Abnormal behavior risk early warning system, method and device based on autonomous learning

Abstract

The application belongs to the technical field of network security, and provides an abnormal behavior risk early warning system, method, device and storage medium based on autonomous learning, comprising: a log recording module for recording the behavior of a user terminal and generating a log file of behavior information; a data storage module for storing the log file; a user classification module for obtaining text information of different types of users and calculating business similarity, creating independent subsets and setting permissions, and determining the behavior baseline of each independent subset; a log analysis module for analyzing the log file corresponding to each independent subset to obtain a data form and associating with the corresponding behavior baseline; an abnormal behavior judgment module for obtaining the association result and comparing to determine abnormal behavior; and an early warning processing module for obtaining abnormal behavior and performing early warning processing. Through user classification, multi-scenario behavior detection and behavior baseline setting, the application realizes accurate monitoring and efficient abnormal early warning of user behavior.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to an abnormal behavior risk early warning system, method, device and storage medium based on autonomous learning. Background Technology

[0002] With the rapid development of technology, especially the advancements in big data processing, cloud computing, data mining, and machine learning, the detection and early warning of abnormal behavior has become a research hotspot. Particularly in the real world, timely warnings and effective responses to abnormal behaviors such as violence and illegal activities are of great significance for maintaining social security and stability.

[0003] In the digital age, the security and compliance of resource access have become a key concern for organizations such as enterprises and government agencies. Anomaly risk warning systems can identify and warn of risks such as unauthorized access, malicious downloads, and data breaches, thereby ensuring the legitimate use of resources and the stable operation of the system.

[0004] Traditional cybersecurity defense methods mainly rely on tools such as firewalls, antivirus software, and intrusion detection systems. These tools typically detect threats based on known attack signatures or rules, but they lack sufficient detection methods for legitimate user behavior. The diversification of malicious behaviors increases privacy issues related to data breaches.

[0005] The challenges of anomaly behavior detection lie in several aspects: First, the diversity of anomaly behaviors makes it difficult to thoroughly investigate and eliminate them through manually defined behavior patterns. Second, establishing standardized criteria for anomaly behavior detection is challenging, as each user terminal has its own usage habits, making it impossible to develop a unified standard for tracking and detecting user behavior. Third, the limited data volume for a single user makes it difficult to determine the behavioral patterns and characteristics of that user through machine learning. Fourth, the lack of hierarchical classification of user terminals makes it difficult to perform machine learning on categorized user datasets together, resulting in a cumbersome management and detection process and a lack of representativeness in the established standards. Summary of the Invention

[0006] To address the problems mentioned in the background section, this invention provides an abnormal behavior risk early warning system, method, device, and storage medium based on autonomous learning.

[0007] This invention discloses an abnormal behavior risk early warning system based on autonomous learning, the system comprising:

[0008] The logging module is used to record user terminal behavior and behavior information in real time and generate log files;

[0009] Data storage module, used to store the log files;

[0010] The user classification module is used to obtain text information of different types of users and calculate business similarity, create independent subsets based on the business similarity and set permissions; and determine the behavioral baseline of each independent subset according to the log file.

[0011] The log parsing module is used to parse the log files corresponding to each of the independent subsets, obtain the data form, and associate each of the independent subsets with the corresponding behavior baseline;

[0012] The abnormal behavior judgment module is used to obtain related results, compare and judge them, and determine abnormal behavior;

[0013] The early warning processing module is used to acquire the abnormal behavior and perform early warning processing.

[0014] Furthermore, the user classification module specifically includes:

[0015] The acquisition unit is used to acquire text information from different types of users; the text information includes the functional scope, administrative level and number of employees of government users, the industry business scope, asset size and personnel size of enterprise users, and the occupation and skill attributes of individual users.

[0016] The conversion unit is used to process and convert the text information to obtain a numerical vector;

[0017] The computing unit is used to divide the numerical vectors of different users based on scale feature words and attribute feature words, obtain the feature vectors of different users, and calculate the business similarity.

[0018] A creation unit is used to create independent subsets based on a preset threshold and the business similarity, and to set the access permissions, API interface call scope and normal operation behavior of each independent subset;

[0019] The determination unit is used to determine the behavioral baseline of each of the independent subsets based on the log file, and to dynamically update it.

[0020] Furthermore, the log parsing module specifically includes:

[0021] The parsing unit is used to parse the log files generated by user behavior in each of the independent subsets to obtain a data form of each key-value pair information;

[0022] The association unit is used to associate each of the independent subsets with the corresponding behavioral baseline.

[0023] This invention also provides a method for early warning of abnormal behavior risks based on autonomous learning, the method comprising:

[0024] Record user terminal behavior and behavior information in real time, and generate log files;

[0025] Obtain text information of different types of users and calculate business similarity; create independent subsets based on the business similarity and set permissions; determine the behavioral baseline of each independent subset based on the log file.

[0026] The log files corresponding to each independent subset are parsed to obtain a data form, and each independent subset is associated with the corresponding behavioral baseline;

[0027] Obtain the correlation results, compare and judge them to identify abnormal behavior;

[0028] The abnormal behavior is detected and an early warning is issued.

[0029] Furthermore, the log file is stored in the data storage module.

[0030] Furthermore, the behavior includes login behavior, access behavior, and operation behavior; the behavior information includes the login status of the behavior subject, IP address, operation behavior, number of operations, operation time, traffic volume, and behavior object.

[0031] Furthermore, the process of acquiring text information from different types of users and calculating business similarity, creating independent subsets based on the business similarity and setting permissions, and determining the behavioral baseline for each independent subset according to the log file specifically includes:

[0032] Acquire text information from different types of users; the text information includes the functional scope, administrative level and number of employees of government users, the industry business scope, asset size and personnel size of enterprise users, and the occupation and skill attributes of individual users.

[0033] The text information is processed and transformed to obtain a numerical vector;

[0034] Based on scale feature words and attribute feature words, the numerical vectors of different users are divided to obtain the feature vectors corresponding to different users, and the business similarity is calculated.

[0035] Based on the preset threshold and the business similarity, independent subsets are created, and the access permissions, API call scope and normal operation behavior of each independent subset are set.

[0036] Based on the log files, the behavioral baselines of each independent subset are determined and dynamically updated.

[0037] Furthermore, the step of parsing the log files corresponding to each of the independent subsets to obtain data forms, and associating each of the independent subsets with the corresponding behavioral baselines, specifically includes:

[0038] The log files generated by user behavior in each of the independent subsets are parsed to obtain a data form of each key-value pair information;

[0039] Each of the independent subsets is associated with its corresponding behavioral baseline.

[0040] The present invention also provides a device including a processor coupled to a memory; the processor is configured to read and execute the computer program stored in the memory to implement the aforementioned method for early warning of abnormal behavior based on autonomous learning.

[0041] The present invention also provides a computer-readable storage medium storing a program or instructions that, when the program or instructions are run on a computer, cause the computer to execute the aforementioned method for early warning of abnormal behavior based on autonomous learning.

[0042] Compared with the prior art, the present invention has the following advantages:

[0043] This invention provides an abnormal behavior risk early warning system, method, device, and storage medium based on autonomous learning. It obtains representative user feature vectors based on user business attributes and business scale, and utilizes cosine similarity to group highly similar users into the same independent subset, increasing the data volume for machine learning while eliminating the need to set behavioral baselines for individual users, thus reducing computational resource consumption. By setting multiple scenarios for login, access, and operation behaviors, it achieves comprehensive behavior detection of users. Furthermore, the addition of a custom mode allows users to set matching behavioral baselines according to their individual usage scenarios and work characteristics, making abnormal behavior detection more accurately aligned with users' actual needs and improving the accuracy and practicality of risk warnings. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of the structure of an abnormal behavior risk early warning system based on autonomous learning according to the present invention;

[0046] Figure 2This is a flowchart illustrating an abnormal behavior risk warning method based on autonomous learning according to the present invention.

[0047] Figure 3 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a list of steps or methods is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes or methods.

[0050] In one embodiment of the present invention, an abnormal behavior risk early warning system based on autonomous learning is provided, such as... Figure 1 As shown, the system includes:

[0051] The logging module is used to record user terminal behavior and behavior information in real time and generate log files; the behavior includes login behavior, access behavior and operation behavior; the behavior information includes the login status of the behavior subject, IP address, operation behavior, number of operations, operation time, traffic volume and behavior object.

[0052] In this embodiment, the logging module records login behavior, access behavior, and operation behavior of each user terminal in real time. Access behavior can include page access, database access, etc.; operation behavior can include database operations, file transfers such as uploading and downloading, and API interface calls. An API (Application Programming Interface) is a set of defined rules and protocols that allow different software applications to communicate and interact.

[0053] In this embodiment, the information for each behavior record includes the login status, IP address, operation behavior, number of operations, operation time, traffic volume, and behavior object of the behavior subject. The behavior subject is a user with a unique UID; the behavior object includes the content of the requested query, the content of the data operation, and the API interface called. The UID (UserIdentifier) ​​is a number or string used to uniquely identify each user in the system.

[0054] A data storage module is used to store the log files.

[0055] The user classification module is used to obtain text information of different users and calculate business similarity, create independent subsets based on the business similarity and set permissions; and determine the behavioral baseline of each independent subset according to the log file.

[0056] In this embodiment, the user classification module specifically includes:

[0057] The acquisition unit is used to acquire text information of different types of users; the text information includes the functional scope, administrative level and number of employees of government users, the industry business scope, asset size and personnel size of enterprise users, and the occupation and skill attributes of individual users.

[0058] The conversion unit is used to process and convert the text information to obtain a numerical vector.

[0059] In this embodiment, the conversion unit processes and converts the text information to obtain a numerical vector, specifically as follows:

[0060] For text information, a word segmentation tool is used to segment the text, and the segmented word text is then transformed using a TF-TDF model to obtain numerical vectors. The word segmentation tool can be SnowNLP.

[0061] The calculation unit is used to divide the numerical vectors of different users based on scale feature words and attribute feature words, obtain the feature vectors corresponding to different users, and calculate the business similarity.

[0062] In this embodiment, the calculation unit divides the numerical vectors of different users based on scale feature words and attribute feature words to obtain feature vectors corresponding to different users, and calculates the business similarity, specifically as follows:

[0063] For a specific enterprise user of the same user type, all numerical vectors related to that enterprise user are distinguished according to business attribute terms and business scale terms. The business attribute terms select industry sector, business scope, and main products as attribute feature words; the business scale terms select number of customers, annual turnover, and number of employees as scale feature words. Furthermore, corresponding attribute feature words and scale feature words are defined for government users and individual users, respectively.

[0064] The numerical vectors corresponding to scale feature words and attribute feature words are weighted and summed according to a set ratio to obtain the feature vector representing the characteristics of the enterprise user. The feature vectors of government users or individual users can also be obtained in the same way. It should be noted that the above-mentioned ratio can be adjusted according to different types of users.

[0065] In this embodiment, taking enterprise users as an example: In the business scale entry, the weighting ratio for evaluating the influence of enterprise user scale based on "number of customers, annual turnover, and number of employees" can be set to 3:5:2. For the corresponding business attribute entries, "industry sector, business scope, and main products," the representative weighting ratio for business attributes can be set to "2:4:4."

[0066] During the weighted summation process, the ratio between business scale terms and business attribute terms can be 1:1 or other more suitable proportions, so the global allocation weight of the above feature terms is 1.5:2.5:1:1:2:2.

[0067] Calculate the cosine similarity between the feature vectors of any two users of the same type.

[0068] A creation unit is used to create independent subsets based on a preset threshold and the business similarity, and to set the access permissions, API interface call scope and normal operation behavior of each independent subset.

[0069] In this embodiment, the creation unit creates independent subsets based on a preset threshold and the business similarity, and sets the access permissions, API call scope, and normal operation behavior for each independent subset, specifically as follows:

[0070] When the cosine similarity is greater than a preset threshold, the two users are considered to have highly similar business operations. An independent subset is created, and the two users are placed in the same subset, thus ensuring that the business operations of users within each independent subset are highly similar. It should be noted that subsequent users need to be compared with the cosine similarity of their feature vectors to all users in that subset. When the cosine similarity of a subsequent user's feature vector is greater than the preset threshold, that user is added to that subset.

[0071] Each user type is categorized into multiple independent subsets, each with a unique identifier. The user classification module sets access permissions, API call scope, and normal operational behavior for each subset with a different identifier. The setting principles include: assigning different permissions to users within the same query form based on their user type, with government users > enterprise users > individual users. The API call scope is disclosed according to the user's business attributes, and the API interfaces differ between different independent subsets. Normal operational behavior is determined based on access permissions and the API call scope.

[0072] The determination unit is used to determine the behavioral baseline of each of the independent subsets based on the log file, and to dynamically update it.

[0073] In this embodiment, the determining unit determines the behavioral baseline of each independent subset based on the log file and updates it dynamically, specifically as follows:

[0074] Learn from the historical user behavior in each independent subset to obtain behavioral baselines such as the frequency and time period of normal logins, operation objects and behaviors, and corresponding traffic data of users with similar business attributes, and dynamically update the behavioral baselines of the above factors in the independent subset within a certain time period.

[0075] In this embodiment, the behavior baseline is a concentrated representation of user-related behavioral operation data with similar business attributes within a certain set time period. The behavior baseline reflects the data representativeness of the behavioral operations corresponding to this type of user.

[0076] For example, the time period can be set to one week or one month, depending on the amount of user behavior data. Within this time period, if the normal concentrated operation time for a certain type of user occurs between 9:00 AM and 12:00 PM, the baseline time for this behavior in the corresponding independent subset can be determined. After one week or one month, the occurrence time of this operation is studied for that month. If it is found that the concentrated operation time period has changed, such as changing to 2:00 PM to 5:00 PM, the baseline time for the behavior should be dynamically updated to avoid continued misjudgment of abnormal behavior.

[0077] In this embodiment, users with similar business attributes are placed in the same independent subset because if their business attributes are similar, the information and data content they involve must be similar, and their access behavior and operation behavior are highly similar. The only difference is in the frequency of the corresponding behavior and the size of the data operated, but this difference is not obvious. According to the user division process in the above independent subset, their business scale is also similar.

[0078] The behavioral baseline is a statistical analysis of the login, access, and operation behaviors of users with similar business attributes and scales within an independent subset. The relevant behaviors of all users are calculated at daily, weekly, and monthly time granularities to obtain data such as average behavior frequency, average duration, concentrated periods of behavior occurrence, and data traffic thresholds at different time granularities. The data constitutes the behavioral baseline.

[0079] In this embodiment, a fixed login frequency baseline is set from each independent subset. All independent subsets are traversed, and users whose login frequency is below the login frequency baseline in each independent subset are extracted to another independent subset and centrally managed. Users whose login frequency is below the login frequency baseline are defined as dormant users.

[0080] In this embodiment, the present invention obtains feature vectors representing users based on user business attributes and business scale, and uses cosine similarity to divide highly similar users into the same independent subset, thereby increasing the data volume of machine learning, while eliminating the need to set behavioral baselines for individual users and reducing the consumption of computing resources.

[0081] The log parsing module is used to parse the log files corresponding to each independent subset, obtain the data form, and associate each independent subset with the corresponding behavior baseline.

[0082] In this embodiment, the log parsing module specifically includes:

[0083] The parsing unit is used to parse the log files generated by user behavior in each of the independent subsets to obtain a data form of each key-value pair information.

[0084] The association unit is used to associate each of the independent subsets with the corresponding behavioral baseline. Specifically, by automatically associating data forms with the behavioral baseline, data comparison at different time granularities can be achieved.

[0085] The abnormal behavior judgment module is used to obtain the associated results, compare and judge them, and determine the abnormal behavior.

[0086] In this embodiment, the data form parsed by the log parsing module is obtained, the corresponding data form is matched and compared with the behavior baseline, and the comparison results are evaluated and judged to finally determine the abnormal behavior. Specifically:

[0087] Based on users within a specific subset, login behavior, access behavior, and operation behavior are compared and evaluated at different time granularities.

[0088] In login behavior, if the login frequency deviation rate at any time granularity is greater than a set value, the login frequency is considered abnormal. Specifically, the number of logins at the current time granularity is compared with the corresponding behavior baseline, and the login frequency deviation rate at that time granularity is obtained by setting |number of logins - average login frequency| / average login frequency.

[0089] If the number of abnormal login times at any time granularity exceeds the set value, the login time is considered abnormal. The concentrated period of login activity is considered the normal login period. For example, the normal login period is from 8:00 AM to 8:00 PM. If a login occurs at 10:00 PM or 4:00 AM, it is considered an abnormal login, and the number of abnormal login times at the corresponding time granularity is counted.

[0090] If a user successfully logs in multiple times from different devices within a specified time frame, it is considered an abnormal login sharing behavior. For example, if a user logs in from two different locations 1000 kilometers apart within a 30-minute period, meaning the IP address of the login behavior appears in different geographical locations within the specified time frame, and the spatial distance between the geographical locations exceeds the set distance, it is considered an abnormal login address.

[0091] In access and operation behaviors, any action exceeding authorized permissions is considered an unauthorized behavior. Within authorized permissions, short-term, high-frequency deletion and modification operations on the same data form are considered abnormal data operations. When the number of file data transfers or the file transfer size exceeds the behavioral baseline, it is considered an abnormal data migration.

[0092] In this embodiment, the abnormal behavior judgment module further includes a custom unit:

[0093] Users can build their own activity geographic center point location baseline. If a user's login IP address exceeds this location baseline, it is considered that the custom login address is abnormal.

[0094] When an individual user's activities are related to or involve an employment relationship with a corporate / government user, a baseline for related behavior is established between the corporate / government user and the individual user. If an individual user's behavior exceeds the scope of a corporate / government user's behavior, or if a particular individual user's behavior differs from that of other individual users within the corporate / government user group, it is considered an abnormal behavioral deviation.

[0095] In this embodiment, the login behavior of all dormant users is identified as abnormal activity behavior. Dormant users include normal users whose activity frequency is lower than a set value, users who have stopped using the service but have not been logged out, and users who have not used the service for a long time.

[0096] In this embodiment, by setting multiple scenarios for login behavior, access behavior, and operation behavior, comprehensive behavior detection of users is achieved. Meanwhile, the addition of a custom mode allows users to set matching behavior baselines based on their individual usage scenarios and work characteristics, making abnormal behavior detection more aligned with user needs.

[0097] The early warning processing module is used to acquire the abnormal behavior and perform early warning processing.

[0098] In this embodiment, the early warning processing module acquires the abnormal behavior and performs early warning processing, specifically as follows:

[0099] When abnormal login frequency and abnormal data migration show the same trend, the analysis determines that it is related to changes in business density. That is, increased business density leads to increased login frequency, increased data migration, and changes in working hours. This is recorded in the questionnaire and sent to the user. Otherwise, the corresponding alarm is sent directly to the user's emergency contact information. The user can choose to ignore the alarm or change the login information. Ignoring the alarm requires the user to manually ignore it; otherwise, user operations will be restricted.

[0100] When login sharing errors or login address errors occur, a corresponding alarm will be sent directly to the user's emergency contact information. The user can choose to ignore the alarm or change the login information.

[0101] For any unauthorized behavior, a counter is activated to count the number of occurrences at each time granularity. If the number of occurrences exceeds the set value at any time granularity, the user is locked and their privileges are automatically downgraded.

[0102] In case of abnormal data operation, the data form will be locked immediately and the corresponding alarm will be sent directly to the user's emergency contact information. The user can choose to ignore the alarm or change the login information.

[0103] For abnormal behavior of custom units, a corresponding alarm will be sent directly to the user's emergency contact information. In addition to ignoring the alarm or changing the login information, the user can also modify the custom content.

[0104] For abnormal behavior of dormant users, identity verification is required. If a dormant user is associated with an enterprise user or government user, the superior user needs to verify the user's identity simultaneously.

[0105] This invention also provides a method for early warning of abnormal behavior risks based on autonomous learning, such as... Figure 2 As shown, the method includes:

[0106] S1. Record user terminal behavior and behavior information in real time and generate log files.

[0107] In this embodiment, the log file is stored in the data storage module.

[0108] In this embodiment, the behaviors include login behavior, access behavior, and operation behavior. Access behavior can include page access, database access, etc.; operation behavior can include database operations, file transfers such as uploading and downloading, and API interface calls.

[0109] In this embodiment, the behavioral information includes the login status, IP address, operation behavior, number of operations, operation time, traffic volume, and behavioral object of the behavioral subject. The behavioral subject is a user with a unique UID; the behavioral object includes the content requested for querying and retrieving, the content of data operations, and the API interfaces invoked.

[0110] S2. Obtain text information of different types of users and calculate business similarity; create independent subsets based on the business similarity and set permissions; determine the behavioral baseline of each independent subset according to the log file.

[0111] In this embodiment, step S2 involves acquiring text information of different types of users and calculating business similarity, creating independent subsets based on the business similarity, and setting permissions; determining the behavioral baseline of each independent subset according to the log file, including the following steps:

[0112] Obtain text information from different types of users; the text information includes the functional scope, administrative level and number of employees of government users, the industry business scope, asset size and personnel size of enterprise users, and the occupation and skill attributes of individual users.

[0113] The text information is segmented using a word segmentation tool, and the segmented word text is then transformed into numerical vectors using a TF-TDF model. The word segmentation tool can be SnowNLP.

[0114] Based on scale feature words and attribute feature words, the numerical vectors of different users are divided. The numerical vectors corresponding to the scale feature words and attribute feature words are then weighted and summed according to a set ratio to obtain the feature vector representing the user's characteristics. The business similarity between any two user feature vectors is then calculated. The set ratio can be adjusted according to different types of users.

[0115] Based on the preset threshold and the business similarity, independent subsets are created, and the access permissions, API call scope and normal operation behavior of each independent subset are set.

[0116] In this embodiment, when the cosine similarity is greater than a preset threshold, the two users are considered to have highly similar business operations, and an independent subset is created, placing the two users in the same subset. Subsequent users are then compared with the cosine similarity of their feature vectors to all users in this subset. If the cosine similarity of a subsequent user's feature vector is greater than the preset threshold, that user is added to the subset.

[0117] Each user type is categorized into multiple independent subsets, each with a unique identifier. The user classification module sets access permissions, API call scope, and normal operational behavior for each subset with a different identifier. The setting principles include: assigning different permissions to users within the same query form based on their user type, with government users > enterprise users > individual users. The API call scope is disclosed according to the user's business attributes, and the API interfaces differ between different independent subsets. Normal operational behavior is determined based on access permissions and the API call scope.

[0118] Based on the log files, the behavioral baselines of each independent subset are determined and dynamically updated.

[0119] In this embodiment, the historical behavior of users in each independent subset is learned to obtain behavioral baselines such as the frequency and time period of normal login, operation objects and behaviors, and corresponding traffic data of users with similar business attributes. The behavioral baselines of the above factors in the independent subset are dynamically updated within a certain time period.

[0120] S3. Parse the log files corresponding to each independent subset to obtain a data form, and associate each independent subset with the corresponding behavior baseline.

[0121] In this embodiment, step S3 involves parsing the log files corresponding to each independent subset to obtain a data form, and associating each independent subset with its corresponding behavioral baseline, including the following steps:

[0122] The log files generated by user behavior in each of the independent subsets are parsed to obtain a data form of each key-value pair information;

[0123] Each of the independent subsets is associated with its corresponding behavioral baseline.

[0124] S4. Parse the log files corresponding to each independent subset to obtain a data form, and associate each independent subset with the corresponding behavior baseline.

[0125] In this embodiment, based on users within a certain independent subset, login behavior, access behavior, and operation behavior are compared and evaluated at different time granularities, specifically including:

[0126] In login behavior, if the login frequency deviation rate at any time granularity is greater than a set value, the login frequency is considered abnormal. Specifically, the number of logins at the current time granularity is compared with the corresponding behavior baseline, and the login frequency deviation rate at that time granularity is obtained by setting |number of logins - average login frequency| / average login frequency.

[0127] If the number of abnormal login times at any time granularity exceeds the set value, the login time is considered abnormal. Among them, the concentrated period of login behavior is the normal login period.

[0128] If a login attempt is successfully made multiple times on different devices within a specified time frame, it is considered an abnormal login sharing behavior.

[0129] In access and operation behaviors, any action exceeding authorized permissions is considered an unauthorized behavior. Within authorized permissions, short-term, high-frequency deletion and modification operations on the same data form are considered abnormal data operations. When the number of file data transfers or the file transfer size exceeds the behavioral baseline, it is considered an abnormal data migration.

[0130] In this embodiment, users can construct a baseline for the location range of their own activity's geographical center point. When a user's login IP address exceeds this baseline, it is considered that the custom login address is abnormal.

[0131] When an individual user's activities are related to or involve an employment relationship with a corporate / government user, a baseline for related behavior is established between the corporate / government user and the individual user. If an individual user's behavior exceeds the scope of a corporate / government user's behavior, or if a particular individual user's behavior differs from that of other individual users within the corporate / government user group, it is considered an abnormal behavioral deviation.

[0132] In this embodiment, the login behavior of all dormant users is identified as abnormal activity behavior. Dormant users include normal users whose activity frequency is lower than a set value, users who have stopped using the service but have not been logged out, and users who have not used the service for a long time.

[0133] S5. Obtain the abnormal behavior and perform early warning processing.

[0134] In this embodiment, the step of acquiring the abnormal behavior and performing early warning processing specifically includes:

[0135] When abnormal login frequency and abnormal data migration show the same trend, the analysis determines that it is related to changes in business density. That is, increased business density leads to increased login frequency, increased data migration, and changes in working hours. This is recorded in the questionnaire and sent to the user. Otherwise, the corresponding alarm is sent directly to the user's emergency contact information. The user can choose to ignore the alarm or change the login information. Ignoring the alarm requires the user to manually ignore it; otherwise, user operations will be restricted.

[0136] When login sharing errors or login address errors occur, a corresponding alarm will be sent directly to the user's emergency contact information. The user can choose to ignore the alarm or change the login information.

[0137] For any unauthorized behavior, a counter is activated to count the number of occurrences at each time granularity. If the number of occurrences exceeds the set value at any time granularity, the user is locked and their privileges are automatically downgraded.

[0138] In case of abnormal data operation, the data form will be locked immediately and the corresponding alarm will be sent directly to the user's emergency contact information. The user can choose to ignore the alarm or change the login information.

[0139] For abnormal behavior of custom units, a corresponding alarm will be sent directly to the user's emergency contact information. In addition to ignoring the alarm or changing the login information, the user can also modify the custom content.

[0140] For abnormal behavior of dormant users, identity verification is required. If a dormant user is associated with an enterprise user or government user, the superior user needs to verify the user's identity simultaneously.

[0141] like Figure 3 As shown, embodiments of the present invention also provide a device, including: a processor 301, the processor 301 being coupled to a memory 302, the processor 301 being used to read and execute a computer program stored in the memory 302, so as to implement an abnormal behavior risk warning method based on autonomous learning as described in the above method embodiments.

[0142] Embodiments of the present invention also provide a computer-readable storage medium storing a program or instructions that, when executed on a computer, cause the computer to perform an abnormal behavior risk warning method based on autonomous learning as described in the above method embodiments.

[0143] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An abnormal behavior risk early warning system based on autonomous learning, characterized in that, The system includes: The logging module is used to record user terminal behavior and behavior information in real time and generate log files; Data storage module, used to store the log files; The user classification module is used to obtain text information of different types of users and calculate business similarity, create independent subsets based on the business similarity and set permissions; and determine the behavioral baseline of each independent subset according to the log file. The user classification module specifically includes: The acquisition unit is used to acquire text information from different types of users; the text information includes the functional scope, administrative level and number of employees of government users, the industry business scope, asset size and personnel size of enterprise users, and the occupation and skill attributes of individual users. The conversion unit is used to process and convert the text information to obtain a numerical vector; The calculation unit is used to divide the numerical vectors of different users based on scale feature words and attribute feature words, perform weighted summation according to a set ratio to obtain the feature vectors corresponding to different users, and calculate the business similarity between any two user feature vectors; wherein, the set ratio includes the ratio between business scale terms and business attribute terms; A creation unit is used to create an independent subset based on a preset threshold and the business similarity. When the cosine similarity is greater than the preset threshold, the businesses of the two users are highly similar, and an independent subset is created, placing the two users in the same subset. The log parsing module is used to parse the log files corresponding to each of the independent subsets, obtain the data form, and associate each of the independent subsets with the corresponding behavior baseline; The abnormal behavior judgment module is used to obtain related results, compare and judge them, and determine abnormal behavior; The early warning processing module is used to acquire the abnormal behavior and perform early warning processing.

2. The system according to claim 1, characterized in that, The user classification module also includes: The creation unit is also used to set the access permissions, API interface call scope, and normal operation behavior of each of the independent subsets. The determination unit is used to determine the behavioral baseline of each of the independent subsets based on the log file, and to dynamically update it.

3. The system according to claim 1, characterized in that, The log parsing module specifically includes: The parsing unit is used to parse the log files generated by user behavior in each of the independent subsets to obtain a data form of each key-value pair information; The association unit is used to associate each of the independent subsets with the corresponding behavioral baseline.

4. A method for early warning of abnormal behavior risks based on autonomous learning, characterized in that, The method includes: Record user terminal behavior and behavior information in real time, and generate log files; Obtain text information from different types of users and calculate business similarity; create independent subsets based on the business similarity and set permissions; determine the behavioral baseline for each independent subset based on the log file, including... Acquire text information from different types of users; the text information includes the functional scope, administrative level and number of employees of government users, the industry business scope, asset size and personnel size of enterprise users, and the occupation and skill attributes of individual users. The text information is processed and transformed to obtain a numerical vector; Based on scale feature words and attribute feature words, the numerical vectors of different users are divided, and the weighted sums are performed according to a set ratio to obtain the feature vectors corresponding to different users. The business similarity between any two user feature vectors is calculated. The set ratio includes the ratio between business scale terms and business attribute terms. Based on a preset threshold and the business similarity, an independent subset is created. When the cosine similarity is greater than the preset threshold, the businesses of the two users are highly similar, and an independent subset is created, placing the two users in the same subset. The log files corresponding to each independent subset are parsed to obtain a data form, and each independent subset is associated with the corresponding behavioral baseline; Obtain the correlation results, compare and judge them to identify abnormal behavior; The abnormal behavior is detected and an early warning is issued.

5. The method according to claim 4, characterized in that, The log files are stored in the data storage module.

6. The method according to claim 4, characterized in that, The behaviors include login behavior, access behavior, and operation behavior; the behavior information includes the login status of the behavior subject, IP address, operation behavior, number of operations, operation time, traffic volume, and behavior object.

7. The method according to claim 4, characterized in that, The process involves acquiring text information from different types of users and calculating business similarity, then creating independent subsets based on the business similarity and setting permissions. Based on the log files, the behavioral baselines of each independent subset are determined, specifically including: The access permissions, API call scope, and normal operation behavior of each of the aforementioned independent subsets are set; Based on the log files, the behavioral baselines of each independent subset are determined and dynamically updated.

8. The method according to claim 4, characterized in that, The step of parsing the log files corresponding to each of the independent subsets to obtain data forms and associating each of the independent subsets with the corresponding behavioral baselines specifically includes: The log files generated by user behavior in each of the independent subsets are parsed to obtain a data form of each key-value pair information; Each of the independent subsets is associated with its corresponding behavioral baseline.

9. An electronic device, characterized in that, Includes a processor, which is coupled to a memory; The processor is used to read and execute the computer program stored in the memory to implement the abnormal behavior risk warning method based on autonomous learning as described in any one of claims 4-8.

10. A computer storage medium, characterized in that, The system stores a program or instructions that, when executed on a computer, cause the computer to perform an abnormal behavior risk warning method based on autonomous learning as described in any one of claims 4-8.

Images