Customer data security management method of CRM platform

Abstract

The invention discloses a customer data security management method for a CRM platform, and belongs to the technical field of data security management, and the method specifically comprises the steps: collecting behavior data after a user logs in the platform, calculating the variation of operation types in adjacent periods, generating a feature sequence, and constructing a time-difference curve; comparing the curve similarities of different time periods to calibrate all the users lower than a preset threshold value as undetermined users; obtaining behavior data of any undetermined user in a past first time period and calculating an active score of the undetermined user; the method comprises the following steps: acquiring an active score Hg of an undetermined user in a past second time period, calculating an absolute value of a difference value between Hv and Hg, comparing the absolute value of the difference value between the active scores of the undetermined user in different time periods, and calibrating the undetermined user as an abnormal user if the absolute value of the difference value is greater than a preset threshold value. And the security of the database data is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and particularly relates to a method for managing the security of customer data in a CRM platform. Background Art

[0002] Security is of crucial importance to CRM system manufacturers and enterprises, as it is directly related to the enterprise's customer data, business secrets, and brand reputation. CRM systems usually store a large amount of sensitive information, including customer contact details, transaction records, and personal identity information. Once a data breach or security incident occurs, it may not only lead to the loss of customer trust, legal litigation, and economic losses, but also have a serious impact on the enterprise's market competitiveness and long-term development.

[0003] To ensure the integrity, quality of data in the business database, and the stable operation of the system, users with potential violations or abnormal operations are usually recorded in detail and monitored in real time. The system will track the execution frequency and usage of each operation in real time. By recording the usage times of these operations, it can help identify abnormal behavior patterns in a timely manner and prevent potential security risks caused by malicious operations or misoperations.

[0004] However, in actual operations, when the business load of the database fluctuates greatly, fixed thresholds may lead to misjudgments and missed judgments. For example, in some normal situations, the frequency or change value of an operation may temporarily exceed the set threshold and thus be misjudged as an abnormal operation, or some abnormal behaviors may be missed because the actual usage behavior does not reach the threshold. This will affect the security of the database. It may cause database administrators to be unable to take timely measures, thereby reducing the running security of the database and affecting the stability of the overall business system and the integrity of the data. Therefore, there is an urgent need for a more intelligent and dynamic anomaly detection mechanism to adapt to different business scenarios and changing operating conditions. Summary of the Invention

[0005] The purpose of the present invention is to provide a method for managing the security of customer data in a CRM platform, and solve the following technical problems:

[0006] However, in actual operations, when the business load of the database fluctuates greatly, fixed thresholds may lead to misjudgments and missed judgments. For example, in some normal situations, the frequency or change value of an operation may temporarily exceed the set threshold and thus be misjudged as an abnormal operation, or some abnormal behaviors may be missed because the actual usage behavior does not reach the threshold. This will affect the security of the database. It may cause database administrators to be unable to take timely measures, thereby reducing the running security of the database and affecting the stability of the overall business system and the integrity of the data. Therefore, there is an urgent need for a more intelligent and dynamic anomaly detection mechanism to adapt to different business scenarios and changing operating conditions.

[0007] The object of the present invention can be achieved by the following technical solutions:

[0008] A method for customer data security management of a CRM platform, characterized by comprising the following steps:

[0009] S1, collecting at intervals a number of behavior data of any user after logging in to the platform; calculating the usage change amount of any data operation type within adjacent collection periods according to the behavior data, obtaining all usage change amounts of data operation types and generating a feature sequence, calculating the difference degree between all adjacent feature sequences within the past second time period, and generating a second change curve C G (t) of the difference degree over time with time as the abscissa and the difference degree as the ordinate; the number of behavior data includes the usage times of each data operation behavior, the operation behaviors include indexing, downloading, updating, and deleting, and the past second time period is a preset monitoring period;

[0010] S2, obtaining the first change curve CV(t) of the corresponding difference degree over time of the user within the past first time period, calculating the similarity between the first change curve Cv(t) and the second change curve C G (t), if the similarity of any user is less than or equal to a preset similarity threshold, then marking this user as a pending user;

[0011] S3, obtaining the behavior data of any pending user within the past first time period and calculating the active score Hv of the pending user within the past first time period, obtaining the active score Hg of the pending user within the past second time period, calculating the absolute value of the difference between Hv and Hg, if the absolute value of the difference is less than or equal to a preset threshold, then marking this pending user as a normal user; if the absolute value of the difference is greater than the preset threshold, then marking this pending user as an abnormal user.

[0012] As a further solution of the present invention: in the S1, the specific calculation process of the difference degree is:

[0013]

[0014] where y p ,y r represent the current difference feature set p and the adjacent previous difference feature set r and their corresponding feature vectors respectively.

[0015] As a further solution of the present invention: in the S1, it also includes obtaining in real time the slope K between any adjacent difference points in the second change curve, if there is any slope K between adjacent difference points greater than or equal to a preset slope threshold, then the past second time period ends in advance, and obtaining the time length corresponding to the second change curve and using it as the reference duration of the past first time period.

[0016] As a further solution of the present invention: in S2, it further includes that if the similarity is greater than or equal to a preset threshold, then calculate according to the calculation formula respectively calculate the mean value VagF of the behavior data in the second past time period G and the mean value VagFv of the behavior data in the first past time period, calculate the difference between VagFv and VagF G , if the difference is greater than or equal to a preset difference threshold, then label this user as a pending user; if the difference is less than the preset difference threshold, then label this user as a normal user, where F is the amount of behavior data of this user in each collection cycle, and T is the length of the second past time period.

[0017] As a further solution of the present invention: the second past time period is composed of N collection cycles, the first past time period has the same time length as the second past time period and these two time periods are continuous in time, and on the time axis, the second past time period is on the left of the first past time period.

[0018] As a further solution of the present invention: in S2, the calculation process of the curve similarity is as follows:

[0019] Calculate the similarity between the change curves through the dynamic time warping algorithm, and the specific calculation process of the similarity is as follows:

[0020] Construct a similarity comparison matrix, and the similarity comparison matrix is:

[0021]

[0022] where, |C Vm - C Gm | is the difference distance value of the difference degree between the change curve Cv(t) and the change curve C G (t), construct a curve similarity function according to the distance matrix by using the dynamic time warping method, and the curve similarity function formula is:

[0023]

[0024] where, Ddtw(C V , C G ) is the shortest cumulative path distance of the distance matrix, and X is the similarity value between the change curve Cv(t) and the change curve C G (t).

[0025] As a further solution of the present invention: in S3, the specific calculation process of the activity score is as follows:

[0026] According to the calculation formula Calculate the initial activity score H'j of the j-th user within any time period, and then obtain the initial activity scores H' of all users. According to the calculation formula Calculate the activity scores of all users. Among them, Fj is the total amount of behavior data of the j-th user within any time period, n is the total number of users, Fi is the total amount of behavior data of the i-th user within this time period, μ is the average value of the initial activity scores of all users, and σ is the standard deviation of the initial activity scores of all users.

[0027] As a further solution of the present invention: in S3, it also includes adjusting the next past first time period of any normal user. The specific adjustment process is as follows:

[0028] Obtain the activity score of any collection period within the past first time period of this normal user. Taking time as the abscissa and activity score as the ordinate, generate a change curve H(t) of the activity score over time. Obtain the starting point, ending point, peak point, and valley point in the change curve H(t) as characteristic points, and calculate the slope k between adjacent characteristic points. According to the calculation formula Calculate the change score K according to the calculation formula Calculate the adjusted past first time period. Among them, ka is the slope between the a-th adjacent characteristic points, ha represents the time length between the a-th adjacent characteristic points, T is the time length of the past second time period, Q is the number of characteristic points in the curve, and K 标 Is a preset change coefficient threshold, and β is a preset correction coefficient.

[0029] The beneficial effects of the present invention:

[0030] The present invention first calculates the change amount of user operation behavior data in the first time period (recent) and the second time period (history) in the past, and generates the time change curves Cv(t) and CG(t), which can dynamically capture the mutation of user behavior. For example, if the user's operation habit suddenly changes, such as frequently attempting sensitive operations, then the similarity of the difference degree curves before and after the user will significantly decrease, indicating that the user may have abnormal operation behavior. Considering that there may be long-term and short-term abnormalities in users, simply comparing the similarity of the difference degree curves may ignore the situation of long-term abnormalities, that is, if the user suddenly becomes abnormal and continues to be abnormal, the difference degree between adjacent abnormalities may also be similar to the operation behavior before, that is, the change amount of the user's operation behavior may be generally consistent with the change amount of the user operation behavior data in the second time period. Therefore, in the present invention, through the slope K between any two adjacent difference points in the first change curve, if the slope K is greater than or equal to the preset slope threshold, the user is marked as a pending user. It can be understood that when the change amount of the user's operation behavior suddenly fluctuates greatly (the slope K is large), it may mean that the user's behavior has long-term abnormalities, so as to identify all pending users and only conduct in-depth analysis on the initially suspicious users, significantly reducing the consumption of computing resources. It can be understood that in the actual application scenario, the user's operation behavior is affected by various factors, such as seasonal changes, promotional activities, system updates, etc. For example, during the major e-commerce promotion period, the user's purchase behavior will significantly increase, so the operation behavior of the salesman will also change greatly. Therefore, the present invention determines abnormal users by considering the overall activity score of all business users. It can be understood that based on the overall activity score, the behavior distribution of the user in the entire business user group can be reflected, and when the external environment changes, it will not overly affect the group distribution of business users. Therefore, if the difference in the activity scores of the pending users is greater than the preset threshold, it indicates that the user has abnormal conditions. The present invention realizes the abnormal identification of database access personnel and improves the security of database data. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The present invention will be further described below with reference to the accompanying drawings.

[0032] Figure 1 It is a schematic flow chart of a method for managing customer data security in a CRM platform of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0033] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0034] Please refer to Figure 1 As shown, the present invention is a method for customer data security management of a CRM platform, including the following steps:

[0035] S1, periodically collect a number of behavior data of any user after logging in to the platform; calculate the usage change amount of any data operation type in adjacent collection periods according to the behavior data, obtain the usage change amounts of all data operation types and generate a feature sequence, calculate the difference degree between all adjacent feature sequences in the past second time period, and generate a second change curve C G (t) with time as the abscissa and the difference degree as the ordinate; the number of behavior data includes the usage times of each data operation behavior, the operation behaviors include indexing, downloading, updating and deleting, and the past second time period is a preset monitoring period;

[0036] S2, obtain the first change curve CV(t) of the difference degree with time of the user in the past first time period, calculate the similarity between the first change curve Cv(t) and the second change curve C G (t), if the similarity of any user is less than or equal to a preset similarity threshold, then label this user as a pending user;

[0037] S3, obtain the behavior data of any pending user in the past first time period and calculate the active score Hv of the pending user in the past first time period, obtain the active score Hg of the pending user in the past second time period, calculate the absolute value of the difference between Hv and Hg, if the absolute value of the difference is less than or equal to a preset threshold, then label this pending user as a normal user; if the absolute value of the difference is greater than the preset threshold, then label this pending user as an abnormal user.

[0038] The present invention first calculates the change amount of the user operation behavior data in the first time period (recent) and the second time period (history) in the past, and generates the time change curves Cv(t) and CG(t), which can dynamically capture the mutation of the user behavior. For example, if the user's operation habit suddenly changes, such as frequently attempting sensitive operations, then the similarity of the difference degree curves before and after the user will significantly decrease, indicating that the user may have abnormal operation behavior. Considering that there may be long-term and short-term abnormalities for the user, simply comparing the similarity of the difference degree curves may ignore the situation of long-term abnormalities, that is, if the user suddenly becomes abnormal and continuously maintains the abnormality, the difference degree between adjacent abnormalities may also be similar to the operation behavior before, that is, the change amount of the user's operation behavior may be generally consistent with the change amount of the user operation behavior data in the second time period. Therefore, in the present invention, through the slope K between any two adjacent difference points in the first change curve, if the slope K is greater than or equal to the preset slope threshold, then the user is marked as a pending user. It can be understood that when the change amount of the user's operation behavior suddenly fluctuates greatly (the slope K is large), it may mean that the user's behavior has long-term abnormalities, so as to identify all pending users, and only conduct in-depth analysis on the initially suspicious users, significantly reducing the consumption of computing resources. It can be understood that in the actual application scenario, the user operation behavior is affected by various factors, such as seasonal changes, promotional activities, system updates, etc. For example, during the large e-commerce promotion period, the user's purchase behavior will significantly increase, so the operation behavior of the salesman will also change greatly. Therefore, the present invention determines the abnormal users by considering the overall activity scores of all business users. It can be understood that based on the overall activity score, the behavior distribution of the user in the entire business user group can be reflected, and when the external environment changes, it will not overly affect the group distribution of the business users. Therefore, if the difference value of the activity scores of the pending users is greater than the preset threshold, it indicates that the user has abnormal conditions. The present invention realizes the abnormal identification of database access personnel and improves the security of database data.

[0039] In a preferred embodiment of the present invention, the several behavior data include the usage times of each data operation behavior, and the operation behaviors include indexing, downloading, updating, and deleting.

[0040] In another preferred embodiment of the present invention, in S1, the specific calculation process of the difference degree is as follows:

[0041]

[0042] where y p , y r respectively represent the current difference feature set p and the adjacent previous difference feature set r and the corresponding feature vectors.

[0043] In another preferred embodiment of the present invention, in S1, it further includes obtaining in real time the slope K between any adjacent difference points in the second change curve. If there exists a slope K between any adjacent difference points that is greater than or equal to a preset slope threshold, the past second time period ends prematurely, and the time length corresponding to the second change curve is obtained and used as the reference duration of the past first time period.

[0044] In another preferred embodiment of the present invention, in S2, it further includes that if the similarity is greater than or equal to a preset threshold, then calculate according to the calculation formula Calculate the mean value VagF of the behavior data within the past second time period respectively G and the mean value VagFv of the behavior data within the past first time period, calculate the difference between VagFv and VagF G If the difference is greater than or equal to a preset difference threshold, then label this user as a pending user; if the difference is less than the preset difference threshold, then label this user as a normal user, where F is the amount of behavior data of this user in each collection cycle, and T is the length of the past second time period.

[0045] In another preferred embodiment of the present invention, the past second time period is composed of N collection cycles. The past first time period has the same time length as the past second time period and these two time periods are continuous in time. On the time axis, the past second time period is on the left of the past first time period.

[0046] In another preferred embodiment of the present invention, in S2, the calculation process of the curve similarity is as follows:

[0047] Calculate the similarity between the change curves through the dynamic time warping algorithm. The specific calculation process of the similarity is as follows:

[0048] Construct a similarity comparison matrix, and the similarity comparison matrix is:

[0049]

[0050] where |CVm - CGm| is the difference distance value of the difference degree between the change curve Cv(t) and the change curve CG(t). According to the distance matrix, use the dynamic time warping method to construct a curve similarity function. The curve similarity function formula is:

[0051]

[0052] where Ddtw(CV, CG) is the shortest cumulative path distance of the distance matrix, and X is the similarity value between the change curve Cv(t) and the change curve CG(t).

[0053] In another preferred embodiment of the present invention, in S3, the specific calculation process of the activity score is as follows:

[0054] According to the calculation formula The initial activity score H'j of the j-th user within any time period is calculated, and then the initial activity scores H' of all users are obtained. According to the calculation formula The activity scores of all users are calculated, where Fj is the total amount of behavior data of the j-th user within any time period, n is the total number of users, Fi is the total amount of behavior data of the i-th user within this time period, μ is the average value of the initial activity scores of all users, and σ is the standard deviation of the initial activity scores of all users.

[0055] In another preferred embodiment of the present invention, in S3, it further includes adjusting the next first past time period of any normal user. The specific adjustment process is as follows:

[0056] Obtain the activity score of any collection period within the first past time period of this normal user. Taking time as the abscissa and the activity score as the ordinate, generate a change curve H(t) of the activity score over time. Obtain the starting point, ending point, peak point, and valley point in the change curve H(t) as characteristic points, calculate the slope k between adjacent characteristic points. According to the calculation formula Calculate the change score K. According to the calculation formula Calculate the adjusted first past time period, where ka is the slope between the a-th adjacent characteristic points, ha represents the time length between the a-th adjacent characteristic points, T is the time length of the second past time period, Q is the number of characteristic points in the curve, and K 标 is a preset change coefficient threshold, and β is a preset correction coefficient.

[0057] The above has described a detailed description of an embodiment of the present invention, but the content described is only a preferred embodiment of the present invention and cannot be considered as limiting the scope of implementation of the present invention. Any equivalent changes and improvements made within the scope of the application of the present invention shall still fall within the scope covered by the patent of the present invention.

Claims

1. A method for customer data security management of a CRM platform, characterized in that, It includes the following steps: S1, Collect a number of behavioral data of any user after logging in to the platform at intervals; calculate the usage change amount of any data operation type within adjacent collection periods based on the behavioral data, obtain the usage change amounts of all data operation types and generate a feature sequence, calculate the difference degree between all adjacent feature sequences within the second past time period, and generate a second change curve C of the difference degree over time with time as the abscissa and the difference degree as the ordinate; G (t); The number of behavioral data includes the usage times of each data operation behavior, the operation behaviors include indexing, downloading, updating, and deleting, and the second past time period is a preset monitoring period; S2, obtain the first change curve CV(t) of the corresponding difference degree over time for the user in the past period, and calculate the similarity between the first change curve Cv(t) and the second change curve C G (t). If the similarity of any user is less than or equal to the preset similarity threshold, then label this user as a pending user; S3. Obtain the behavior data of any user to be determined in the first past time period and calculate the activity score Hv of the user to be determined in the first past time period. Obtain the activity score Hg of the user to be determined in the second past time period. Calculate the absolute value of the difference between Hv and Hg. If the absolute value of the difference is less than or equal to the preset threshold, label the user to be determined as a normal user; if the absolute value of the difference is greater than the preset threshold, label the user to be determined as an abnormal user.

2. The customer data security management method of a CRM platform according to claim 1, characterized in that In the above S1, the specific calculation process of the difference degree is as follows: Among them, y p , y r respectively represent the current difference feature set p, the adjacent previous difference feature set r, and the corresponding feature vectors.

3. A method for customer data security management of a CRM platform according to claim 1, characterized in that, In the above S1, it also includes obtaining the slope K between any adjacent difference points in the second change curve in real time. If there is a slope K between any adjacent difference points that is greater than or equal to the preset slope threshold, the second past time period ends in advance, and obtain the time length corresponding to the second change curve and use it as the reference duration of the first past time period.

4. A method for customer data security management of a CRM platform according to claim 2, characterized in that, In S2, it further includes that if the similarity is greater than or equal to a preset threshold, then calculate according to the calculation formula respectively calculate the mean value VagF of the behavior data in the second past time period G and the mean value VagFv of the behavior data in the first past time period, calculate the difference between VagFv and VagF G If the difference is greater than or equal to a preset difference threshold, then label this user as a pending user; If the difference is less than the preset difference threshold, label the user as a normal user, where F is the amount of behavior data of the user in each collection period, and T is the length of the second past time period.

5. A method for managing the security of customer data in a CRM platform according to claim 4, characterized in that, The second past time period is composed of N collection periods. The first past time period and the second past time period have the same time length and are continuous in time. On the time axis, the second past time period is on the left of the first past time period.

6. The customer data security management method of a CRM platform according to claim 1, wherein, In the above S2, the calculation process of the curve similarity is as follows: Calculate the similarity between the change curves through the dynamic time warping algorithm. The specific calculation process of the similarity is as follows: Construct a similarity comparison matrix, and the similarity comparison matrix is: Among them, |C Vm -C Gm | is the difference distance value of the difference degree between the change curve Cv(t) and the change curve C G (t). A curve similarity function is constructed by using the dynamic time warping method according to the distance matrix. The formula of the curve similarity function is as follows: where Ddtw(C V , C G ) is the shortest cumulative path distance of the distance matrix, and X is the similarity value between the change curve Cv(t) and the change curve C G (t).

7. A method for customer data security management of a CRM platform according to claim 1, characterized in that, In the above S3, the specific calculation process of the activity score is as follows: According to the calculation formula The initial activity score H'j of the j-th user within any time period is calculated, and then the initial activity scores H' of all users are obtained. According to the calculation formula The activity scores of all users are calculated, where Fj is the total amount of behavior data of the j-th user within any time period, n is the total number of users, Fi is the total amount of behavior data of the i-th user within this time period, μ is the mean value of the initial activity scores of all users, and σ is the standard deviation of the initial activity scores of all users.

8. A method for customer data security management of a CRM platform according to claim 3, characterized in that, In the above S3, it also includes adjusting the next first past time period of any normal user. The specific adjustment process is as follows: Obtain the active score of the normal user within any collection period in the first past time period. Taking time as the abscissa and the active score as the ordinate, generate the change curve H(t) of the active score over time. Obtain the starting point, ending point, peak point, and valley point in the change curve H(t) and use them as characteristic points. Calculate the slope k between adjacent characteristic points. According to the calculation formula Calculate the change score K. According to the calculation formula Calculate the adjusted first past time period, where ka is the slope between the a-th adjacent characteristic points, ha represents the time length between the a-th adjacent characteristic points, T is the time length of the second past time period, Q is the number of characteristic points in the curve, and K 标 is a preset change coefficient threshold, and β is a preset correction coefficient.

Images