Method for detecting abnormal behavior and storage medium

Abstract

The invention discloses a method for detecting abnormal behaviors and a storage medium, and relates to the technical field of network security, and the method comprises the steps: extracting behavior feature information of a to-be-detected user from behavior data of the to-be-detected user, and carrying out the serialization processing of the behavior feature information according to time, and obtaining a feature sequence; and based on the feature sequence, using a pre-trained recurrent neural network to identify whether the behavior of the to-be-detected user is abnormal. The expression ability of the feature sequence to the user behavior can be improved, and the feature information of the user behavior is associated with the time information through the feature sequence, so that the recurrent neural network can extract the feature information and the time information of the user behavior from the feature sequence, and whether the behavior of the to-be-detected user is abnormal or not is recognized accordingly; and the detection precision of the abnormal behavior can be improved.

Description

Technical Field

[0001] This article relates to the field of network security technology, and in particular to a method and storage medium for detecting abnormal behavior. Background Art

[0002] Research has found that data breaches caused by insiders are the most costly, so internal risk management and internal threat defense have become important components of cybersecurity plans. Internal threats refer to damage caused to an organization by insiders who have legal access to the organization's network, usually involving deliberate fraud, theft of confidential or commercially valuable information, deliberate destruction of computer systems, etc. Compared with external attacks, internal threats are not easily detected, making them more difficult to detect.

[0003] At present, most internal threat detection methods determine whether the user's behavior is abnormal by analyzing the user's behavior data, and then determine whether the user is an internal threat. In related technologies, abnormal user behavior detection can usually be achieved in the following two ways: the first is to detect and classify through machine learning methods. This method requires preprocessing of user behavior data through feature engineering. Due to the high dimensionality, complexity, non-uniformity and sparsity of the data, the feature extraction in the preprocessing stage is difficult, which in turn affects the detection accuracy of abnormal behavior; the second is to extract features from the user's behavior data with the help of a deep learning model and perform detection. However, the detection accuracy of this method is greatly affected by the quality of the behavior data. For example, when the training data is unbalanced or the input behavior data reflects the user's behavior with low accuracy, it will lead to low detection accuracy. Therefore, how to improve the detection accuracy of abnormal user behavior is an issue worthy of attention. Summary of the invention

[0004] Embodiments of the present disclosure provide a method and a storage medium for detecting abnormal behavior.

[0005] In a first aspect, an embodiment of the present disclosure provides a method for detecting abnormal behavior, the method comprising: extracting behavior feature information of a user to be detected from the behavior data of the user to be detected, and serializing the behavior feature information according to time to obtain a feature sequence; based on the feature sequence, using a pre-trained recurrent neural network to identify whether the behavior of the user to be detected is abnormal.

[0006] In a second aspect, an embodiment of the present disclosure provides a non-transitory computer storage medium, wherein the computer storage medium stores a computer program, and when the computer program is executed by a processor, the method for detecting abnormal behavior in the above embodiment is implemented.

[0007] The method for detecting abnormal behavior in the embodiment of the present disclosure extracts the behavior feature information of the user to be detected from the behavior data of the user to be detected, and serializes the behavior feature information according to time, which can not only improve the ability of the feature sequence to express the user behavior, but also associate the feature information of the user behavior with the time information through the feature sequence. The feature sequence is used as input data of the recurrent neural network, so that the recurrent neural network can extract the feature information and time information of the user behavior from the feature sequence, and thereby identify whether the behavior of the user to be detected is abnormal, which helps to improve the detection accuracy of abnormal behavior.

[0008] Other features and advantages of the present disclosure will be described in the following description, and partly become apparent from the description, or be understood by implementing the present disclosure. Other advantages of the present disclosure can be realized and obtained by the schemes described in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The accompanying drawings are used to provide an understanding of the technical solution of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the technical solution of the present disclosure and do not constitute a limitation on the technical solution of the present disclosure.

[0010] Figure 1 A flowchart of an embodiment of a method for detecting abnormal behavior disclosed herein; Figure 2 A schematic diagram of a flow chart of generating a feature sequence in one embodiment of the method for detecting abnormal behavior disclosed herein; Figure 3 A schematic diagram of a process of detecting abnormal behavior in one embodiment of the method for detecting abnormal behavior disclosed herein; Figure 4 A schematic diagram of a flow chart of training a recurrent neural network in one embodiment of the method for detecting abnormal behavior disclosed herein; Figure 5 The present invention is a flowchart of generating a third subset and a fourth subset in one embodiment of the method for detecting abnormal behavior disclosed herein. DETAILED DESCRIPTION

[0011] The present disclosure describes multiple embodiments, but the description is exemplary rather than restrictive, and it is apparent to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present disclosure. Although many possible feature combinations are shown in the drawings and discussed in the specific embodiments, many other combinations of the disclosed features are possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with any other feature or element in any other embodiment, or may replace any other feature or element in any other embodiment.

[0012] The present disclosure includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The disclosed embodiments, features, and elements of the present disclosure may also be combined with any conventional features or elements to form a unique invention scheme. Any features or elements of any embodiment may also be combined with features or elements from other invention schemes to form another unique invention scheme. Therefore, it should be understood that any feature shown and / or discussed in the present disclosure may be implemented individually or in any appropriate combination. Therefore, except for the limitations made according to the attached claims and their equivalents, the embodiments are not subject to other restrictions. In addition, various modifications and changes may be made within the scope of protection of the attached claims.

[0013] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps in the specific order described. As will be appreciated by those of ordinary skill in the art, other orders of steps are also possible. Therefore, the specific order of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to the steps performed in the order written, and those skilled in the art can easily understand that these orders can be changed and still remain within the spirit and scope of the disclosed embodiments.

[0014] Figure 1 A flow chart of an embodiment of a method for detecting abnormal behavior disclosed in the present invention is shown as follows: Figure 1 As shown, the process may include the following steps.

[0015] Step 110: extracting the behavior feature information of the user to be detected from the behavior data of the user to be detected, and performing serialization processing on the behavior feature information according to time to obtain a feature sequence.

[0016] In this embodiment, the behavior data refers to data obtained by recording specific user behaviors, and specific behaviors may include various types of behaviors, such as user operation records on devices, web browsing records, file operation records, etc. The behavior feature information refers to feature data extracted from the behavior data, such as a numerical representation of specific behaviors.

[0017] As an example, an electronic device for detecting abnormal behavior (for example, a terminal device or a server) can obtain the behavior log of the user to be detected, filter out the records of specific behaviors and the timestamp information of specific behaviors from the behavior log through feature engineering, and encode the filtered records of specific behaviors to obtain a numerical representation of the records of characteristic behaviors as the behavior feature information of the user to be detected; then, the behavior feature information at different times is sorted according to the timestamp information to obtain a feature sequence. In this way, the feature sequence includes not only the feature information of the user's behavior, but also the time information of the user's behavior.

[0018] Step 120: Based on the feature sequence, use a pre-trained recurrent neural network to identify whether the behavior of the user to be detected is abnormal.

[0019] In this embodiment, a recurrent neural network (RNN) represents the corresponding relationship between a feature sequence and whether the user behavior is abnormal. The RNN can extract the behavior characteristics and time information of the user to be detected from the input feature sequence to form context information of the user behavior characteristics, and thereby identify whether the behavior of the user to be detected is abnormal.

[0020] The method for detecting abnormal behavior in this embodiment extracts the behavior feature information of the user to be detected from the behavior data of the user to be detected, and serializes the behavior feature information according to time, which can not only improve the ability of the feature sequence to express the user behavior, but also associate the feature information of the user behavior with the time information through the feature sequence. The feature sequence is used as input data of the recurrent neural network, so that the recurrent neural network can extract the feature information and time information of the user behavior from the feature sequence, and thereby identify whether the behavior of the user to be detected is abnormal, which helps to improve the detection accuracy of abnormal behavior.

[0021] In some embodiments, the above step 110 can be performed by Figure 2 The process shown in the figure obtains the feature sequence, such as Figure 2 As shown, the process may include the following steps.

[0022] Step 210: extracting multiple types of behavior feature data from the behavior data of the user to be detected.

[0023] In this embodiment, the behavior types included in the behavior characteristic data may be predetermined so as to extract the corresponding type of behavior characteristic data from the behavior data of the user to be detected.

[0024] In some optional implementations of this embodiment, device operation data, network behavior data and file operation data may be extracted from the behavior data of the user to be detected as the behavior feature data of the user to be detected.

[0025] In an optional example of this embodiment, the device operation data includes at least one of the following: the operation record of the user to be detected on the device during working hours, the operation record of the user to be detected on the device during non-working hours, and the operation record of the user to be detected using a storage medium to connect the device.

[0026] As an example, the device operation data may be the operation record of the computer by the user to be detected, for example, it may include the following records: the time difference between the start time of work and the first login to the computer; the time difference between the last login time and the time of leaving work; the average duration of computer login during working hours; the average duration of computer login during non-working hours; the total number of computer logins; the total number of computer logouts; the number of computer logins during non-working hours; the total number of computers visited (the number of computers visited outside office hours); the number of times storage media (such as a mobile hard disk, USB flash memory or other storage media) are used during non-working hours; the number of storage media; the number of times the storage medium is connected to the computer of the user to be detected; the number of times the storage medium is connected to other users' computers, etc.

[0027] In an optional example of this embodiment, the network behavior data includes access records for preset types of web pages and / or operation records of emails.

[0028] As an example, the preset types of web pages may include job search web pages, news web pages, and technology web pages, and the access records may include the number of accesses and the duration of accesses. The operation records of mail (also called E-mail) may include: the number of emails sent outside the organization domain, the number of emails sent from the parent account within the organization domain, the number of external emails received, the number of attachments carried in the emails, the average size of the emails, the number of recipients, etc.

[0029] In an optional example of this embodiment, the file operation data includes operation records for files stored in the target device and / or operation records for files stored in devices other than the target device, and the target device is a device for which the user to be detected has operation authority.

[0030] As an example, the target device may be a computer that the user to be detected has operation authority on, and the other devices may be computers of users other than the user to be detected. File operation data may include operation records of the user to be detected on files stored in the target device and other devices other than the target device. The file type may be, for example, a disguised file, an .exe file, a txt file, a doc file, a pdf file, a zip file, etc., and the operation type may be, for example, copy, download, install, etc.

[0031] In this embodiment, the device operation data, network behavior data and file operation data of the user to be detected are used as behavioral feature data, and the user's behavioral characteristics can be characterized from three dimensions: hardware device operation information, network behavior operation information and file operation information, thereby improving the accuracy of the behavioral feature data in describing the user's behavior.

[0032] Step 220: Aggregate the extracted behavior feature data according to time to obtain multiple behavior feature data sets.

[0033] Each behavior feature data set includes multiple types of behavior feature data within a time period.

[0034] In this embodiment, the time unit of clustering can be predetermined, for example, hours, days, weeks or months. The behavior feature data extracted in step 210 can be divided into multiple behavior feature data sets through clustering, each behavior feature data set including multiple types of behavior feature data within a time period.

[0035] As an example, the behavioral feature data obtained in step 210 includes the device operation data, network behavior data, and file operation data of the user to be detected within a week. After clustering in units of days, 7 behavioral feature data sets can be obtained, corresponding to the 7 days of a week. Each behavioral feature data set includes the device operation data, network behavior data, and file operation data of the user to be detected within a day.

[0036] Step 230: Encode each behavior feature data set to obtain behavior feature information corresponding to each time period.

[0037] As an example, a number can be used to represent the type of behavior, and a string can be formed based on the type number of the behavior and the value corresponding to the behavior as the characteristic information of the behavior. Then, the character strings corresponding to all behaviors can be concatenated to obtain the behavior characteristic information. A two-dimensional array can also be used to represent the behavior characteristic information. The position of the element in the two-dimensional array represents the type of behavior, and the value of the element represents the value corresponding to the behavior.

[0038] For categorical behavior data, such as logging into a target device or logging into devices other than the target device, the behavior data of the category row can be converted into numerical feature information through one-hot encoding.

[0039] Step 240: Sort the behavior feature information corresponding to the multiple time periods in chronological order to obtain a feature sequence.

[0040] In this embodiment, the behavior feature information corresponding to each time period is taken as an element in the feature sequence and arranged in chronological order to obtain the feature sequence.

[0041] Figure 2 In the embodiment shown, the behavior feature data is clustered according to time, the behavior data of the user to be detected is divided into multiple data sets according to time, each behavior feature data set is converted into corresponding behavior feature information through encoding, and then a feature sequence is formed in chronological order, so that the feature sequence contains both the user's behavior features and time information, which can expand the dimension of the feature sequence to characterize user behavior and help improve the accuracy of abnormal behavior detection.

[0042] In some embodiments, the recurrent neural network may include an input layer, a hidden layer, and an output layer. The above step 120 may be performed by Figure 3 The process shown detects the user's behavior, such as Figure 3 As shown, the process may include the following steps.

[0043] Step 310: Utilize the input layer of the recurrent neural network to receive the feature sequence, and sequentially transmit the behavior feature information contained in the feature sequence to the hidden layer of the recurrent neural network.

[0044] As an example, the input layer may pass one element of the feature sequence to the hidden layer each time in order, that is, the behavior feature information of a time period is input to the hidden layer each time.

[0045] Step 320: Use the hidden layer to extract context information in the feature sequence and output hidden state information.

[0046] In this embodiment, the hidden layer can record the hidden state information corresponding to the behavior feature information of the previous input, and then combine it with the behavior feature information of the current input as context information for calculation to determine the hidden state information corresponding to the current input.

[0047] Step 330: Use the output layer of the recurrent neural network to predict the behavior type identifier corresponding to the user to be detected based on the hidden state information output by the hidden layer.

[0048] The behavior type identifier indicates whether the behavior of the user to be detected is abnormal.

[0049] In this embodiment, the output layer can classify the behavior of the user to be detected according to the hidden state information, and output the behavior type identifier of the user to be detected, so as to detect whether the user to be detected has abnormal behavior.

[0050] In this embodiment, with the help of the sequence modeling capability of the recurrent neural network, reasoning can be performed based on the context information in the feature sequence to detect whether the user behavior is abnormal, which can improve the accuracy of detecting abnormal behavior.

[0051] In some optional implementations of the present embodiment, the hidden layer of the recurrent neural network may include a gated recurrent unit (GRU); and the above step 320 may include: determining a gating value of the gated recurrent unit based on the hidden state information at the previous moment and the input at the current moment; and outputting the hidden state information at the current moment based on the hidden state information at the previous moment, the input at the current moment, and the gating value.

[0052] In this embodiment, the hidden layer can control the input data and memory information through the gated recurrent unit, and can make trade-offs and choices between the input data and memory information when determining the hidden state information at the next moment. This is beneficial for dealing with problems such as gradient diffusion of recurrent neural networks, and can achieve effective modeling of long-term dependencies of recurrent neural networks, which helps to improve the performance of recurrent neural networks, thereby improving the accuracy of abnormal behavior detection.

[0053] In an alternative example, the hidden layer computes t The process of hiding the state information at time +1 can be expressed by the following equations (1), (2), and (3).

[0054] (1) (2) (3) In the formula, z、r represents the gate value, express t Input at the moment, Indicates that the hidden layer is t Hidden state information output at all times, Indicates that the hidden layer is t +1 hidden state information output at the moment, , represents the activation function, W represents the weight parameter of the hidden layer, and b represents the bias parameter of the hidden layer.

[0055] Usually, the samples required for training recurrent neural networks need to include samples of abnormal behavior and samples of normal behavior. However, in practice, it is much more difficult to obtain abnormal behavior data than normal behavior data, which results in the number of abnormal behavior data being much smaller than that of normal behavior data. The sample set constructed in this way will have data imbalance, and the performance of the trained recurrent neural network will also be adversely affected.

[0056] In order to solve the above problems, the method for detecting abnormal behavior disclosed in the present invention can adopt Figure 4 The process shown is to train a recurrent neural network. Figure 4 As shown, the process may include the following steps.

[0057] Step 410: Obtain behavior data of multiple users as sample behavior data, and generate a sample feature sequence corresponding to the sample behavior data.

[0058] The sample behavior data includes normal behavior data and abnormal behavior data.

[0059] For example, you can Figure 2 The process shown serializes the sample behavior data to obtain a sample feature sequence corresponding to each sample behavior data.

[0060] Step 420: Mark the sample feature sequence with a behavior type label according to whether it is an abnormal behavior, and obtain a marked sample feature sequence.

[0061] In this embodiment, the sample behavior data includes normal behavior data and abnormal behavior data. Correspondingly, the behavior type labels of the sample feature sequences can be divided into two types: normal behavior and abnormal behavior.

[0062] Step 430: construct a sample set based on the labeled sample feature sequence.

[0063] The sample set includes a first subset obtained by undersampling a set consisting of sample feature sequences corresponding to normal behavior data and a second subset obtained by oversampling a set consisting of sample feature sequences corresponding to abnormal behavior data.

[0064] As an example, all sample feature sequences can be divided into two sets according to the behavior type labels of the sample feature sequences, and then the set containing the sample feature sequences corresponding to the normal behavior data is undersampled to reduce the number of sample feature sequences corresponding to the normal behavior data; the set containing the sample feature sequences corresponding to the abnormal behavior data is oversampled to increase the number of sample feature sequences corresponding to the abnormal behavior data, so that the numbers of the two types of sample feature sequences are similar or the same, thereby ensuring the balance of the two types of sample numbers.

[0065] Step 440: Based on the sample set, the pre-constructed recurrent neural network to be trained is trained to obtain a trained recurrent neural network.

[0066] As an example, we can choose the cross entropy function shown in formula (4): L As a loss function: (4) In the formula, Indicates the behavior type identifier to be predicted by the recurrent neural network to be trained, Indicates the behavior type identifier of the sample feature sequence tag.

[0067] In the training phase, the sample feature sequence in the sample set can be input into the recurrent neural network to be trained to obtain the prediction result of the recurrent neural network to be trained (i.e., ), based on the prediction result and the behavior type identification marked by the sample feature sequence (i.e., ) determines the loss value, and iteratively optimizes the parameters of the recurrent neural network to be trained (such as the weight parameters and bias parameters in equations (1), (2), and (3)) through the Adam method until the recurrent neural network to be trained converges or the number of iterations reaches a preset number, thereby obtaining a trained recurrent neural network.

[0068] In this embodiment, when constructing a sample set, the number of sample data corresponding to normal behavior and abnormal behavior is controlled through sampling processing, so that the number of samples of the two types in the sample set is similar, thereby improving the balance of sample data and reducing the adverse effects of data imbalance on the performance of the recurrent neural network.

[0069] In some optional implementations of this embodiment, the sample set further includes a third subset and a fourth subset, wherein the third subset and the fourth subset can be Figure 5 The process shown is as follows: Figure 5 As shown, the process includes the following steps.

[0070] Step 510: Divide the first subset into multiple mutually non-overlapping subsets, and merge each subset with the second subset to obtain multiple fifth subsets.

[0071] Step 520: Identify the sample feature sequences that are mislabeled as abnormal behaviors and the sample feature sequences that are mislabeled as normal behaviors in each fifth subset.

[0072] Generally, the labeling process of sample feature sequences can be implemented through a specific classification model. However, due to performance limitations, the classification model may make misjudgments, labeling sample feature sequences of normal behavior as abnormal behavior, and / or labeling sample feature sequences of abnormal behavior as normal behavior.

[0073] As an example, for each fifth subset, a gradient boosting decision tree algorithm (such as XGBoost) can be used for training and prediction to identify sample feature sequences in the fifth subset that are mislabeled as abnormal behaviors and sample feature sequences that are mislabeled as normal behaviors.

[0074] Step 530: All sample feature sequences that are mistakenly marked as abnormal behaviors are taken as the third subset, and all sample feature sequences that are mistakenly marked as normal behaviors are taken as the fourth subset.

[0075] In this embodiment, the sample set includes not only the first subset corresponding to the normal behavior data and the second subset corresponding to the abnormal behavior data, but also the third subset and the fourth subset composed of the sample feature sequences that are incorrectly labeled. Training the recurrent neural network in this way can enable the recurrent neural network to extract richer feature information from the data, thereby improving the robustness of the recurrent neural network.

[0076] An embodiment of the present disclosure further provides a non-transitory computer storage medium storing a computer program. In some embodiments, when the computer program is executed by a processor, the method for detecting abnormal behavior in any of the above embodiments is implemented.

[0077] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transient medium). As is known to those skilled in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A method for detecting abnormal behavior, characterized in that: The method comprises: Extracting behavior feature information of the user to be detected from the behavior data of the user to be detected, and performing serialization processing on the behavior feature information according to time to obtain a feature sequence; Based on the feature sequence, a pre-trained recurrent neural network is used to identify whether the behavior of the user to be detected is abnormal.

2. The method according to claim 1, characterized in that Extracting behavior feature information of the user to be detected from the behavior data of the user to be detected, and performing serialization processing on the behavior feature information according to time to obtain a feature sequence, including: Extracting multiple types of behavior feature data from the behavior data of the user to be detected; Aggregate the extracted behavior feature data according to time to obtain multiple behavior feature data sets, each behavior feature data set including multiple types of behavior feature data within a time period; Encoding each of the behavior feature data sets to obtain behavior feature information corresponding to each time period; The behavior feature information corresponding to the multiple time periods is sorted in chronological order to obtain the feature sequence.

3. The method according to claim 2, characterized in that Extracting multiple types of behavior data from the behavior data of the user to be detected, including: Device operation data, network behavior data and file operation data are extracted from the behavior data of the user to be detected as the behavior feature data of the user to be detected.

4. The method according to claim 3, characterized in that: The device operation data includes at least one of the following: the operation record of the user to be detected on the device during working hours, the operation record of the user to be detected on the device during non-working hours, and the operation record of the user to be detected connecting the device using a storage medium; The network behavior data includes access records for preset types of web pages and / or operation records for emails; The file operation data includes operation records for files stored in a target device and / or operation records for files stored in other devices other than the target device, and the target device is a device for which the user to be detected has operation authority.

5. The method according to any one of claims 1 to 4, characterized in that Based on the feature sequence, using a pre-trained recurrent neural network to identify whether the behavior of the user to be detected is abnormal, including: Utilizing the input layer of the recurrent neural network to receive the feature sequence, and sequentially transmitting the behavior feature information contained in the feature sequence to the hidden layer of the recurrent neural network; Extracting context information from the feature sequence using the hidden layer and outputting hidden state information; The output layer of the recurrent neural network is used to predict the behavior type identifier corresponding to the user to be detected based on the hidden state information output by the hidden layer, and the behavior type identifier represents whether the behavior of the user to be detected is abnormal.

6. The method according to claim 5, characterized in that The hidden layer of the recurrent neural network includes a gated recurrent unit; as well as, The hidden layer is used to extract context information in the feature sequence and output hidden state information, including: determining a gating value of the gated cyclic unit based on the hidden state information at a previous moment and an input at a current moment; and outputting the hidden state information at a current moment based on the hidden state information at a previous moment, the input at a current moment and the gating value.

7. The method according to claim 6, characterized in that The hidden layer is determined by the following formula t +1 hidden status information: In the formula, z、r represents the gate value, express t Input at the moment, Indicates that the hidden layer is t Hidden state information output at all times, Indicates that the hidden layer is t +1 hidden state information output at the moment, , represents the activation function, W represents the weight parameter of the hidden layer, and b represents the bias parameter of the hidden layer.

8. The method according to claim 5, characterized in that The recurrent neural network is trained in the following way: Acquire behavior data of multiple users as sample behavior data, and generate a sample feature sequence corresponding to the sample behavior data, wherein the sample behavior data includes normal behavior data and abnormal behavior data; According to whether it is an abnormal behavior, marking the behavior type label on the sample feature sequence to obtain the marked sample feature sequence; Based on the labeled sample feature sequences, a sample set is constructed, wherein the sample set includes a first subset obtained by undersampling a set composed of sample feature sequences corresponding to the normal behavior data and a second subset obtained by oversampling a set composed of sample feature sequences corresponding to the abnormal behavior data; Based on the sample set, the pre-constructed recurrent neural network to be trained is trained to obtain the trained recurrent neural network.

9. The method according to claim 8, characterized in that The sample set further includes a third subset and a fourth subset, wherein the third subset and the fourth subset are obtained in the following manner: Dividing the first subset into a plurality of mutually disjoint subsets, and merging each subset with the second subset respectively, to obtain a plurality of fifth subsets; Identifying sample feature sequences that are mislabeled as abnormal behaviors and sample feature sequences that are mislabeled as normal behaviors in each of the fifth subsets; All the sample feature sequences that are mistakenly marked as abnormal behaviors are taken as the third subset, and all the sample feature sequences that are mistakenly marked as normal behaviors are taken as the fourth subset.

10. A non-transitory computer storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for detecting abnormal behavior according to any one of claims 1 to 9 is implemented.

Images