Data access risk early warning method based on artificial intelligence

Abstract

The invention relates to the field of user behavior analysis and risk prediction, in particular to a data access risk early warning method based on artificial intelligence. The method comprises the following steps: collecting user access behavior data in real time, and generating an access behavior state vector; based on the access behavior state vector, constructing a joint probability density function of the access behavior; constructing a time transformation prediction model based on the joint probability density function of the access behavior to obtain a time prediction value; and performing risk assessment on the access behavior based on the time prediction value, and judging whether the access behavior is abnormal or not. The problem that a traditional data access risk early warning method usually depends on static rules and threshold values and cannot effectively deal with a complex and changeable network security environment is solved; the problems that in the prior art, a simple linear model is used for describing user access behaviors mostly, periodic effective modeling of the access behaviors is lacked, flexible adjustment cannot be carried out according to the user behaviors changing in real time, and therefore risk assessment does not have enough timeliness and dynamics are solved.

Description

Technical Field

[0001] The present invention relates to the field of user behavior analysis and risk prediction, and in particular to a data access risk early warning method based on artificial intelligence. Background Art

[0002] With the rapid development of information technology, the application scenarios of the Internet and information systems are becoming more and more extensive, especially in sensitive industries such as finance, e-commerce, medical care, and government. User access behavior data is becoming an important basis for protecting system security and user privacy. With the continuous escalation of network attack methods, traditional security protection mechanisms based on static rules and simple models can no longer meet the needs of today's complex and changing security environment. In this context, how to accurately and real-time monitor and predict user access behavior, and then identify potential security risks in advance, has become an important research topic in the current information security field.

[0003] In order to effectively deal with this challenge, risk prediction methods based on machine learning and big data analysis have gradually emerged in recent years. By deeply exploring the potential patterns in user access behaviors, potential risk behaviors can be predicted in advance, and corresponding security protection measures can be taken. However, existing risk warning methods based on behavioral analysis mostly focus on traditional rule-based models or simple statistical analysis. These methods show obvious limitations when faced with complex, high-dimensional, and diverse user behaviors.

[0004] Traditional data access risk warning methods have the following technical problems: they usually rely on static rules and thresholds, which cannot adapt to dynamically changing access behavior patterns, easily lead to false positives and false negatives, and cannot effectively cope with complex and changing network security environments; most of them use simple linear models to describe user access behavior, which cannot accurately capture the nonlinear characteristics and complex interactions in access behavior, lack effective modeling of the periodicity of access behavior, and cannot fully consider the short-term and long-term fluctuation characteristics of access behavior, which affects the accuracy and reliability of risk prediction, and fails to make flexible adjustments based on real-time changes in user behavior, resulting in risk assessment not being sufficiently timely and dynamic. Summary of the invention

[0005] The present invention provides an artificial intelligence-based data access risk warning method to solve the problem that traditional data access risk warning methods usually rely on static rules and thresholds, which cannot adapt to dynamically changing access behavior patterns, easily lead to false positives and false negatives, and cannot effectively cope with complex and changeable network security environments; most of them use simple linear models to describe user access behavior, which cannot accurately capture the nonlinear characteristics and complex interactions in access behavior, lack effective modeling of the periodicity of access behavior, and cannot fully consider the short-term and long-term fluctuation characteristics of access behavior, which affects the accuracy and reliability of risk prediction, and fails to flexibly adjust according to real-time changing user behavior, resulting in the problem that risk assessment does not have sufficient timeliness and dynamism.

[0006] The present invention provides an artificial intelligence-based data access risk early warning method, which specifically includes the following technical solutions: A data access risk early warning method based on artificial intelligence includes the following steps: S1. Collect user access behavior data in real time and generate access behavior state vectors; based on the access behavior state vectors, construct a joint probability density function of access behavior; S2. Based on the joint probability density function of the access behavior, a time transformation prediction model is constructed to obtain a time prediction value; based on the time prediction value, a risk assessment is performed on the access behavior to determine whether the access behavior is abnormal.

[0007] Preferably, the S1 specifically includes: The user access behavior data is feature extracted and normalized to obtain the access behavior feature vector; based on the access behavior feature vector, a multi-dimensional nonlinear transformation is introduced to generate the access behavior state vector.

[0008] Preferably, the S1 specifically includes: The specific formula of the multi-dimensional nonlinear transformation is defined as follows: , , , in, It's time The access behavior state vector at ; is a nonlinear transformation function; It's in time The next The visit behavior characteristics of the dimensions; Represents dimension; It is Nonlinear transformation function in dimensions; It is for A function that transforms the interaction of the access behavior characteristics of the dimensions; It is Dynamic weights of access behavior characteristics in different dimensions; It is The linear weight coefficient of the access behavior characteristics of the dimensions; It is Moderators of the interaction between the characteristics of the dimensions; is the exponent in the polynomial transformation; As the exponential decay parameter of the dimension; It is to adjust Factors that influence the degree of visit behavior characteristics in each dimension; It is The scaling parameter of the interaction term for the dimensions; is the power of the interaction feature.

[0009] Preferably, the S1 specifically includes: Based on the access behavior state vector, combined with the exponential decay term and the triangular disturbance term, and introducing the normalization factor, the joint probability density function of the access behavior is constructed.

[0010] Preferably, the S2 specifically includes: The access time series data in the user access behavior data is mapped to the variable-scale spatiotemporal domain, and combined with the joint probability density function of the access behavior, a dynamic time transformation function is defined to construct a time transformation prediction model.

[0011] Preferably, the S2 specifically includes: The dynamic time transformation function introduces trigonometric functions of different frequencies to obtain the time characteristics after time transformation.

[0012] Preferably, the S2 specifically includes: Based on the time characteristics after time transformation, the time scaling factor and adjustment factor are introduced to calculate the time prediction value.

[0013] Preferably, the S2 specifically includes: Based on the time prediction value, risk assessment is performed through Bayesian reasoning to determine whether the access behavior is abnormal.

[0014] The beneficial effects of the technical solution of the present invention are: 1. The present invention avoids misjudgment of abnormal detection due to data missing or delayed by collecting and storing user access behavior data in real time and in a structured manner; it fully captures the complexity of user access behavior data through feature extraction and nonlinear transformation, and especially by introducing interactive feature items, the interaction between different access features can be accurately described, laying a solid foundation for subsequent risk assessment.

[0015] 2. The present invention adopts a dynamic time transformation function, and combines it with the joint probability density function of access behavior to accurately model the time characteristics of user access behavior; by considering the combined characteristics of short cycles and long cycles, the time transformation prediction model can dynamically adjust and adapt to the different access patterns of users, thereby improving the prediction accuracy of access time, thereby providing more accurate timing input for risk assessment.

[0016] 3. Utilizing a dynamic risk probability calculation method based on recursive Bayesian reasoning, the present invention can evaluate the risk level of user behavior in real time and dynamically; unlike the traditional static threshold judgment method, the present invention continuously updates the risk status at the current moment based on historical behavior data and predictions of future access times, which can effectively reduce the false alarm rate and improve the accuracy of risk prediction.

[0017] 4. The present invention calculates the abnormal score of access behavior and the final access risk value by comprehensively considering the characteristic deviation degree of user access behavior data, the mean change of historical access behavior data and the risk assessment probability, accurately assesses the abnormal degree of user access behavior, and avoids the false positive or false negative problem caused by fixed detection standards in traditional methods; the calculated final access risk value is between 0 and 1, which can intuitively and accurately reflect the risk status of user access behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flow chart of an artificial intelligence-based data access risk warning method described in the present invention. DETAILED DESCRIPTION

[0019] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0021] The following is a detailed description of a specific scheme of a data access risk warning method based on artificial intelligence provided by the present invention in conjunction with the accompanying drawings.

[0022] Refer to the attached Figure 1 , which shows a flow chart of a data access risk warning method based on artificial intelligence provided by an embodiment of the present invention, the method comprising the following steps: S1. Collect user access behavior data in real time and generate access behavior state vectors; based on the access behavior state vectors, construct a joint probability density function of access behavior; Collect user access behavior data in real time, including user access time series, access operation content, access path, access device fingerprint and other data, and perform structured storage on all user access behavior data to ensure the integrity of the access behavior data's temporal relationship, feature dependency and access pattern, and avoid misjudgment of anomaly detection due to data missing or delay.

[0023] Access time series data is used to build a time transformation prediction model; access operation content is used for feature nesting transformation to ensure that access behavior can be accurately modeled in high-dimensional space; access path data can be used to assist in calculating the joint probability density of access behavior to ensure that the correlation between different features can be accurately described; access device fingerprint information is used to calculate the dynamic weight of access behavior to ensure differentiated processing based on different access devices in different environments.

[0024] Extract features from user access behavior data and normalize them to obtain access behavior feature vectors and construct access behavior state vectors; set the time The access behavior feature vector at ,in Represents dimensions, and the features of each dimension represent an attribute of the user's access behavior data, such as the type of IP address accessed, the sensitivity level of the accessed resource, the category of the access time period, the unique identifier of the access device, etc. Since the characteristics of access behavior are not linearly distributed, they cannot be directly modeled using uniform distribution or Gaussian distribution. Instead, multi-dimensional nonlinear transformations need to be introduced so that the access behavior feature vector can be reasonably mapped in a more complex space, so as to accurately describe the changing trend of user access behavior in the future. The specific formula for multi-dimensional nonlinear transformation is defined as follows: , , , , in, It's time The access behavior state vector at ; is a nonlinear transformation function; It's in time The next Access behavior characteristics in three dimensions, such as the type of IP address accessed, the sensitivity level of the accessed resources, the type of access time period, the unique identifier of the access device, etc. It is Nonlinear transformation function in dimensions; It is for A function that transforms the interaction of access behavior features in multiple dimensions. A single feature (such as the type of IP address accessed, the category of access time period, the unique identifier of the access device, etc.) may not be able to fully describe the complexity of access behavior. Different access behavior features often have non-independent mutual influences. For example, a user using a specific IP to access a certain type of resource in a specific time period may be a normal behavior, but the same IP accessing the same resource during non-working hours may be an abnormal behavior. Therefore, the interactive feature term is introduced to show the mutual influence between access behavior features. is the interaction feature term; It is Dynamic weights of access behavior characteristics in different dimensions; It is The linear weight coefficient of the access behavior characteristics of each dimension represents the linear contribution of the access behavior characteristics to risk assessment, which is obtained through experiments; It is The adjustment factor of the feature interaction part of the dimension, indicating the The influence of the access behavior characteristics of each dimension when interacting with other characteristics is obtained through experiments; is the exponent in the polynomial transformation, used to control the influence of the characteristic power, obtained through experiments; As the The exponential decay parameter of the dimension determines the decay rate in the feature transformation and is obtained through experiments; It is to adjust The factors that influence the degree of visit behavior characteristics in each dimension are obtained through experiments; It is The scaling parameters of the interaction terms in the dimensions are used to adjust the nonlinear effects of the interaction results and are obtained through experiments; is the power of the interaction feature, which is used to enhance the impact of the interaction term and is obtained through experiments; It is The learnable parameters of the dimensions enable the dynamic weights of the access behavior features to be dynamically adjusted according to the changes in the access behavior, which is obtained through experiments.

[0025] Based on the access behavior state vector, a joint probability density model is constructed to describe the distribution characteristics of the access behavior, so that the abnormality of the access behavior can be evaluated later; in order to more accurately characterize the joint distribution of access behavior in different feature dimensions, a joint probability density model combining exponential decay terms and triangular perturbation terms is adopted to ensure that the stability of the overall data distribution is maintained and the nonlinear fluctuation characteristics in the access pattern can be captured; the joint probability density function needs to meet the normalization condition, that is, the integral in the entire feature space is equal to 1, so a normalization factor must be introduced to ensure rationality. The definition formula of the constructed joint probability density function is as follows: , in, is the joint probability density function of the access behavior; is the normalization factor, which makes the joint probability density function satisfy the integral normalization; Represents the contribution of the access behavior state vector to the joint probability density, and the value is determined by the maximum likelihood estimation method; is the probability density perturbation parameter, which is used to control the asymmetry of the probability distribution and is obtained through experiments.

[0026] S2. Based on the joint probability density function of the access behavior, a time transformation prediction model is constructed to obtain a time prediction value; based on the time prediction value, a risk assessment is performed on the access behavior to determine whether the access behavior is abnormal.

[0027] In order to make the prediction of access behavior more accurate, the future access behavior is modeled through the dynamic time transformation function, and the time transformation prediction model is constructed. The access time series data in the user access behavior data is mapped to the variable-scale spatiotemporal domain, and weighted in combination with the joint probability density function of the access behavior to improve the accuracy of time prediction; access behavior has the combined characteristics of short cycles and long cycles, that is, some access behaviors will occur frequently in a short period of time, while some access behaviors will have long intervals; therefore, in the process of time transformation, trigonometric functions of different frequencies are needed to model periodic characteristics, and normalization operations are combined to ensure the rationality of time prediction values. The dynamic time transformation function is defined as follows: , in, Indicates the time after transformation time characteristics; Is an activation function, used for nonlinear transformation, in the form of Sigmoid function, ; is the number of sinusoidal terms, set according to expert experience, indicating that the time-transformed forecasting model takes into account the time series Sine waves of different frequencies; is the weight coefficient of the sine function, indicating the The contribution of the sine terms to the final transformation result is obtained through experiments; It is in Access time series data in time steps; It is with The frequency coefficient related to the sine function determines the frequency of the sine term, that is, the fluctuation rate of the access behavior in time, which is obtained through experiments; is the number of cosine terms, set according to expert experience, indicating that the time-transformed forecasting model takes into account the time series cosine waves of different frequencies; is the weight coefficient of the cosine function, indicating the The contribution of the cosine terms to the final transformation result is obtained through experiments; It is with The frequency coefficients related to the cosine function are used to control the period and amplitude of the cosine function, which reflects the periodicity in the access behavior time series and is obtained through experiments. The core of the dynamic time transformation function is to use trigonometric functions to describe the periodicity of the time series and combine it with the joint probability density function of the access behavior for weighting, so that the time transformation prediction model can adapt to different access patterns.

[0028] Based on the time features after time transformation, calculate the time prediction value for the next time step: , in, It is The time prediction value of time steps; is the time scaling factor, which is used to control the adjustment range of the time prediction value and is obtained through experiments; is the number of adjustment factors, i.e., the number of adjustment factors, which is set according to the expert experience method; It is The weight of the adjustment factor, The contribution of each adjustment factor to the time feature prediction adjustment is obtained through experiments; It is The angular frequency of the adjustment factor is obtained through experiments.

[0029] Based on the time prediction value, the access behavior is risk assessed to determine whether the access behavior is abnormal; in the embodiment of the present application, the risk assessment can be performed by combining existing technologies such as time series prediction, Bayesian reasoning, classification model and anomaly detection, or by the following methods: A dynamic risk probability calculation method based on recursive Bayesian reasoning is constructed to conduct risk assessment on access behaviors; the time prediction value is used as input to reflect the time distribution of the access behaviors that may occur to the current user at a certain time in the future, and the risk status of the access behavior at the previous moment is combined to infer the risk probability at the current moment, so that the risk assessment can be adjusted dynamically with the evolution of time, rather than relying on static thresholds to judge the risk status. Based on the above considerations, the calculation formula of recursive Bayesian reasoning is as follows: , in, Indicates the characteristic data of the given historical access behavior Under the condition of Risk status probability; It is in All historical access behavior data or features before the time step, that is, from the 1st time step to the All historical access behavior feature data of time steps; Given the current risk status After that, the probability of the access behavior at the next time step is predicted; Given historical access behavior feature data Under the condition of Risk status at Based on recursive Bayesian reasoning, the time prediction value is used as input to evaluate the abnormal probability of the current behavior.

[0030] In order to ensure that the risk assessment of data access behavior can accurately measure the degree of abnormality, the abnormal score of access behavior is calculated by comprehensively considering the degree of characteristic deviation of user access behavior data, the mean change of historical access behavior data, and the impact of risk assessment probability, so as to solve the false alarm problem caused by the fixed abnormal behavior detection standard in traditional methods. The calculation formula of the abnormal score of access behavior is: , in, It's in time Abnormality score of access behavior; It's time The access behavior state vector at ; is the mean of historical access behavior data; is the standard deviation of historical access behavior data. Based on the abnormal score of access behavior, the final access risk value is calculated. The specific formula is as follows: , in, is the final access risk value; It is an adjustable parameter used to control the risk growth rate and is obtained through experiments; It is a set risk threshold used to determine whether the user's access behavior is abnormal. It is set based on expert experience. The final access risk value It is between [0,1], close to 0 indicates low risk, and close to 1 indicates high risk.

[0031] In summary, an artificial intelligence-based data access risk early warning method was completed.

[0032] The order of the embodiments of the invention is for description only and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0033] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0034] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A data access risk early warning method based on artificial intelligence, characterized in that: The following steps are involved: S1. Collect user access behavior data in real time and generate access behavior state vectors; based on the access behavior state vectors, construct a joint probability density function of access behavior; S2. Based on the joint probability density function of the access behavior, a time transformation prediction model is constructed to obtain a time prediction value; based on the time prediction value, a risk assessment is performed on the access behavior to determine whether the access behavior is abnormal.

2. According to the artificial intelligence-based data access risk early warning method of claim 1, it is characterized in that: The S1 specifically includes: The user access behavior data is feature extracted and normalized to obtain the access behavior feature vector; based on the access behavior feature vector, a multi-dimensional nonlinear transformation is introduced to generate the access behavior state vector.

3. The data access risk early warning method based on artificial intelligence according to claim 2 is characterized in that: The S1 specifically includes: The specific formula of the multi-dimensional nonlinear transformation is defined as follows: ， ， ， in, It's time The access behavior state vector at ; is a nonlinear transformation function; It's in time The next The visit behavior characteristics of the dimensions; Represents dimension; It is Nonlinear transformation function in dimensions; It is for A function that transforms the interaction of the access behavior characteristics of the dimensions; It is Dynamic weights of access behavior characteristics in different dimensions; It is The linear weight coefficient of the access behavior characteristics of the dimensions; It is Moderators of the interaction between the features of the dimensions; is the exponent in the polynomial transformation; As the exponential decay parameter of the dimension; It is to adjust Factors that influence the degree of visit behavior characteristics in each dimension; It is The scaling parameter of the interaction term for the dimensions; is the power of the interaction feature.

4. The data access risk early warning method based on artificial intelligence according to claim 3 is characterized in that: The S1 specifically includes: Based on the access behavior state vector, combined with the exponential decay term and the triangular disturbance term, and introducing the normalization factor, the joint probability density function of the access behavior is constructed.

5. The data access risk early warning method based on artificial intelligence according to claim 1 is characterized in that: The S2 specifically includes: The access time series data in the user access behavior data is mapped to the variable-scale spatiotemporal domain, and combined with the joint probability density function of the access behavior, a dynamic time transformation function is defined to construct a time transformation prediction model.

6. The data access risk early warning method based on artificial intelligence according to claim 5 is characterized in that: The S2 specifically includes: The dynamic time transformation function introduces trigonometric functions of different frequencies to obtain the time characteristics after time transformation.

7. The data access risk early warning method based on artificial intelligence according to claim 6 is characterized in that: The S2 specifically includes: Based on the time characteristics after time transformation, the time scaling factor and adjustment factor are introduced to calculate the time prediction value.

8. The data access risk early warning method based on artificial intelligence according to claim 7 is characterized in that: The S2 specifically includes: Based on the time prediction value, risk assessment is performed through Bayesian reasoning to determine whether the access behavior is abnormal.

Images