AI-based business system data illegal operation behavior identification method and system

Abstract

The present invention relates to data recognition technology, and provides an AI-based business system data illegal operation behavior recognition method and system, the method comprising collecting original data; using an adversarial network algorithm model generated by feature nesting to generate new samples, and using the new samples to expand the database; placing the expanded data into a feature extraction model based on a dynamic adaptive oscillating neural network algorithm for feature extraction; inputting the feature-extracted data into a feature dimensionality reduction model for dimensionality reduction; inputting the feature-reduced data into a classifier for classifier training; and using the trained model to identify illegal operation behaviors. The AI-based business system data illegal operation behavior recognition method provided in this application can realize feature extraction and dimensionality reduction by combining a dynamic adaptive oscillating neural network and an autoencoder algorithm based on boundary smoothing, significantly improving the accuracy, robustness and training efficiency of the model.

Description

Technical Field

[0001] The present invention relates to the technical field of business system data illegal operation behavior identification, and in particular to a business system data illegal operation behavior identification method based on artificial intelligence. Background Art

[0002] With the widespread application of artificial intelligence (AI) technology in business systems, identifying data violations has become a critical component of ensuring enterprise data security and compliance. Traditional methods for identifying violations rely primarily on rule engines and manual review, which often fall short when faced with complex and ever-changing business scenarios and massive amounts of data. The introduction of AI technology, through machine learning and deep learning algorithms, can automatically learn and identify potential violation patterns, thereby improving identification accuracy and efficiency.

[0003] With the advent of the big data era, AI applications in identifying data violations in business systems currently primarily include technologies such as anomaly detection, behavioral analysis, and pattern recognition. Anomaly detection technology monitors user behavior in business systems in real time to identify abnormal operations that significantly deviate from normal patterns. Behavioral analysis analyzes historical user behavior data to build behavioral models and predict and identify potential violations. Pattern recognition leverages big data analysis to identify patterns of violations with specific characteristics. The combination of these technologies enables AI to effectively identify and warn of various data violations, ensuring data security and compliance in business systems.

[0004] The demand for processing and analyzing all types of data continues to increase, but in many practical applications, insufficient data annotation, sample imbalance, and noise interference remain significant factors that hinder model effectiveness. In traditional machine learning methods, a lack of data samples often leads to poor model generalization and an inability to effectively predict new or unseen samples. Summary of the Invention

[0005] The purpose of this section is to summarize some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and in the abstract and title of this application to avoid unclear expression of the purpose of this section and the abstract and title of the invention, and such simplifications or omissions shall not be used to limit the scope of the present invention.

[0006] In view of the above-mentioned and / or existing problems in the existing AI-based business system data illegal operation behavior identification method, the present invention is proposed.

[0007] Therefore, the problem to be solved by the present invention is:

[0008] In existing business system data violation operation behavior identification technologies, the data collection and labeling process usually relies on manual completion, and the labeled samples are relatively limited, resulting in insufficient training data, affecting the generalization ability and accuracy of the model; many methods are unable to effectively expand the data when faced with a wide variety and changes in violation behaviors, which easily leads to insufficient model training, making the model unable to accurately identify diverse violations.

[0009] To solve the above technical problems, the present invention provides the following technical solutions: an AI-based business system data illegal operation behavior identification method, which includes:

[0010] Collecting raw data to obtain operation logs, business records, and user behavior data from the raw data;

[0011] A feature-nested adversarial network algorithm model is used to generate new samples, and the collected original data is trained with the new samples to achieve data expansion;

[0012] The expanded data is placed into a feature extraction model to achieve feature extraction, wherein the feature extraction model is established based on a dynamic adaptive oscillatory neural network algorithm;

[0013] The feature-extracted data is input into a feature dimensionality reduction model for dimensionality reduction training, wherein the dimensionality reduction model is based on a boundary-smoothed autoencoder;

[0014] The reduced-dimensional data is input into the classifier for classifier training, and the trained model is used to identify illegal operation behaviors.

[0015] As a preferred solution of the AI-based business system data illegal operation behavior identification method of the present invention, the method of generating new samples using the feature nested adversarial network algorithm model includes:

[0016] Initialize the parameters of the generator and discriminator of the generative adversarial network randomly, and the initialized parameters obey the normal distribution with mean 0 and variance as the unit matrix;

[0017] The calculation method of generating new samples by the adversarial network algorithm model is:

[0018]

[0019] The generator model is , the discriminator model is , the parameters of the generator are , is the parameter update operation, is the learning rate of the generator, represents the real data sample, is the distribution of the real data, Indicates that it obeys a specific distribution. is the input noise of the generator, is the noise distribution, Express expectations, represents the gradient of the generator parameters, is the discriminator function, is the generator function, Q ce is a feature nested item;

[0020] The generator generates new samples, and the discriminator evaluates the new samples. The discriminator determines whether the samples are real data or generated data, and provides a feedback signal to the generator based on its output, forming a new sample iteration.

[0021] As a preferred solution of the AI-based business system data illegal operation behavior identification method of the present invention, the feature dimensionality reduction model adopts an autoencoder based on boundary smoothing for model design, including:

[0022] The autoencoder consists of two parts: an encoder and a decoder, wherein the encoder compresses the input data into a low-dimensional representation, and the decoder reconstructs the low-dimensional data into a feature vector similar to the input data;

[0023] In order to deal with outliers and boundary effects in the dimensionality reduction process, the feature dimensionality reduction model adopts an automatic boundary smoothing strategy to enhance the robustness of the model by dynamically adjusting the boundary value. The encoder output is smoothed by a smoothing function, which is expressed as:

[0024]

[0025]

[0026] Where, is the output reconstructed by the decoder, is the smoothed encoder output, is a smooth function, is the smoothing strength parameter, It is an automatically adjusted threshold parameter that controls the degree of smoothing.

[0027] As a preferred solution of the AI-based business system data violation operation behavior identification method of the present invention, the feature extraction model is implemented based on a dynamic adaptive oscillation neural network algorithm. By simulating the nonlinear oscillation behavior in physical phenomena, the algorithm can effectively explore and utilize local extreme values in high-dimensional parameter space, thereby realizing the optimization of the neural network.

[0028] As a preferred solution of the AI-based business system data violation operation behavior identification method of the present invention, the classifier classifies the data based on the feature dimensionality reduction model output, which is divided into normal data operations, violation operations, illegal access operations, data modification and deletion operations, and permission operations.

[0029] In view of the above-mentioned and / or existing problems in the existing AI-based business system data illegal operation behavior identification method, the present invention is proposed.

[0030] Therefore, the problem to be solved by the present invention is:

[0031] Existing feature dimensionality reduction algorithms for business systems often exhibit weaknesses when dealing with outliers and edge effects. This results in poor adaptability to noise and abnormal data, which in turn affects classification accuracy. During the classification phase, existing classification algorithms often rely on static feature selection strategies, which can result in redundant features not being effectively removed, thus impacting model performance.

[0032] To solve the above technical problems, the present invention provides the following technical solutions: an AI-based business system data illegal operation behavior identification system, comprising:

[0033] A data acquisition module, which is used to build a database and collect raw data;

[0034] A data expansion module generates new samples based on the original data through an adversarial network algorithm model to enrich the database and achieve data expansion;

[0035] A data feature extraction module, which extracts features from the data in the database expanded by the data expansion module based on a dynamic adaptive oscillating neural network algorithm;

[0036] A feature dimensionality reduction module, wherein the feature dimensionality reduction module implements feature dimensionality reduction model training based on a boundary smoothing autoencoder;

[0037] A classifier module, which classifies the data after feature dimensionality reduction into illegal operation behaviors;

[0038] A display module, which displays the illegal operation behaviors classified by the classifier module;

[0039] The data acquisition module, data expansion module, data feature extraction module, feature dimension reduction module, classifier module and display module are connected in sequence.

[0040] As a preferred solution of the AI-based business system data violation operation behavior identification system of the present invention, wherein: during the training process of the autoencoder in the feature dimensionality reduction module, data processing is performed by forward propagation, and then the autoencoder parameters are updated by using the gradient descent method through error back propagation;

[0041] The autoencoder in the feature dimensionality reduction module repeatedly iterates the data dimensionality reduction process until a preset stopping iteration condition is met, indicating that the model training is completed. The preset stopping iteration condition is that a preset maximum number of iterations is reached.

[0042] As a preferred solution of the AI-based business system data violation operation behavior identification system described in the present invention, the display module displays the violation operation after displaying the data input by the classifier module, and performs warning signal processing on the violation behavior and the location where the violation behavior data is generated.

[0043] The present invention provides the following technical solution: an electronic device comprising:

[0044] one or more processors;

[0045] a storage device having one or more programs stored thereon;

[0046] When the one or more programs are executed by the one or more processors, the one or more processors implement an AI-based method for identifying illegal business system data operation behaviors.

[0047] The present invention provides the following technical solution: an electronic device comprising:

[0048] A computer-readable storage medium stores executable instructions, which, when executed by a processor, enable the processor to implement an AI-based method for identifying illegal business system data operation behaviors.

[0049] As a preferred solution of the AI-based business system data violation operation behavior identification system described in the present invention, the display module displays the violation operation after displaying the data input by the classifier module, and performs warning signal processing on the violation behavior and the location where the violation behavior data is generated.

[0050] The present invention proposes a data augmentation method and system based on a generative adversarial network, which combines a dynamic adaptive oscillating neural network and an autoencoder algorithm based on boundary smoothing for feature extraction and dimensionality reduction, and adopts a classification optimization algorithm with adaptive elastic deep feature clipping, thereby significantly improving the accuracy, robustness and training efficiency of the model when the data volume is insufficient and the features are complex. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort. Among them:

[0052] Figure 1 This is a flow chart of the feature extraction model training for the AI-based business system data illegal operation behavior identification method in Example 1.

[0053] Figure 2 This is a flow chart of the feature dimensionality reduction model training for the AI-based business system data illegal operation behavior identification method in Example 1.

[0054] Figure 3 This is a system flow chart of the AI-based business system data violation operation behavior identification system in Example 2.

[0055] Figure 4 This is a comparison chart of the generative adversarial network training loss at different learning rates for the AI-based business system data violation operation behavior identification system in Example 3.

[0056] Figure 5 This is a diagram showing the impact of the number of observed training iterations on the generation effect at different learning rates for the AI-based business system data illegal operation behavior identification system in Example 3.

[0057] Figure 6 This is a diagram showing the impact of different noise distributions at different learning rates on the generator training convergence speed of the AI-based business system data violation operation behavior identification system in Example 3.

[0058] Figure 7 This is a diagram showing the influence of the regularization term at different learning rates on the model generation stability of the AI-based business system data violation operation behavior identification system in Example 3. DETAILED DESCRIPTION

[0059] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0060] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0061] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0062] Example 1

[0063] Reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, provides an AI-based method for identifying illegal data operation behaviors in a business system, which includes:

[0064] S1. Data collection and annotation

[0065] The data used in this invention to train the illegal operation behavior recognition model is collected from the operation logs, business records, user behavior data of the actual business system, and other relevant information in the system, such as access control logs, anomaly detection records, identity authentication data, etc. The collected data covers multiple levels, including:

[0066] 1. User behavior data: records the operations performed by each user in the system, including but not limited to query, modify, delete, and other operations, as well as information such as time and access path;

[0067] 2. Operation log data: The log file generated by the system contains detailed information about each user operation, such as operation type, operation time, operation object, etc.

[0068] 3. Abnormal and violation logs: Violation data generated by the system's internal abnormality detection mechanism or third-party security protection mechanism, including malicious login, privilege escalation, illegal data access, and other behaviors.

[0069] The collected raw data is stored using relational databases, distributed file systems such as HDFS, NoSQL databases, etc.

[0070] S2. Data expansion

[0071] In the task of the present invention, the collection, acquisition, labeling and preprocessing of training data are time-consuming and labor-intensive, and insufficient training samples can easily lead to poor generalization ability of the model and affect the accuracy of the model;

[0072] This paper uses a generative adversarial network algorithm based on feature nesting for data augmentation, enriching the training dataset by generating new samples, thereby improving the model's ability to identify diverse violations;

[0073] The generative adversarial network consists of two parts: a generator and a discriminator. The generator is responsible for generating new data samples, and the discriminator is used to evaluate the authenticity of the generated samples.

[0074] Based on the traditional generative adversarial network, this paper adopts a feature nesting strategy to enhance the representativeness and diversity of data while maintaining the intrinsic structure and distribution relationship between data.

[0075] Specifically, the training process of the feature-embedded generative adversarial network algorithm is as follows:

[0076] S201, initialize the parameters of the generator and discriminator, and set the generator model to G c , the discriminator model is , the parameters of the generator are , the parameters of the discriminator are ;

[0077] In one embodiment, the parameters of the generator and the discriminator of the generative adversarial network are initialized by random initialization, and the initialized parameters obey a normal distribution with a mean of 0 and a variance of the unit matrix.

[0078] S202. While generating samples, the generator adjusts its generation strategy according to the distribution of the original data, so that the generated data can maintain similarity and consistency with the original data. This is achieved through nested structure modeling in the feature space, so that the generated data is not only diverse but also fully reflects the internal laws of the original data, which can be expressed as:

[0079]

[0080] The generator model is assumed to be , the discriminator model is , the parameters of the generator are , is the parameter update operation, is the learning rate of the generator, represents the real data sample, is the distribution of the real data, Indicates that it obeys a specific distribution. is the input noise of the generator, is the noise distribution, Express expectations, represents the gradient of the generator parameters, is the discriminator function, is the generator function, Q ce is a feature nested item;

[0081] Furthermore, the feature nesting term is calculated based on the L2 norm, which reduces the generator's excessive reliance on noise, prompts the generator to generate more diverse data, and enhances the model's tolerance to uncertainty. The calculation method is expressed as:

[0082]

[0083] Where, is the weight of the regularization term, is the gradient of the discriminator to the generated sample, which indicates the sensitivity of the generated sample to the discriminator output; || || is norm; is the characteristic divergence calculation function; is the distribution that generates the data. Preferably, Set to 0.2.

[0084] Furthermore, the distance between the output of the generator and the real data distribution needs to be measured by the divergence metric to make the generated data closer to the real data distribution. The implementation of the feature divergence calculation function is expressed as:

[0085]

[0086] Where, represents the Kullback-Leibler divergence, is the average of the two distributions (the distribution of the real data and the generated data), and are the distributions of real data and generated data, respectively.

[0087] S203. As training progresses, the generator will continuously generate new samples, and the discriminator will evaluate these samples. The task of the discriminator is to determine whether the sample is real data or generated data, and provide feedback signals to the generator based on its output. The parameter update method of the discriminator is expressed as:

[0088]

[0089]

[0090] Where, is the learning rate of the discriminator; represents the gradient of the discriminator parameters; is the smoothing regularization term.

[0091] Furthermore, the smoothing regularization term is intended to prevent the discriminator from overfitting during training and improve the robustness of the model. The calculation method is expressed as:

[0092]

[0093] Where, is the coefficient of the smoothing regularization term; is the discriminator's response to the input sample The gradient of , characterizes the sensitivity of the discriminator to the input.

[0094] Furthermore, the coefficient of the smoothing regularization term is dynamically adjusted according to the number of iterations, and the adjustment method is expressed as:

[0095]

[0096] Where, is the coefficient of the initial smoothing regularization term, is the adjustment speed, int(t) is the current iteration number. Preferably, Set to 0.2.

[0097] S204, repeat the above steps until the preset stop iteration condition is met, which means that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0098] S3. Feature extraction model training

[0099] Specifically, the training process of the neural network algorithm based on dynamic adaptive oscillation is as follows:

[0100] S301 , initializing the parameters of the neural network and simultaneously initializing the hyperparameters of the dynamic adaptive oscillation, including the initial phase and initial amplitude of the oscillation.

[0101] S302. Calculate the oscillation frequency of each parameter based on the current loss function. Adjustment of the oscillation frequency depends on the local curvature estimation of the loss surface and is performed using historical gradient information to make parameter updates smoother.

[0102] S303. The update of each parameter is affected by the phase difference. The phase difference is determined by the success rate of the previous update and the interaction strength between parameters. The phase update depends on the effect of the previous parameter update, which is used to simulate the delayed effect of causality.

[0103] S304. Automatically adjust the amplitude based on the effect of parameter updates in the past few iterations. If the update of a certain parameter continuously leads to a reduction in loss, then increase its amplitude; otherwise, decrease the amplitude. The adaptive adjustment method of the amplitude is expressed as:

[0104]

[0105] Where, is the amplitude of the oscillation, It is The amplitude of the oscillation of the iteration; It is The amplitude of the oscillation of the iteration; is the amplitude adjustment coefficient. Preferably, Set to 0.95.

[0106] S305. Calculate the updated values of the parameters of each neural network. Specifically, update the parameters in combination with the oscillation behavior, use sine and cosine functions to simulate the oscillation behavior, and allow the parameters to be periodically explored in the gradient direction of the loss function.

[0107] S306: Repeat the above steps until a preset stop iteration condition is met, indicating that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0108] S4. Feature dimensionality reduction model training

[0109] The data after feature extraction is input into the feature dimensionality reduction model for training the feature dimensionality reduction model. The present invention adopts an autoencoder based on boundary smoothing as the feature dimensionality reduction model. The autoencoder includes two parts, an encoder and a decoder. The encoder compresses the input data to a low-dimensional representation, and the decoder reconstructs the low-dimensional representation into a feature vector as similar as possible to the input data.

[0110] Specifically, the training process of the boundary smoothing autoencoder algorithm is as follows:

[0111] S401. Initialize the parameters of the autoencoder.

[0112] S402. During the training of the autoencoder, the data is processed by forward propagation, and then the autoencoder parameters are updated by gradient descent through error backpropagation.

[0113] S403. In order to deal with outliers and boundary effects in the dimensionality reduction process, an automatic boundary smoothing strategy is adopted to enhance the robustness of the model by dynamically adjusting the boundary value. Specifically, the encoder output is smoothed by a smoothing function, which is expressed as:

[0114]

[0115]

[0116] Where, is the output reconstructed by the decoder, is the smoothed encoder output, is a smooth function, is the smoothing strength parameter, is an automatically adjusted threshold parameter that controls the degree of smoothing.

[0117] In an embodiment, the smoothing strength parameter is determined using an adaptive method based on the local density of the data.

[0118] S404. The training of the autoencoder is completed by continuously optimizing the loss function in an iterative process.

[0119] S405. Optimize the training process of the autoencoder using the convex hull convergence strategy. Adjust the learning step size and weight update strategy to make the network converge quickly. The learning rate is dynamically adjusted according to the data distribution characteristics in the current iteration as follows:

[0120]

[0121] Where, is the learning rate of the initial autoencoder; It is The learning rate of the autoencoder for each iteration; is the learning rate decay factor of the autoencoder, It is The average diameter of the convex hull in iterations, is the diameter of the initial convex hull. The learning rate decreases as the convex hull diameter decreases to prevent instability caused by excessive step size in the later stages of learning.

[0122] S406: Repeat the above steps until a preset stop iteration condition is met, indicating that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0123] S5. Classifier model training

[0124] The data after feature dimensionality reduction is input into the classifier to train the classifier model. The present invention adopts the extreme learning machine algorithm based on random jump as the classifier model to classify the data after feature dimensionality reduction;

[0125] The random jump strategy improves the robustness of the extreme learning machine under high-dimensional features by adopting a dynamic adjustment mechanism and a jump strategy, while reducing the redundancy and overfitting of the network, thereby improving the performance of the classification model.

[0126] Specifically, the training process of the extreme learning machine algorithm based on random jumps is as follows:

[0127] 1. Construct an extreme learning machine classifier. The extreme learning machine adopts a single hidden layer feedforward neural network architecture. The basic principle of the extreme learning machine classifier can be expressed as follows:

[0128]

[0129] Where, is the output matrix of the hidden layer of the extreme learning machine; is the weight matrix of the output layer; is the target output matrix.

[0130] Before training the extreme learning machine, parameters need to be initialized. In one embodiment, the weights and biases of the hidden layer are initialized randomly, and the initialized parameters obey a normal distribution with a mean of 0 and a variance of the identity matrix.

[0131] And the calculation method of the output of the hidden layer of the extreme learning machine is expressed as:

[0132]

[0133] Where, is the input data of the extreme learning machine; is the Sigmoid activation function; is the weight of the extreme learning machine; is the bias of the extreme learning machine.

[0134] 2. During the training process of the extreme learning machine, the sparse regularization term is used to achieve sparse optimization, and the loss function is calculated as follows:

[0135]

[0136] Where || ||1 is the L1 norm, which is used to achieve weight sparsification; is the sparse regularization coefficient of the extreme learning machine; || || is the L2 norm.

[0137] 3. During training, a random jump strategy is used to avoid falling into the local optimal solution. Some weight items are randomly selected to make changes. Specifically, a part of the weight matrix elements is randomly selected and the jump probability is set. , if the randomly generated number is less than the probability , then the weight item jumps.

[0138] 4. Repeat the above steps until the preset stop iteration condition is met, which means that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0139] After the above training process, the final output of the extreme learning machine is:

[0140]

[0141] Where, It is the model output of the extreme learning machine, corresponding to different classification categories.

[0142] Example 2

[0143] Reference Figure 3 , which is a second embodiment of the present invention, the business system data illegal operation behavior identification system based on AI includes a data acquisition module (100), and the data acquisition module (100) is used to build a database and collect original data;

[0144] A data expansion module (200) is provided, wherein the data expansion module (200) generates new samples based on the original data through an adversarial network algorithm model, thereby enriching the database and achieving data expansion; a data feature extraction module (300) is provided, wherein the data feature extraction module (300) performs feature extraction on the data in the database expanded by the data expansion module (200) based on a dynamic adaptive oscillating neural network algorithm; a feature dimension reduction module (400) is provided, wherein the feature dimension reduction module (400) performs feature dimension reduction model training based on a boundary smoothing autoencoder; a classifier module (500) is provided, wherein the classifier module (500) classifies the data after the feature dimension reduction into illegal operation behaviors; and a display module (600) is provided, wherein the display module displays the illegal operation behaviors classified by the classifier module (500); the data acquisition module (100), the data expansion module (200), the data feature extraction module (300), the feature dimension reduction module (400), the classifier module (500), and the display module (600) are connected in sequence.

[0145] The data expansion module (200) is composed of a generator and a discriminator. The generator is responsible for generating new data samples, and the discriminator is used to evaluate the authenticity of the generated samples. During the training process of the autoencoder in the feature dimensionality reduction module (400), the data is processed by forward propagation, and then the autoencoder parameters are updated using the gradient descent method through error backpropagation. The display module (600) displays the illegal operation after displaying the data input by the classifier module (500), and performs warning signal processing for the illegal behavior and the location where the illegal behavior data is generated.

[0146] Example 3

[0147] In a third embodiment of the present invention, an AI-based business system data illegal operation behavior identification system includes, in one embodiment, attributes of the collected data include:

[0148] Table 1: Data attribute information table

[0149]

[0150] It should be noted that this embodiment is only intended to illustrate one data format and type of the present invention. In actual applications, the attributes of data are usually more than 10 attributes, and the number of attributes of data may reach dozens or even hundreds.

[0151] Furthermore, the collected data is labeled. The labeling method of the present invention is manual labeling. In one embodiment, the labeling categories include normal operation, illegal operation, illegal access to sensitive data, malicious tampering with system configuration, exploitation of permission loopholes to elevate permissions, and unauthorized data deletion or modification, a total of 6 categories.

[0152] To verify the effectiveness of this technology, the following experimental analysis is conducted:

[0153] like Figure 4 As shown in the figure, by comparing the training loss of the generative adversarial network under different learning rates, the impact of different learning rates on the generator is evaluated. The experimental results show that a high learning rate usually accelerates model convergence, but when it is too large, it may cause oscillation. The feature-nested generative adversarial network can still maintain a steady decline at a higher learning rate, showing the advantage of this technology in dealing with large learning rates.

[0154] Experimental results show that the loss of the feature-nested generative adversarial network decreases more steadily at different learning rates, while the ordinary generative adversarial network exhibits greater fluctuations at high learning rates.

[0155] like Figure 5 As shown in the figure, by analyzing the influence of the regularization term, we explore the impact of the regularization term on the stability of model generation. The experimental results show that the feature nesting regularization term can reduce the possibility of overfitting of the generator and increase the diversity and stability of the generated samples. Even when the regularization term is large, the feature nested generative adversarial network can still maintain good stability. The feature nested regularization term effectively improves the training stability of the generator, especially at higher regularization values, which is more robust than ordinary generative adversarial networks.

[0156] like Figure 6 As shown in the figure, by analyzing the impact of different noise distributions on the generation effect, and at the same time analyzing the impact of different noise distributions on the convergence speed of generator training, the experimental results show that Gaussian noise can accelerate the convergence of the generator compared to uniform noise, and can effectively improve the quality of generated data. The feature-nested generative adversarial network can better handle different noise distributions, and the quality and diversity of generated samples are significantly improved.

[0157] like Figure 7As shown in the figure, by analyzing the relationship between the number of training iterations and the generation effect, the impact of the number of training iterations on the generation effect is observed. The experimental results show that increasing the number of training iterations will help the generator generate more diverse and realistic data. The feature-nested generative adversarial network has more advantages in the number of iterations and shows better convergence. The generation effect of the feature-nested generative adversarial network is best at 1000 iterations, while the ordinary generative adversarial network may start to overfit with fewer iterations.

[0158] The expanded data is input into the feature extraction model for training the feature extraction model. The present invention adopts a six-layer fully connected neural network for feature extraction. The number of nodes in each layer of the fully connected layer is 128, that is, the layer contains 128 neurons.

[0159] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An AI-based method for identifying illegal operations on business system data, characterized by: The method comprises: Collecting raw data to obtain operation logs, business records, and user behavior data from the raw data; A feature-nested adversarial network algorithm model is used to generate new samples, and the collected original data is trained with the new samples to achieve data expansion; The expanded data is placed into a feature extraction model to achieve feature extraction, wherein the feature extraction model is established based on a dynamic adaptive oscillatory neural network algorithm; The feature-extracted data is input into a feature dimensionality reduction model for dimensionality reduction training, wherein the dimensionality reduction model is based on a boundary-smoothed autoencoder; The reduced-dimensional data is input into the classifier for classifier training, and the trained model is used to identify illegal operations. The classifier is based on the output data of the feature dimensionality reduction model and is divided into normal data operations, illegal operations, illegal access operations, data modification and deletion operations, and permission operations; Classifier model training: The reduced-dimensional data is input into the classifier for training. A random jump-based extreme learning machine algorithm is used as the classifier model to classify the reduced-dimensional data. The random jump strategy improves the robustness of the extreme learning machine under high-dimensional features by adopting a dynamic adjustment mechanism and a jump strategy, while reducing network redundancy and overfitting, thereby improving the performance of the classification model. Specifically, the training process of the extreme learning machine algorithm based on random jumps is as follows: Step 1: Construct an extreme learning machine classifier. The extreme learning machine adopts a single hidden layer feedforward neural network architecture. The basic principle of the extreme learning machine classifier is expressed as follows: Where, is the output matrix of the hidden layer of the extreme learning machine; is the weight matrix of the output layer; is the target output matrix; Before training the extreme learning machine, the parameters need to be initialized. The weights and biases of the hidden layer are initialized randomly, and the initialized parameters obey the normal distribution with mean 0 and variance as the unit matrix. And the calculation method of the output of the hidden layer of the extreme learning machine is expressed as: Where, is the input data of the extreme learning machine; is the Sigmoid activation function; is the weight of the extreme learning machine; is the bias of the extreme learning machine; Step 2: During the training of the extreme learning machine, the sparse regularization term is used to achieve sparse optimization. The loss function is calculated as follows: Where || ||1 is the L1 norm, which is used to achieve weight sparsification; is the sparse regularization coefficient of the extreme learning machine; || || is the L2 norm; Step 3: During training, a random jump strategy is used to avoid falling into the local optimal solution. Some weight items are randomly selected for change. Specifically, a part of the weight matrix elements is randomly selected and the jump probability is set. , if the randomly generated number is less than the probability , then the weight item jumps; Step 4: Repeat the above steps until the preset stop iteration condition is met, indicating that the model training is completed; the preset stop iteration condition is reaching the preset maximum number of iterations, which is set to 1000 times; After the above training process, the final output of the extreme learning machine is: Where, It is the model output of the extreme learning machine, corresponding to different classification categories.

2. The AI-based business system data violation operation behavior identification method according to claim 1 is characterized by: The method of generating new samples by adopting the feature-nested adversarial network algorithm model includes: Initialize the parameters of the generator and discriminator of the generative adversarial network randomly, and the initialized parameters obey the normal distribution with mean 0 and variance as the unit matrix; The calculation method of generating new samples by the adversarial network algorithm model is: The generator model is , the discriminator model is , the parameters of the generator are , is the parameter update operation, is the learning rate of the generator, represents the real data sample, is the distribution of the real data, Indicates that it obeys a specific distribution. is the input noise of the generator, is the noise distribution, Express expectations, represents the gradient of the generator parameters, is the discriminator function, is the generator function, Q ce is a feature nested item; The generator generates new samples, and the discriminator evaluates the new samples. The discriminator determines whether the samples are real data or generated data, and provides a feedback signal to the generator based on its output, forming a new sample iteration.

3. The AI-based business system data illegal operation behavior identification method according to claim 2 is characterized by: The feature extraction model uses a dynamic adaptive oscillating neural network to extract features from data. The dynamic adaptive oscillating neural network extracts data features using a local extreme value method in a high-dimensional parameter space by simulating nonlinear oscillation behaviors in physical phenomena.

4. The AI-based business system data violation operation behavior identification method according to claim 3 is characterized by: The feature dimensionality reduction model adopts a boundary smoothing-based autoencoder for model design, including: The autoencoder consists of two parts: an encoder and a decoder, wherein the encoder compresses the input data into a low-dimensional representation, and the decoder reconstructs the low-dimensional data into a feature vector similar to the input data; In order to deal with outliers and boundary effects in the dimensionality reduction process, the feature dimensionality reduction model adopts an automatic boundary smoothing strategy to enhance the robustness of the model by dynamically adjusting the boundary value. The encoder output is smoothed by a smoothing function, which is expressed as: Where, is the output data reconstructed by the decoder, is the output data of the smoothed encoder, is a smooth function, is the smoothing strength parameter, is an automatically adjusted threshold parameter that controls the degree of smoothing.

5. An AI-based business system data illegal operation behavior identification system, used to implement the method according to any one of claims 1 to 4, characterized in that: The system comprises: A data acquisition module (100), the data acquisition module (100) is used to construct a database and collect original data; A data expansion module (200), wherein the data expansion module (200) generates new samples based on the original data through an adversarial network algorithm model to enrich the database and achieve data expansion; A data feature extraction module (300), wherein the data feature extraction module (300) extracts features from the data in the database expanded by the data expansion module (200) based on a dynamic adaptive oscillating neural network algorithm; A feature dimensionality reduction module (400), wherein the feature dimensionality reduction module (400) implements feature dimensionality reduction based on a boundary smoothing autoencoder; A classifier module (500), wherein the classifier module (500) classifies the data after feature dimension reduction into illegal operation behaviors; A display module (600), which displays the illegal operation behaviors classified by the classifier module (500); The data acquisition module (100), the data expansion module (200), the data feature extraction module (300), the feature dimension reduction module (400), the classifier module (500), and the display module (600) are connected in sequence.

6. The AI-based business system data illegal operation behavior identification system according to claim 5, characterized in that: During the training of the autoencoder in the feature dimension reduction module (400), data processing is performed by forward propagation, and then the autoencoder parameters are updated by using the gradient descent method through error back propagation; The autoencoder in the feature dimensionality reduction module (400) repeatedly iterates the data dimensionality reduction process until a preset stopping iteration condition is met, indicating that the model training is completed. The preset stopping iteration condition is reaching a preset maximum number of iterations.

7. The AI-based business system data illegal operation behavior identification system according to claim 5, characterized in that: The display module (600) displays the illegal operation after displaying the data input by the classifier module (500), and performs warning signal processing on the location where the illegal behavior and the illegal behavior data are generated.

8. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4.

9. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to implement the method according to any one of claims 1 to 4.

Images