subsequent time window t+1, obtain a new snapshot G(t+1) of the network request-response graph. Compare G(t) and G(t+1) to extract the changed nodes and edges, including additions, deletions, and modifications. For newly added nodes, based on their semantic vectors and the relevance threshold t3, similar nodes are searched in G(t) and directed edges are established. For modified nodes, their semantic similarity is recalculated and the association relationship is updated based on the semantic similarity, that is, directed edges are connected to other nodes, that is, hidden associations of cross-interface call links are identified. Based on the topological structure of G(t+1), an initial anomaly propagation probability graph PU is constructed. For each pair of associated request node A and response node B, the shortest path length d from A to B is calculated, and the initial propagation probability of the directed edge from A to B is set to ; Record the initial propagation probabilities of all edges in PU, and then obtain the final abnormal propagation probability graph.

9. The artificial intelligence-integrated mini-program abnormal behavior management system according to claim 8 is characterized in that: The method of dynamically correcting the weights of nodes in the abnormal propagation probability graph includes: If the node is a request node and the API corresponding to its URL has an abnormal peak in the API call frequency matrix, the real-time abnormal confidence coefficient of the API is defined as the preliminary adjustment coefficient of the corresponding node; if the node is a response node and its associated request node has a preliminary adjustment coefficient defined, the response node inherits the value of the same preliminary adjustment coefficient; otherwise, the preliminary adjustment coefficient of the response node is calculated based on the abnormality of the response status code = f(abnormality of response status code × Ct_gin), where f() is a preset linear function and Ct_gin is a preset baseline preliminary adjustment coefficient; For each node, its initial weight is defined as the normalized value of its API importance score, based on the initial weight of each node x , calculate its initial revised weight ;in, is the gain coefficient, is the preset control threshold, is the preliminary adjustment coefficient corresponding to the node; the Sigmoid function is restricted on the preliminary modified weight w'_x to obtain the corresponding node The middle weight w''_x of the directed edge is then adjusted to obtain the adjusted propagation probability. The adjustment formula is: ;in, For nodes and nodes The adjusted propagation probability of the directed edges between them; For nodes and nodes The initial propagation probability of the directed edge between nodes, w''_y is the ... The mid-segment weight, w_y is the node Initial weight; is the difference attenuation factor, For nodes The corresponding preliminary adjustment coefficient, For nodes The corresponding preliminary adjustment coefficient is obtained; based on the adjusted propagation probability of the directed edge, the mid-segment weights of the adjacent nodes are back-propagated and corrected, and the update is iterated until the change value of the mid-segment weight is less than the preset change threshold, and the update is stopped to obtain the final node correction weight.

10. The artificial intelligence-integrated mini-program abnormal behavior management system according to claim 9 is characterized in that: The calculation method of the comprehensive risk entropy value includes: Construct a three-dimensional risk space, where the three coordinate axes correspond to the deviation, the real-time anomaly confidence coefficient, and the node correction weight respectively; Calculate the Shannon entropy value of each coordinate axis, and analyze the coupling relationship between the coordinate axes through the covariance matrix to obtain the coupling coefficient; use the entropy weight method to determine the weight of each coordinate axis, recorded as the dimension weight; then calculate the comprehensive risk entropy value ;in, For the coordinate axis The dimension weight of For the coordinate axis The Shannon entropy value of is the covariance matrix The determinant value of is the coupling coefficient.

Images