An artificial intelligence-based method for early warning of data access risks

Abstract

The present invention relates to the field of user behavior analysis and risk prediction, and particularly to a data access risk early warning method based on artificial intelligence. The content includes: collecting user access behavior data in real time and generating an access behavior state vector; constructing a joint probability density function of the access behavior based on the access behavior state vector; constructing a time transformation prediction model based on the joint probability density function of the access behavior to obtain a time prediction value; and performing risk assessment on the access behavior based on the time prediction value to determine whether the access behavior is abnormal. It solves the problems that traditional data access risk early warning methods usually rely on static rules and thresholds and cannot effectively cope with the complex and changeable network security environment; most use simple linear models to describe user access behavior, lack effective modeling of the periodicity of access behavior, and fail to make flexible adjustments according to the real-time changing user behavior, resulting in insufficient timeliness and dynamics of risk assessment.

Description

Technical Field

[0001] The present invention relates to the field of user behavior analysis and risk prediction, and particularly to a data access risk early warning method based on artificial intelligence. Background Art

[0002] With the rapid development of information technology, the application scenarios of the Internet and information systems are becoming more and more extensive. Especially in sensitive industries such as finance, e-commerce, healthcare, and government, the access behavior data of users has increasingly become an important basis for protecting system security and user privacy. With the continuous upgrading of network attack methods, the traditional security protection mechanisms based on static rules and simple patterns can no longer meet the current complex and changeable security environment. In this context, how to accurately and real-time monitor and predict the access behavior of users, and then identify potential security risks in advance, has become an important research topic in the current information security field.

[0003] To effectively address this challenge, in recent years, risk prediction methods based on machine learning and big data analysis have gradually emerged. By deeply mining the potential rules in user access behavior, potential risk behaviors can be predicted in advance, and then corresponding security protection measures can be taken. However, most of the existing risk early warning methods based on behavior analysis focus on traditional rule-based models or simple statistical analysis. These methods show obvious limitations when facing complex, high-dimensional, and diverse user behaviors.

[0004] The traditional data access risk early warning methods have the following technical problems: They usually rely on static rules and thresholds, which cannot adapt to the dynamically changing access behavior patterns, easily lead to false alarms and missed alarms, and cannot effectively cope with the complex and changeable network security environment; Most of them use simple linear models to describe user access behavior, unable to accurately capture the non-linear features and complex interactions in access behavior, lacking effective modeling of the periodicity of access behavior, unable to fully consider the short-term and long-term fluctuation characteristics of access behavior, affecting the accuracy and reliability of risk prediction, and failing to make flexible adjustments according to the real-time changing user behavior, resulting in insufficient timeliness and dynamics of risk assessment. Summary of the Invention

[0005] The present invention provides a method for warning of data access risks based on artificial intelligence, aiming to solve the problems that traditional methods for warning of data access risks usually rely on static rules and thresholds, which cannot adapt to dynamically changing access behavior patterns, are prone to false alarms and missed alarms, and cannot effectively cope with complex and changeable network security environments; most use simple linear models to describe user access behaviors, cannot accurately capture the non-linear characteristics and complex interaction effects in access behaviors, lack effective modeling of the periodicity of access behaviors, cannot fully consider the short-term and long-term fluctuation characteristics of access behaviors, affect the accuracy and reliability of risk prediction, and fail to make flexible adjustments according to real-time changing user behaviors, resulting in insufficient timeliness and dynamics of risk assessment.

[0006] A method for warning of data access risks based on artificial intelligence according to the present invention specifically includes the following technical solutions:

[0007] A method for warning of data access risks based on artificial intelligence includes the following steps:

[0008] S1. Collect user access behavior data in real time and generate an access behavior state vector; based on the access behavior state vector, construct a joint probability density function of the access behavior;

[0009] S2. Based on the joint probability density function of the access behavior, construct a time transformation prediction model to obtain a time prediction value; based on the time prediction value, conduct a risk assessment of the access behavior to determine whether the access behavior is abnormal.

[0010] Preferably, the S1 specifically includes:

[0011] Extract features from the user access behavior data and perform normalization processing to obtain an access behavior feature vector; based on the access behavior feature vector, introduce a multi-dimensional non-linear transformation to generate an access behavior state vector.

[0012] Preferably, the S1 specifically includes:

[0013] The specific formula definition of the multi-dimensional non-linear transformation is as follows:

[0014] ,

[0015] ,

[0016] ,

[0017] where, is the access behavior state vector at time ; is a non-linear transformation function; is at time The access behavior characteristics in the th dimension; Indicates the dimension; Is the nonlinear transformation function in the th dimension; Is a function that transforms the interaction of the access behavior characteristics in the th dimension; Is the dynamic weight of the access behavior characteristics in the th dimension; Is the linear weight coefficient of the access behavior characteristics in the th dimension; Is the regulatory factor of the feature interaction part in the th dimension; Is the exponent in the polynomial transformation; As the exponential decay parameter in the th dimension; Is a factor that regulates the influence degree of the access behavior characteristics in the th dimension; Is the scaling parameter of the interaction term in the th dimension; Is the power of the interaction feature.

[0018] Preferably, the S1 specifically includes:

[0019] Based on the access behavior state vector, combining the exponential decay term and the triangular perturbation term, and introducing a normalization factor, construct the joint probability density function of the access behavior.

[0020] Preferably, the S2 specifically includes:

[0021] Map the access time series data in the user access behavior data to the variable-scale spatio-temporal domain, and combine the joint probability density function of the access behavior to define the dynamic time transformation function and construct the time transformation prediction model.

[0022] Preferably, the S2 specifically includes:

[0023] For the dynamic time transformation function, introduce trigonometric functions of different frequencies to obtain the time characteristics after time transformation.

[0024] Preferably, the S2 specifically includes:

[0025] Based on the time characteristics after time transformation, introduce the time scaling factor and the adjustment factor, and calculate to obtain the time prediction value.

[0026] Preferably, the S2 specifically includes:

[0027] Based on the time prediction value, risk assessment is carried out through Bayesian inference, and whether the access behavior is abnormal is judged.

[0028] The beneficial effects of the technical solution of the present invention are as follows:

[0029] 1. By collecting and structurally storing user access behavior data in real time, the present invention avoids misjudgment of anomaly detection caused by data loss or delay; through feature extraction and non-linear transformation, the complexity of user access behavior data is fully captured, especially by introducing interactive feature items, so that the interaction between different access features can be accurately described, laying a solid foundation for subsequent risk assessment.

[0030] 2. The present invention adopts a dynamic time transformation function and combines it with the joint probability density function of access behavior, which can accurately model the time characteristics of user access behavior; by considering the combined characteristics of short cycles and long cycles, the time transformation prediction model can dynamically adjust and adapt to different access patterns of users, improving the prediction accuracy of access time, thereby providing a more accurate time series input for risk assessment.

[0031] 3. Using a dynamic risk probability calculation method based on recursive Bayesian inference, the present invention can evaluate the risk level of user behavior in real time and dynamically; different from the traditional static threshold judgment method, the present invention continuously updates the risk state at the current moment according to historical behavior data and the prediction of future access time, which can effectively reduce the false alarm rate and improve the accuracy of risk prediction.

[0032] 4. By comprehensively considering the feature deviation degree of user access behavior data, the mean change of historical access behavior data, and the risk assessment probability, the present invention calculates the anomaly score of access behavior and the final access risk value, accurately evaluates the anomaly degree of user access behavior, and avoids false alarms or missed alarms caused by fixed detection criteria in traditional methods; the calculated final access risk value is between 0 and 1, which can intuitively and accurately reflect the risk state of user access behavior. Description of the Drawings

[0033] Figure 1 It is a flowchart of a data access risk early warning method based on artificial intelligence according to the present invention. Detailed Embodiments

[0034] To further elaborate on the technical means and effects adopted by the present invention to achieve the intended invention purpose, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present invention belongs.

[0036] The following specifically describes the specific solution of a data access risk warning method based on artificial intelligence provided by the present invention with reference to the accompanying drawings.

[0037] Refer to the attached Figure 1 , which shows a flowchart of a data access risk warning method based on artificial intelligence provided by an embodiment of the present invention. The method includes the following steps:

[0038] S1. Collect user access behavior data in real time and generate an access behavior state vector; based on the access behavior state vector, construct a joint probability density function of the access behavior;

[0039] Collect user access behavior data in real time, including data such as the user's access time series, access operation content, access path, and access device fingerprint. Structurally store all user access behavior data to ensure the integrity of the time sequence relationship, feature dependence relationship, and access pattern of the access behavior data, and avoid misjudgment of anomaly detection due to data loss or delay.

[0040] The access time series data is used to construct a time transformation prediction model; the access operation content is used for feature nested transformation to ensure that the access behavior can be accurately modeled in a high-dimensional space; the access path data can be used to assist in calculating the joint probability density of the access behavior to ensure that the correlation between different features can be accurately described; the access device fingerprint information is used to calculate the dynamic weight of the access behavior to ensure differential processing according to different access devices in different environments.

[0041] Extract features from the user access behavior data and perform normalization processing to obtain an access behavior feature vector, and construct an access behavior state vector; set the access behavior feature vector at time , where Denote dimensions. The features of each dimension represent an attribute of user access behavior data, such as the type of access IP address, the sensitivity level of the accessed resource, the category of the access time period, the unique identifier of the access device, etc. Since the features of access behavior are not linearly distributed, it is not possible to directly use a uniform distribution or a Gaussian distribution for modeling. Instead, a multi-dimensional non-linear transformation needs to be introduced so that the access behavior feature vector can be reasonably mapped in a more complex space to accurately describe the changing trend of user access behavior subsequently. The specific formula for the multi-dimensional non-linear transformation is defined as follows:

[0042] ,

[0043] ,

[0044] ,

[0045] ,

[0046] where, is the access behavior state vector at time ; is the non-linear transformation function; is the access behavior feature of the th dimension at time , such as the type of access IP address, the sensitivity level of the accessed resource, the category of the access time period, the unique identifier of the access device, etc.; is the non-linear transformation function on the th dimension; is a function that transforms the interaction of the access behavior features of the th dimension. A single feature (such as the type of access IP address, the category of the access time period, the unique identifier of the access device, etc.) may not be sufficient to describe the complexity of access behavior. There are often non-independent mutual influences between different access behavior features. For example, a user accessing a certain type of resource using a specific IP at a specific time period may be normal behavior, but the same IP accessing the same resource during non-working hours may be abnormal behavior. Therefore, interaction feature terms are introduced to explicitly represent the mutual influences between access behavior features; is the interaction feature term; is the dynamic weight of the access behavior feature of the th dimension; is the linear weight coefficient of the access behavior feature of the th dimension, representing the linear contribution of the access behavior feature to risk assessment, obtained through experiments; is the adjustment factor of the feature interaction part of the th dimension, representing the The influence degree of the access behavior characteristics in a dimension when interacting with other characteristics is obtained through experiments; It is the exponent in the polynomial transformation, used to control the influence of the feature power, and is obtained through experiments; As the exponential decay parameter of the dimension, which determines the decay rate in the feature transformation, and is obtained through experiments; It is a factor that adjusts the influence degree of the access behavior characteristics in the dimension, and is obtained through experiments; It is the scaling parameter of the interaction term in the dimension, used to adjust the non - linear influence of the interaction result, and is obtained through experiments; It is the power of the interaction feature, used to enhance the influence of the interaction term, and is obtained through experiments; It is the learnable parameter of the dimension, enabling the dynamic weight of the access behavior characteristics to be adjusted dynamically according to the changes in the access behavior, and is obtained through experiments.

[0047] Based on the access behavior state vector, a joint probability density model is constructed to describe the distribution characteristics of the access behavior, so as to be able to evaluate the abnormality degree of the access behavior subsequently; in order to more accurately depict the joint distribution of the access behavior in different feature dimensions, a joint probability density model combining an exponential decay term and a triangular perturbation term is adopted to ensure both maintaining the stability of the overall data distribution and being able to capture the non - linear fluctuation characteristics in the access pattern; the joint probability density function needs to satisfy the normalization condition, that is, the integral over the entire feature space is equal to 1, so a normalization factor must be introduced to ensure rationality. The definition formula of the constructed joint probability density function is as follows:

[0048] ,

[0049] where, is the joint probability density function of the access behavior; is the normalization factor, making the joint probability density function satisfy integral normalization; represents the contribution of the access behavior state vector to the joint probability density, and the value size is determined by the maximum likelihood estimation method; is the probability density perturbation parameter, used to control the asymmetry of the probability distribution, and is obtained through experiments.

[0050] S2. Based on the joint probability density function of the access behavior, a time transformation prediction model is constructed to obtain the time prediction value; based on the time prediction value, a risk assessment of the access behavior is carried out to judge whether the access behavior is abnormal.

[0051] To make the prediction of access behavior more accurate, the future access behavior is modeled through a dynamic time transformation function to construct a time transformation prediction model. The access time series data in the user access behavior data is mapped to a variable-scale spatio-temporal domain, and weighted by combining the joint probability density function of the access behavior to improve the accuracy of time prediction. Access behavior has a combined characteristic of short cycles and long cycles, that is, some access behaviors occur frequently in a short time, while some access behaviors have long intervals. Therefore, in the time transformation process, trigonometric functions with different frequencies are needed to model the periodic characteristics, and combined with normalization operations to ensure the rationality of the time prediction values. The dynamic time transformation function is defined as follows:

[0052] ,

[0053] where, represents the th time feature after time transformation; is the activation function for non-linear transformation, in the form of the Sigmoid function, ; is the number of sine terms, set according to the expert experience method, indicating that the time transformation prediction model considers different frequencies of sine waves in the time series; is the weight coefficient of the sine function, representing the contribution degree of the rd sine term to the final transformation result, obtained through experiments; is the access time series data at the th time step; is the frequency coefficient related to the rd sine function, which determines the frequency of the sine term, that is, the fluctuation rate of the access behavior in time, obtained through experiments; is the number of cosine terms, set according to the expert experience method, indicating that the time transformation prediction model considers different frequencies of cosine waves in the time series; is the weight coefficient of the cosine function, representing the contribution degree of the th cosine term to the final transformation result, obtained through experiments; is the frequency coefficient related to the th cosine function, used to control the period and amplitude of the cosine function, reflecting the periodicity in the access behavior time series, obtained through experiments. The core of the dynamic time transformation function lies in using trigonometric functions to describe the periodicity of the time series and weighted by combining the joint probability density function of the access behavior, so that the time transformation prediction model can adapt to different access patterns.

[0054] Based on the time features after time transformation, calculate the time prediction value for the next time step:

[0055] ,

[0056] wherein, is the time prediction value at the th time step; is the time scaling factor, which is used to control the adjustment range of the time prediction value and is obtained through experiments; is the number of adjustment factors, that is, the number of adjustment factors, which is set according to the expert experience method; is the weight of the th adjustment factor, indicating the contribution degree of the th adjustment factor to the adjustment of time feature prediction, and is obtained through experiments; is the angular frequency of the th adjustment factor, which is obtained through experiments.

[0057] Based on the time prediction value, risk assessment is performed on the access behavior to determine whether there is an abnormality in the access behavior; in the embodiments of the present application, the risk assessment can be carried out by combining existing technologies such as time series prediction, Bayesian inference, classification models, and anomaly detection, or can be carried out in the following manner:

[0058] Construct a dynamic risk probability calculation method based on recursive Bayesian inference to perform risk assessment on the access behavior; use the time prediction value as the input, which reflects the time distribution of the access behavior that the current user may have at a future time, and combine the risk status of the access behavior at the previous moment to infer the risk probability at the current moment, so that the risk assessment can be dynamically adjusted as time evolves, rather than relying on static thresholds to judge the risk status. Based on the above considerations, the calculation formula of recursive Bayesian inference is as follows:

[0059] ,

[0060] wherein, represents the probability of calculating the risk status at the current moment under the condition of given historical access behavior feature data ; is all historical access behavior data or features before the th time step, that is, all historical access behavior feature data from the 1st time step to the th time step; is the probability of the access behavior at the next time step predicted after the given current risk status ; is the risk status when calculating the previous moment under the condition of given historical access behavior feature data ​ The conditional probability. Based on recursive Bayesian inference, the time prediction value is used as the input to evaluate the anomaly probability of the current behavior.

[0061] To ensure that the risk assessment of data access behavior can accurately measure the degree of anomaly, comprehensively consider the deviation degree of the characteristics of user access behavior data, the mean change of historical access behavior data, and the influence of the risk assessment probability, calculate the anomaly score of the access behavior, and solve the false alarm problem caused by the fixed anomaly behavior detection standard in the traditional method. The calculation formula of the anomaly score of the access behavior is:

[0062] ,

[0063] where, is the anomaly score of the access behavior at time ; is the access behavior state vector at time ; is the mean of the historical access behavior data; is the standard deviation of the historical access behavior data. Based on the anomaly score of the access behavior, calculate the final access risk value, and the specific formula is as follows:

[0064] ,

[0065] where, is the final access risk value; is an adjustable parameter used to control the risk growth rate and is obtained through experiments; is the set risk threshold used to determine whether the user access behavior is abnormal and is set according to the expert experience method. The final access risk value is between [0, 1]. Being close to 0 indicates low risk, and being close to 1 indicates high risk.

[0066] In summary, a data access risk warning method based on artificial intelligence is completed.

[0067] The sequence of the invention embodiments is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0068] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments.

[0069] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A data access risk early warning method based on artificial intelligence, characterized in that: The following steps are involved: S1. Collect user access behavior data in real time, extract features from the user access behavior data, and perform normalization processing to obtain an access behavior feature vector; based on the access behavior feature vector, introduce a multi-dimensional nonlinear transformation to generate an access behavior state vector; the specific formula of the multi-dimensional nonlinear transformation is: ， ， ， in, It's time The access behavior state vector at ; is a nonlinear transformation function; It's in time The next The visit behavior characteristics of the dimensions; Represents dimension; It is Nonlinear transformation function in dimensions; It is for A function that transforms the interaction of the access behavior characteristics of the dimensions; It is Dynamic weights of access behavior characteristics in different dimensions; It is The linear weight coefficient of the access behavior characteristics of the dimensions; It is Moderators of the interaction between the characteristics of the dimensions; is the exponent in the polynomial transformation; As the exponential decay parameter of the dimension; It is to adjust Factors that influence the degree of visit behavior characteristics in each dimension; It is Scaling parameters for the interaction terms in the dimensions; is the power of the interaction feature; Based on the access behavior state vector, a joint probability density function of the access behavior is constructed; S2. Introduce trigonometric functions of different frequencies and combine them with the joint probability density function of access behavior to define a dynamic time transformation function, build a time transformation prediction model, map the access time series data in the user access behavior data to the variable-scale spatiotemporal domain, and obtain the time characteristics after time transformation; Based on the time characteristics after time transformation, the time scaling factor and adjustment factor are introduced to obtain the time prediction value; based on the time prediction value, the access behavior is evaluated for risk through Bayesian reasoning to determine whether the access behavior is abnormal.

2. According to the artificial intelligence-based data access risk early warning method of claim 1, it is characterized in that: The S1 specifically includes: Based on the access behavior state vector, combined with the exponential decay term and the triangular disturbance term, and introducing the normalization factor, the joint probability density function of the access behavior is constructed.

3. According to the artificial intelligence-based data access risk early warning method of claim 1, it is characterized in that: The S2 specifically includes: The specific formula of the dynamic time transformation function is as follows: ， in, Indicates the time after transformation time characteristics; is the activation function; is the number of sinusoidal terms; It is The weight coefficients of the sine functions; It is in Access time series data in time steps; It is with The frequency coefficients associated with the sine functions; is the number of cosine terms; It is The weight coefficients of the cosine function; It is with The frequency coefficients associated with the cosine function; is the joint probability density function of the access behavior.

4. The data access risk early warning method based on artificial intelligence according to claim 3 is characterized in that: The S2 specifically includes: The specific calculation formula of the time prediction value is: ， in, It is The time prediction value of time steps; is the time scaling factor; is the number of adjustment factors; It is The weight of the adjustment factor; It is The angular frequency of the adjustment factor.

Images