Access anomaly analysis method and system based on multi-dimensional features and user behaviors

Abstract

The invention discloses an access anomaly analysis method and system based on multi-dimensional features and user behaviors, and relates to the technical field of dynamic access anomaly detection, and the method comprises the steps: based on a dynamic hypergraph structure, extracting high-order correlation features of the user behaviors through a multilayer hypergraph convolutional network, and generating a high-order feature matrix; based on the high-order feature matrix, generating an authority approval threshold through a causal reinforcement learning framework, constructing a user behavior causal graph to generate strategy network parameters, and storing the strategy network parameters to distributed nodes of a regional data center; based on strategy network parameters stored by distributed nodes, security multi-party computing is adopted, cross-node collaborative optimization is carried out, and global defense strategy parameters are generated through a security aggregation algorithm. According to the method, security multi-party computing is adopted, cross-node collaborative optimization is performed, and the global defense strategy parameters are generated in combination with homomorphic encryption and a block chain fragmentation technology, so that the collaboration efficiency and strategy consistency among distributed nodes are improved on the premise of ensuring data privacy.

Description

Technical Field

[0001] The present invention relates to the technical field of dynamic access anomaly detection, in particular to an access anomaly analysis method and system based on multi-dimensional features and user behavior. Background Art

[0002] With the accelerating progress of informatization and digitalization, access control and security protection in the cyber space have become the key links to ensure system security. Against the background of the wide application of emerging technologies such as cloud computing, big data, and the Internet of Things, traditional identity authentication mechanisms based on static rules or single features are difficult to cope with increasingly complex and hidden access anomaly behaviors. In recent years, security detection technologies centered on user behavior analysis have gradually become a research hotspot. Such methods collect and model multi-source heterogeneous data such as user operation logs, identity information, and device usage habits, and use statistical learning, machine learning, and even deep learning to identify potential anomaly behaviors, so as to achieve active defense.

[0003] However, the existing technologies still have significant deficiencies in dealing with high-order interaction relationships, cross-node collaboration, and dynamic environment adaptability. First, most existing solutions rely on traditional graph structures to model user behavior, which can only express binary relationships and are difficult to depict the complex high-order associations among users-devices-operations. Second, when most current systems perform policy collaborative optimization across distributed nodes, there is a lack of effective solutions that balance privacy protection mechanisms and computational efficiency. Summary of the Invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides an access anomaly analysis method based on multi-dimensional features and user behavior to solve the problems of difficult high-order relationship modeling and the difficulty in balancing privacy protection and efficiency in cross-node collaboration.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: In a first aspect, the present invention provides an access anomaly analysis method based on multi-dimensional features and user behavior, which includes obtaining user access behavior metadata, performing standardization processing, and constructing a dynamic hypergraph structure; Based on the dynamic hypergraph structure, extract the high-order correlation features of user behavior through a multi-layer hypergraph convolutional network to generate a high-order feature matrix; based on the high-order feature matrix, generate permission approval thresholds through a causal reinforcement learning framework, and construct a user behavior causal graph to generate policy network parameters through a time-series decay function, and store them in the distributed nodes of the regional data center; based on the policy network parameters stored in the distributed nodes, use secure multi-party computing and perform cross-node collaborative optimization to obtain the local parameter aggregation result, and generate global defense policy parameters through a secure aggregation algorithm; according to the global defense policy parameters, calculate the deviation between the user behavior features and the permission approval threshold in real time, and when the deviation exceeds the preset tolerance threshold, determine it as an abnormal access behavior.

[0007] As a preferred solution of the access anomaly analysis method based on multi-dimensional features and user behavior according to the present invention, wherein: the user access behavior metadata includes user identity features, device fingerprint features, operation type features, access behavior records, permission change logs, and device switching events; The device fingerprint feature includes a device type field.

[0008] As a preferred solution of the access anomaly analysis method based on multi-dimensional features and user behavior according to the present invention, wherein: the steps of obtaining the user access behavior metadata, performing standardization processing, and constructing a dynamic hypergraph structure are as follows. Encode the device type field into discrete numerical values, and perform Z-score normalization processing on the user identity features, device fingerprint features, and operation type features to generate a standardized feature vector; Based on the standardized feature vector, generate an initial hyperedge set according to the spatio-temporal correlation of the operation type features, and perform dynamic weight adjustment and abnormal node elimination through sliding time window statistics and outlier detection to construct a dynamic hypergraph structure.

[0009] As a preferred solution of the access anomaly analysis method based on multi-dimensional features and user behavior according to the present invention, wherein: the steps of extracting the high-order correlation features of user behavior through a multi-layer hypergraph convolutional network based on the dynamic hypergraph structure to generate a high-order feature matrix are as follows. Extract the standardized feature vectors of user nodes, device nodes, and operation nodes through the predefined node type identifiers in the dynamic hypergraph structure, and form an initial node feature matrix according to the node type; Input the initial node feature matrix into a multi-layer hypergraph convolutional network, and layer by layer extract the second-order correlation features of user behavior and the third-order correlation features of cross-device operations through the node-hyperedge feature propagation mechanism, and generate a multi-level cascade feature matrix; Horizontally splice the multi-level cascade feature matrix, and through weight fusion and non-linear activation function mapping, generate a high-order feature matrix that fuses spatio-temporal correlation.

[0010] As a preferred solution of the access anomaly analysis method based on multi-dimensional features and user behavior according to the present invention, wherein: based on the high-order feature matrix, a permission approval threshold is generated through a causal reinforcement learning framework, and a user behavior causal graph is constructed to generate policy network parameters through a time-series decay function and stored in the distributed nodes of the regional data center. The specific steps are as follows: Input the high-order feature matrix integrating spatio-temporal correlation into the causal reinforcement learning framework, and obtain the permission approval threshold through the time-series action value network; Establish three-dimensional topological nodes based on user nodes, device nodes and operation nodes, dynamically map the association strength between nodes by combining real-time risk level feature vectors and historical behavior security scores, verify the causal edge weights through Granger causality test, and construct and generate a user behavior causal graph; Perform tensor fusion on the causal edge weights in the user behavior causal graph and the normalized feature vectors of the nodes, and calculate the dynamic permission risk value through a time-series decay function; Input the dynamic permission evaluation parameters into the policy network parameter generator, update the causal graph node weights through the gradient backpropagation algorithm, and generate policy network parameters; After the policy network parameters are verified through consensus, they are stored in the distributed nodes of the regional data center in a blockchain sharding manner.

[0011] As a preferred solution of the access anomaly analysis method based on multi-dimensional features and user behavior according to the present invention, wherein: based on the policy network parameters stored in the distributed nodes, secure multi-party computing is used and cross-node collaborative optimization is performed to obtain the local parameter aggregation result, and the global defense policy parameters are generated through a secure aggregation algorithm. The specific steps are as follows: Based on the policy network parameters stored in the distributed nodes, secure multi-party computing is used and homomorphic encryption processing is performed to generate an encrypted parameter vector; Distribute the encrypted parameter vector to adjacent nodes through a cross-node communication protocol, and perform local parameter aggregation on the encrypted parameter vector based on the gradient residual correction algorithm; Perform weighted fusion on the local parameter aggregation result through a secure aggregation algorithm to generate global defense policy parameters, and store them in the distributed nodes in a blockchain sharding manner.

[0012] As a preferred solution of the access anomaly analysis method based on multi-dimensional features and user behavior according to the present invention, wherein: for access control according to the global defense policy parameters, the deviation amount between the user behavior characteristics and the permission approval threshold is calculated in real time. When the deviation amount exceeds the preset tolerance threshold, it is determined as an access anomaly behavior. The specific steps are as follows: Based on the global defense policy parameters stored in the distributed nodes, construct a basic policy matrix for access control; Parse the user access behavior metadata in real time according to the basic policy matrix to generate a dynamic feature vector; Compare the dynamic feature vector with the permission approval threshold dimension by dimension, and generate a dynamic deviation metric value through a linear weighted algorithm; When the dynamic deviation metric value exceeds the preset tolerance threshold, it is determined as an abnormal access behavior, and an access blocking instruction and a security warning log are executed.

[0013] In a second aspect, the present invention provides an access anomaly analysis system based on multi-dimensional features and user behavior, including a hypergraph construction module for obtaining user access behavior metadata, performing standardization processing, and constructing a dynamic hypergraph structure; a hypergraph convolution module for extracting high-order correlation features of user behavior based on the dynamic hypergraph structure through a multi-layer hypergraph convolution network to generate a high-order feature matrix; a causal policy module for generating a permission approval threshold based on the high-order feature matrix through a causal reinforcement learning framework, constructing a user behavior causal graph, generating policy network parameters through a time series decay function, and storing them in the distributed nodes of the regional data center; a security aggregation module for obtaining a local parameter aggregation result based on the policy network parameters stored in the distributed nodes, using secure multi-party computing and performing cross-node collaborative optimization, and generating global defense policy parameters through a security aggregation algorithm; an anomaly blocking module for performing access control according to the global defense policy parameters, calculating the deviation between the user behavior characteristics and the permission approval threshold in real time, and determining it as an abnormal access behavior when the deviation exceeds the preset tolerance.

[0014] In a third aspect, the present invention provides a computer device, including a memory and a processor, where the memory stores a computer program, and: when the computer program is executed by the processor, any step of the access anomaly analysis method based on multi-dimensional features and user behavior as described in the first aspect of the present invention is implemented.

[0015] In a fourth aspect, the present invention provides a computer-readable storage medium, on which a computer program is stored, and: when the computer program is executed by the processor, any step of the access anomaly analysis method based on multi-dimensional features and user behavior as described in the first aspect of the present invention is implemented.

[0016] The beneficial effects of the present invention are as follows: By constructing a dynamic hypergraph structure and using a multi-layer hypergraph convolution network to extract high-order correlation features of user behavior, in-depth modeling of the user-device-operation ternary relationship is realized, and the problem that traditional graph structures are difficult to express complex interaction relationships is solved, thereby improving the accuracy and robustness of access anomaly detection. Further, by using secure multi-party computing and performing cross-node collaborative optimization, combined with homomorphic encryption and blockchain sharding technology to generate global defense policy parameters, the collaboration efficiency and policy consistency between distributed nodes are improved on the premise of ensuring data privacy. Description of the Drawings

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings required in the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0018] Figure 1 It is a flowchart of an access anomaly analysis method based on multi-dimensional features and user behavior.

[0019] Figure 2 It is a flowchart of constructing a dynamic hypergraph structure for an access anomaly analysis method based on multi-dimensional features and user behavior.

[0020] Figure 3 It is a flowchart of extracting high-order correlation features for an access anomaly analysis method based on multi-dimensional features and user behavior.

[0021] Figure 4 It is a flowchart of generating global defense strategy parameters for an access anomaly analysis method based on multi-dimensional features and user behavior. Detailed implementation manners

[0022] To make the above objects, features, and advantages of the present invention more obvious and understandable, the following will make a detailed description of the specific implementation manners of the present invention with reference to the accompanying drawings of the specification.

[0023] In the following description, many specific details are set forth to fully understand the present invention. However, the present invention can also be implemented in other ways different from those described herein. Those skilled in the art can make similar generalizations without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0024] Secondly, the so-called "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that can be included in at least one implementation manner of the present invention. The "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that mutually excludes other embodiments.

[0025] Referring to Figures 1 to 4 , which is an embodiment of the present invention. This embodiment provides an access anomaly analysis method based on multi-dimensional features and user behavior, including the following steps: S1: Obtain user access behavior metadata, perform standardization processing, and construct a dynamic hypergraph structure.

[0026] S1.1: The user access behavior metadata includes user identity characteristics, device fingerprint characteristics, operation type characteristics, access behavior records, permission change logs, and device switching events.

[0027] It should be noted that the user access behavior metadata consists of user identity characteristics, device fingerprint characteristics, operation type characteristics, access behavior records, permission change logs, and device switching events. User identity characteristics include the user's unique identifier, role attributes, and organizational affiliation information, which are used to identify the subject's identity. Device fingerprint characteristics cover the device's hardware identification code, terminal type classification, and geographical coordinate information, and the uniqueness of the device is verified through the MAC address or IMEI. The operation type characteristics are represented by discrete codes to indicate specific behavioral actions, including operation classifications such as login, query, and modification. The access behavior records store the operation occurrence time, target resource identifier, and operation result status, with a timestamp accuracy reaching the millisecond level. The permission change logs record the permission application time point, approval status result, and expiration date, forming the trajectory of the permission life cycle. The device switching events include the device identifiers before and after the switch, the switching time interval, and the operation continuity marker, which are used to detect abnormal device change behaviors.

[0028] S1.2: The device fingerprint characteristics include a device type field.

[0029] It should be noted that the device fingerprint characteristics include a device type field, which is used to identify the hardware classification attributes of the terminal device. The device type field differentiates different types of devices such as mobile terminals, personal computers, and Internet of Things devices through a discrete coding scheme.

[0030] S1.3: Encode the device type field into discrete numerical values, and perform Z-score normalization on the user identity characteristics, device fingerprint characteristics, and operation type characteristics to generate a standardized feature vector.

[0031] The specific process includes that the device type field is converted into discrete numerical values through a predefined classification mapping table, the role attributes in the user identity characteristics are converted into ordered numerical values using the enumeration coding method, the hardware identification code in the device fingerprint characteristics is converted into a fixed-length digital sequence through a hash function, the behavioral actions in the operation type characteristics are divided into different numerical intervals according to the real-time risk level feature vector, and all feature values are processed through Z-score normalization. The mean and standard deviation of each feature dimension are analyzed, and the original feature value is subtracted by the mean and then divided by the standard deviation, so that features with different dimensions are comparable, and finally a standardized feature vector that conforms to the standard normal distribution is generated.

[0032] The real-time risk level feature vector is a quantitative evaluation index divided based on the potential impact degree of the operation type characteristics on data security and business continuity.

[0033] S1.4: Based on the standardized feature vectors, generate an initial hyperedge set according to the spatio-temporal correlation of operation type features, and perform dynamic weight adjustment and abnormal node elimination through sliding time window statistics and outlier detection to construct a dynamic hypergraph structure.

[0034] The specific process includes that the standardized feature vectors are aggregated into an initial hyperedge set for operation type features with similar spatio-temporal change patterns through hierarchical clustering based on the dynamic time warping distance. Operation type features with similar spatio-temporal patterns are grouped into the same initial hyperedge set; the sliding time window statistical method performs periodic analysis on the feature vectors within each initial hyperedge set to obtain the mean and variance of the feature vectors within the window period; analyze the Mahalanobis distance from each standardized feature vector to the center of the hyperedge set it belongs to, then fit the probability distribution of the distance values through the kernel density estimation method, and finally determine the feature vectors in the 5% area at the tail of the distribution as abnormal nodes and eliminate them. Feature vectors beyond the confidence interval are marked as abnormal nodes; the dynamic weight adjustment process redistributes the hyperedge weights according to the stability of the standardized feature vectors within the sliding time window, and the stability is evaluated by the change rate of the feature vectors in consecutive windows; after abnormal nodes are eliminated, the remaining feature vectors and the adjusted hyperedge weights together constitute the dynamic hypergraph structure. The nodes of the dynamic hypergraph structure represent operation entities, and the hyperedges represent sets of operation type features with spatio-temporal correlations.

[0035] The spatio-temporal correlation of operation type features is obtained by analyzing the Hadamard product of the dynamic time warping distance and the spatial correlation coefficient matrix of feature vectors within consecutive time windows.

[0036] The confidence interval is defined by calculating the Mahalanobis distance distribution of feature vectors within the hyperedge set and taking the 95% quantile as the threshold boundary.

[0037] S2: Based on the dynamic hypergraph structure, extract high-order correlation features of user behavior through a multi-layer hypergraph convolutional network to generate a high-order feature matrix.

[0038] S2.1: Extract the standardized feature vectors of user nodes, device nodes, and operation nodes through the predefined node type identifiers in the dynamic hypergraph structure, and form an initial node feature matrix according to the node types.

[0039] The specific process includes that the predefined node type identifiers in the dynamic hypergraph structure are used to distinguish user nodes, device nodes, and operation nodes. The standardized feature vectors of user nodes, device nodes, and operation nodes are retrieved from the dynamic hypergraph structure through the node type identifiers. The standardized feature vectors of user nodes are arranged as matrix rows according to the user node type, the standardized feature vectors of device nodes are arranged as matrix rows according to the device node type, and the standardized feature vectors of operation nodes are arranged as matrix rows according to the operation node type. Finally, an initial node feature matrix containing user node features, device node features, and operation node features is formed. The row dimension of the initial node feature matrix corresponds to the number of nodes, and the column dimension corresponds to the feature dimension of the standardized feature vectors.

[0040] The predefined node type identifiers are divided and mapped according to three types of entity attributes in the user access behavior metadata, namely user identity features, device fingerprint features, and operation type features.

[0041] S2.2: Input the initial node feature matrix into a multi-layer hypergraph convolutional network, and layer by layer extract the second-order association features of user behaviors and the third-order association features of cross-device operations through the node-hyperedge feature propagation mechanism, and generate a multi-level cascaded feature matrix.

[0042] The specific process includes inputting the initial node feature matrix into a multi-layer hypergraph convolutional network. In the first-layer analysis of the node-hyperedge feature propagation mechanism, the user node features and device node features are subjected to feature interaction through a shared hyperedge to extract the second-order association features between users and devices in user behaviors; in the second-layer analysis, the user-device association features output from the first layer and the operation node features are subjected to feature fusion through a cross-device hyperedge to extract the temporal correlation of operations performed by the user on different devices, forming the third-order association features of cross-device operations; after each layer of analysis, key association patterns are retained through nonlinear transformation and feature dimensionality reduction. Finally, the second-order association features and third-order association features output from each layer are concatenated according to the feature dimension, and the two matrices are connected side by side along the feature dimension to generate a fusion matrix. Each row in the fusion matrix corresponds to the complete feature vector of the same entity. The left half is the second-order association feature (user-device relationship pattern), and the right half is the third-order association feature (cross-device temporal pattern), and finally a multi-level cascaded feature matrix containing multi-level association information is generated.

[0043] S2.3: Horizontally splice the multi-level cascaded feature matrix, and through weight fusion and nonlinear activation function mapping, generate a high-order feature matrix that fuses spatio-temporal correlation.

[0044] The specific process includes horizontally splicing the second-order correlation feature matrix and the third-order correlation feature matrix in the multi-level cascade feature matrix along the feature dimension direction to form a spliced feature matrix with an extended dimension. The spliced feature matrix is subjected to feature dimension weighted fusion through a preset weight coefficient matrix. The weight coefficient matrix dynamically adjusts the contribution ratio of different correlation features according to feature importance. The weighted fused feature matrix is element-wise mapped through the ReLU non-linear activation function to retain positive features and suppress noise interference, and finally a high-order feature matrix containing both user-device association patterns and cross-device operation time series patterns is generated.

[0045] The preset weight coefficient matrix is initialized and dynamically adjusted according to the feature importance weights automatically learned by the backpropagation algorithm during the training process of the multi-level hypergraph convolutional network.

[0046] S3: Based on the high-order feature matrix, generate a permission approval threshold through a causal reinforcement learning framework, and construct a user behavior causal graph to generate policy network parameters through a time series decay function, and store them in the distributed nodes of the regional data center.

[0047] S3.1: Input the high-order feature matrix that fuses spatio-temporal correlation into the causal reinforcement learning framework, and obtain the permission approval threshold through the time series action value network.

[0048] The specific process includes that after inputting the high-order feature matrix that fuses spatio-temporal correlation into the causal reinforcement learning framework, the time series action value network performs time dimension slicing on the high-order feature matrix to extract the feature sub-matrices within each time window; the multi-head attention layer in the time series action value network analyzes the dependence relationship between the feature sub-matrices of different time windows to generate a time attention weight distribution; the gated recurrent unit network extracts the time series hidden state of the feature sub-matrix, and combines the attention mechanism to dynamically weight and fuse the features of different time steps, so as to capture the long-range dependence relationship of operation behaviors. In the output layer, the time series feature representation is compared and learned with the historical permission approval records, and the policy gradient is used to optimize the generation process of the permission approval threshold; the finally output permission approval threshold contains the dynamic safety boundary values corresponding to the features of different operation types.

[0049] The time series feature representation refers to a low-dimensional dense vector containing time dimension dependence relationships extracted from dynamic feature vectors through a gated recurrent unit network and an attention mechanism.

[0050] The long-range dependence relationship of operation behaviors represents causal or time series correlation across time intervals, such as: the permission change behavior that appears after a high-frequency operation triggers a threshold alarm with a delay, and the potential logical chain between periodic task scheduling and subsequent abnormal access.

[0051] S3.2: Establish a three-dimensional topological node based on user nodes, device nodes, and operation nodes. Combine the real-time risk level feature vector and the historical behavior safety score to dynamically map the association strength between nodes. Verify the causal edge weight through Granger causality test, and construct and generate a user behavior causal graph.

[0052] The specific process includes that user nodes, device nodes, and operation nodes constitute the three-dimensional topological node infrastructure. Based on the operation sequence of the current session, use statistical analysis methods and rule engines to extract numerical risk indicators from the original operation logs, forming a feature vector composed of multi-dimensional risk values. The weight ratio is dynamically adjusted according to operation sensitivity; Granger causality test analyzes the time series data from user nodes to operation nodes and from device nodes to operation nodes to verify the causal influence of the previous nodes on subsequent operations; the causal edge weight is generated after standardizing the statistic of the Granger causality test, and the numerical range is mapped to the interval from 0 to 1; the finally generated user behavior causal graph contains weighted causal edges and undirected association edges. The causal edges represent the operation-driven relationship verified by statistics, and the association edges reflect the comprehensive association strength of real-time risk and historical behavior.

[0053] S3.3: Perform tensor fusion on the causal edge weight in the user behavior causal graph and the standardized feature vector of the node, and calculate the dynamic permission risk value through a time series attenuation function. The expression is: ; where, represents the dynamic permission risk value, represents the index number of the user node, represents the index number of the device node, represents the index number of the operation node, represents the user node 's permission feature vector (including role level and historical behavior data), represents the potential energy value after non-linearly transforming the permission feature vector of the user node , represents the non-linear coupling operator, represents the device node 's security feature vector (including device operation status and historical exception records), represents the potential energy value after dynamically scoring the security feature vector of the device node , represents the operation node 's risk feature vector, represents the potential energy value after dynamically coupling the risk feature vector of the operation node , represents the variance of the risk gradient, represents the user node Through the device node Execute the operation node Degree of deviation from the real-time operation risk and the user device security baseline when Denote the time decay coefficient (0.01 ≤ ≤ 0.1), Denote the time variable, Denote time Absolute time difference from the most recent valid timestamp, Denote the indicator function, Denote the improved Granger causality statistic, Denote the Granger causality significance threshold (3.84 ≤ ≤ 6.63).

[0054] The specific process includes performing three-dimensional tensor fusion on the causal edge weights in the user behavior causal graph, the normalized eigenvectors of the user nodes, the normalized eigenvectors of the device nodes, and the normalized eigenvectors of the operation nodes. The normalized eigenvector of the user node includes the role level and historical behavior data. The normalized eigenvector of the device node includes the device operating state and historical exception records. The normalized eigenvector of the operation node includes the real-time risk level eigenvector.

[0055] Furthermore, the normalized eigenvector of the user node is converted into a permission potential value through a non-linear activation function, the normalized eigenvector of the device node is converted into a security potential value through a dynamic scoring function, and the normalized eigenvector of the operation node is converted into a risk potential value through a risk coupling function; the three potential values are subjected to a Hadamard product operation with the causal edge weights, and the real-time risk deviation is calculated by combining the risk gradient variance; the calculation result is weighted in the time dimension through a time series decay function, and the time decay coefficient of the time series decay function is controlled within the range of 0.01 to 0.1; the improved Granger causality statistic is used to verify the significance of the causal relationship between features, and the Granger causality significance threshold is set in the interval of 3.84 to 6.63; the finally generated dynamic permission evaluation parameter comprehensively reflects the real-time security state when the user node executes the operation node through the device node.

[0056] S3.4: Input the dynamic permission evaluation parameter into the policy network parameter generator, and update the causal graph node weights through the gradient backpropagation algorithm to generate the policy network parameters.

[0057] The specific process includes that after the dynamic permission evaluation parameters are input into the policy network parameter generator, the dynamic permission evaluation parameters are mapped into the feature representation in the policy gradient space through a fully connected layer; during the execution of the gradient backpropagation algorithm, the loss function of the node weights in the policy network output and the user behavior causal graph is analyzed, and the loss function comprehensively considers the permission evaluation error and the causal graph structure consistency constraint; during the backpropagation process, the chain rule of derivative calculation is used to update the weight parameters of the user node, device node, and operation node in the user behavior causal graph, and the weight update amount is adjusted according to the gradient direction of the dynamic permission evaluation parameters; in each iteration process, the causal edge weight update results that meet the Granger causality significance threshold are retained, and the weight changes that do not meet the significance requirements are discarded; the finally generated policy network parameters include the updated user node permission feature weights, device node security feature weights, and operation node real-time risk level feature weights.

[0058] The Granger causality significance threshold is the confidence critical value selected according to the chi-square distribution table and is set through the preset significance level in the hypothesis test.

[0059] S3.5: After the policy network parameters are verified through consensus, they are stored in the distributed nodes of the regional data center in the form of blockchain sharding.

[0060] The specific process includes that the policy network parameters are verified by multiple nodes through Byzantine fault-tolerant consensus. During the verification process, the hash values of the policy network parameters obtained by each distributed node are compared; after reaching a consensus, the policy network parameters are stored by region using blockchain sharding technology, and each distributed node in the regional data center only maintains the subset of the policy network parameters related to its shard; the cross-shard communication protocol in the blockchain sharding technology ensures that the policy network parameters of different shards are synchronized and updated; during the storage process, the policy network parameters are organized in a Merkle tree structure and redundantly backed up among the distributed nodes of the regional data center; finally, the policy network parameters are stored in a distributed and tamper-proof form on the nodes of multiple regional data centers, and the copies of the policy network parameters stored on each node maintain global consistency through the state root hash of the blockchain sharding technology.

[0061] S4: Based on the policy network parameters stored in the distributed nodes, secure multi-party computing is used for cross-node collaborative optimization to obtain the local parameter aggregation result, and the global defense policy parameters are generated through the secure aggregation algorithm.

[0062] S4.1: Based on the policy network parameters stored in the distributed nodes, secure multi-party computing is used and homomorphic encryption processing is performed to generate an encrypted parameter vector, and the expression is: ; Among them, represents the encrypted parameter vector, Represents the current level index of hierarchical aggregation, Represents the total number of levels of hierarchical aggregation, Represents the hierarchical secure aggregation operator, Represents the public key, Represents based on the public key of fully homomorphic encryption, Represents the total number of distributed nodes, Represents the index of the distributed node, Represents the basis function parameter of the Haar transform, Represents based on of the tree-shaped Haar transform operator, Represents the index number of the execution of the participating party, Represents the th secure multi-party computation protocol for participation in execution, Represents from the th set of encrypted policy network parameters extracted from the distributed node, Represents the Hadamard product, Represents the Gaussian noise distribution, Represents over time dynamically adjusted Gaussian noise variance, Represents the adaptive masked multiplication, Represents the adaptive privacy masking function, Represents the privacy budget parameter, Represents over time dynamically updated random seed.

[0063] The specific process includes that the policy network parameters stored in the distributed nodes are processed through the fully homomorphic encryption algorithm, and the public key is used to encrypt and transform the policy network parameters; the encrypted set of policy network parameters is input into the secure multi-party computation protocol, and the hierarchical secure aggregation operator is used to process layer by layer according to the hierarchical index during the calculation; feature extraction based on the tree-shaped Haar transform is performed during each layer of calculation, and the basis function parameter of the tree-shaped Haar transform controls the transformation granularity; the Hadamard product operation is used to fuse the encrypted policy network parameters of different distributed nodes; the Gaussian noise distribution function dynamically adjusts the noise variance parameter according to the time variable, and the noise injection process combines the adaptive privacy masking function to achieve differential privacy protection; the privacy budget parameter controls the amount of information leakage in each round of calculation, and the random seed is dynamically updated over time to ensure the unpredictability of the calculation; finally, the encrypted policy network parameters of each distributed node are integrated.

[0064] S4.2: Distribute the encrypted parameter vector to adjacent nodes through the cross-node communication protocol, and perform local parameter aggregation on the encrypted parameter vector based on the gradient residual correction algorithm.

[0065] The specific process includes that the encrypted parameter vector is distributed to adjacent nodes through the point-to-point transmission mechanism in the cross-node communication protocol, and the cross-node communication protocol adopts a data integrity guarantee mechanism based on Merkle tree verification to ensure the accurate vector transmission; the gradient residual correction algorithm identifies the parameter deviation direction by comparing the difference pattern of the Hadamard product of the received encrypted parameter vector and the locally stored vector; the encrypted parameter vector is locally adjusted through the residual compensation function, and the weight of the compensation function is dynamically constrained according to the privacy budget parameter; in the local parameter aggregation stage, a hierarchical secure aggregation operator is used to fuse the encrypted parameter vectors of adjacent nodes, and the aggregation process maintains the fully homomorphic encryption state; the finally generated aggregation result verifies the mathematical consistency with the original encrypted parameter vector through homomorphic hashing to ensure the verifiability of subsequent inter-node collaborative optimization.

[0066] S4.3: The local parameter aggregation results are weighted and fused through the secure aggregation algorithm to generate the global defense strategy parameters, which are stored in the distributed nodes through the blockchain sharding method. The expression is: ; Where represents the global defense strategy parameter vector generated in the -th round of aggregation, represents the time round index, represents the -th local policy parameter vector generated by the -th distributed node in the -th round of aggregation, represents the weight mapping function, represents the dynamic trusted weight value of the -th distributed node in the -th round of aggregation, represents the encrypted noise superposition operator, represents the privacy budget parameter, represents the time decay factor dynamically adjusted based on the aggregation round represents the -th local policy parameter vector generated by the -th distributed node in the ciphertext value after full homomorphic encryption, represents the -th dynamic trusted weight value of the -th distributed node in the weight characterization, represents the time decay factor dynamically adjusted based on the aggregation round differential privacy noise term.

[0067] The specific process includes, the The global defense strategy parameter vector generated by round aggregation fuses the local policy parameter vectors of each distributed node through a secure aggregation algorithm, and the time round index marks the current aggregation round; each distributed node The local policy parameter vector generated during the round of aggregation is processed by a weight mapping function, which generates a normalized weight based on the dynamic trust weight value of the th distributed node during the round of aggregation; the local policy parameter vector in the encrypted state is combined with the weight vector through Hadamard product operation, and Gaussian noise generated based on the privacy budget parameter and the time decay factor is injected through the encrypted state noise superposition operator; the privacy budget parameter restricts the noise injection intensity, and the time decay factor dynamically adjusts the noise decay rate with the aggregation round; the finally generated global defense strategy parameter vector is stored in the distributed node through blockchain sharding technology.

[0068] S5: Perform access control according to the global defense strategy parameters, calculate the deviation between the user behavior characteristics and the permission approval threshold in real time, and when the deviation exceeds the preset tolerance threshold, it is determined as an abnormal access behavior.

[0069] S5.1: Based on the global defense strategy parameters stored in the distributed node, construct a basic policy matrix for access control.

[0070] The specific process includes transforming the global defense strategy parameters stored in the distributed node through structured transformation to form a basic policy matrix for access control. The row and column structure of the basic policy matrix corresponds to the entity relationship in the access control scenario, with the row direction representing different access subjects and the column direction representing various resource access permissions. During the construction of the basic policy matrix, the feature pattern of the global defense strategy parameters is pattern-matched with the access control rule template, and the key decision features are retained. The basic policy matrix maps the original policy features to the standardized decision strength through non-linear transformation, and the value at each position in the matrix represents the authorization determination result of a specific access request. The finally generated basic policy matrix maintains logical consistency with the global defense strategy parameters and provides a structured determination basis for subsequent access control decisions.

[0071] S5.2: According to the basic policy matrix, parse the user access behavior metadata in real time to generate a dynamic feature vector.

[0072] The specific process includes that the basic policy matrix serves as the core reference for access control decisions, and it receives and parses the user access behavior metadata stream in real time; the user access behavior metadata contains structured fields such as request time, resource type, operation command, etc., and the structured fields are converted into numerical features through standardized encoding; in the process of generating the dynamic feature vector, the dot product operation is performed between the row vector of the basic policy matrix and the user access behavior features, and the result reflects the matching degree between the current behavior and the preset policy; at the same time, the temporal features in the user access behavior metadata are extracted, including the access frequency change rate and the operation interval periodicity, to form an auxiliary feature dimension; the column vector weights of the basic policy matrix dynamically adjust the contribution ratio of each feature dimension, and the feature dimension corresponding to sensitive operations automatically obtains a higher weight; the dimension of the finally generated dynamic feature vector is consistent with the basic policy matrix, and the vector element values comprehensively represent the projection intensity of the user access behavior on each policy dimension, providing a quantitative basis for subsequent real-time decisions.

[0073] S5.3: Compare the dynamic feature vector with the permission approval threshold dimension by dimension, and generate a dynamic deviation metric value through a linear weighted algorithm. The expression is: ; Among them, represents the dynamic deviation metric value, represents the feature dimension index, represents the index coding number of the feature dimension, represents the th dynamic normalization factor of the feature dimension, represents the th dynamic reference threshold of the feature dimension at time , represents the th dynamic normalization factor of the feature dimension at time , represents the static weight coefficient of the th feature dimension (1 < ≤ 1), represents the hyperbolic tangent function, represents the risk sensitivity coefficient (1.0 < ≤ 1.5), represents the real-time risk factor of the th dimension feature at time , represents the environmental suppression coefficient (0.3 < ≤ 0.7), represents the environmental interference coefficient of the th dimension feature at time .

[0074] The specific process includes that the calculation process of the dynamic deviation metric is based on the dimension-by-dimension comparison between the dynamic feature vector and the permission approval threshold, and a linear weighted algorithm is used to achieve quantitative evaluation. The dynamic deviation metric is obtained by summing after traversing all feature dimensions with the feature dimension index, and the feature dimension index is used to identify the number of the currently calculated feature dimension. The dynamic normalization factor of the th feature dimension is used to normalize the absolute deviation between the eigenvalue of the th feature dimension at a certain time and the dynamic reference threshold of the th feature dimension at the same time. The static weight coefficient of the th feature dimension is multiplied by the risk environment coupling term, and the risk environment coupling term adjusts the real-time risk factor of the th feature dimension at a certain time through the hyperbolic tangent function. The adjustment process takes into account the combined effect of the environment suppression coefficient and the environmental interference coefficient of the th feature dimension at a certain time. The risk sensitivity coefficient controls the sensitivity of the hyperbolic tangent function to the real-time risk factor, and the environment suppression coefficient adjusts the influence intensity of the environmental interference coefficient. The finally generated dynamic deviation metric comprehensively reflects the abnormality degree of each feature dimension at a certain time point. The larger the value, the higher the degree of deviation from the permission approval threshold.

[0075] S5.4: When the dynamic deviation metric exceeds the preset tolerance threshold, it is determined as an abnormal access behavior, and an access blocking instruction and a security warning log are executed.

[0076] The specific process includes that the dynamic deviation metric is compared with the preset tolerance threshold in real time. When the dynamic deviation metric exceeds the preset tolerance threshold, an abnormal determination mechanism is triggered; the abnormal access behavior determination is comprehensively evaluated based on the number of feature dimensions and the deviation amplitude of the dynamic deviation metric exceeding the threshold; after being determined as an abnormal access behavior, an access blocking instruction is immediately executed, and the access blocking instruction includes operations such as terminating the current session connection and revoking the temporary access token; at the same time, a security warning log is generated, and the security warning log records the abnormal behavior feature dimension, the dynamic deviation metric, the trigger timestamp, and the associated user identifier; the access blocking instruction is synchronized to all relevant service nodes through a distributed message queue, and the security warning log is written into the audit database and marked as a high-risk event; the whole process is completed within 500 milliseconds after the dynamic deviation metric exceeds the preset tolerance threshold to ensure real-time response.

[0077] The preset tolerance threshold is dynamically generated according to the statistical distribution of historical dynamic deviation metrics combined with real-time risk strategies, and is adjusted regularly through a sliding time window.

[0078] This embodiment also provides an access anomaly analysis system based on multi-dimensional features and user behavior, including: a hypergraph construction module, which is used to obtain user access behavior metadata, perform normalization processing, and construct a dynamic hypergraph structure; a hypergraph convolution module, which is used to extract high-order association features of user behavior based on the dynamic hypergraph structure through a multi-layer hypergraph convolution network to generate a high-order feature matrix; a causal policy module, which is used to generate a permission approval threshold based on the high-order feature matrix through a causal reinforcement learning framework, construct a user behavior causal graph, generate policy network parameters through a time-series decay function, and store them in the distributed nodes of the regional data center; a secure aggregation module, which is used to perform secure multi-party computing and cross-node collaborative optimization based on the policy network parameters stored in the distributed nodes, obtain the local parameter aggregation result, and generate global defense policy parameters through a secure aggregation algorithm; an anomaly blocking module, which is used to perform access control according to the global defense policy parameters, calculate the deviation between the user behavior characteristics and the permission approval threshold in real time, and determine it as an access anomaly behavior when the deviation exceeds the preset tolerance.

[0079] This embodiment also provides a computer device applicable to the case of an access anomaly analysis method based on multi-dimensional features and user behavior, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the access anomaly analysis method based on multi-dimensional features and user behavior proposed in the above embodiment.

[0080] The computer device can be a terminal. The computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a carrier network, NFC (Near Field Communication), or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, a trackball, or a touchpad provided on the housing of the computer device, or an external keyboard, touchpad, or mouse, etc.

[0081] This embodiment also provides a storage medium, on which a computer program is stored. When the program is executed by a processor, it implements the access anomaly analysis method based on multi-dimensional features and user behavior proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, abbreviated as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, abbreviated as EPROM), programmable read-only memory (Programmable Red-Only Memory, abbreviated as PROM), read-only memory (Read-Only Memory, abbreviated as ROM), magnetic memory, flash memory, magnetic disk or optical disc.

[0082] In summary, the present invention realizes in-depth modeling of the user-device-operation ternary relationship by constructing a dynamic hypergraph structure and using a multi-layer hypergraph convolutional network to extract high-order correlation features of user behavior, solves the problem that traditional graph structures are difficult to express complex interaction relationships, and thus improves the accuracy and robustness of access anomaly detection. Further, by adopting secure multi-party computing and performing cross-node collaborative optimization, and combining homomorphic encryption and blockchain sharding technology to generate global defense strategy parameters, the cooperation efficiency and strategy consistency among distributed nodes are improved while ensuring data privacy.

[0083] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and they should all be covered by the scope of the claims of the present invention.

Claims

1. An access anomaly analysis method based on multi-dimensional features and user behavior, characterized in that: Including, Obtain user access behavior metadata, perform normalization processing, and construct a dynamic hypergraph structure; Based on the dynamic hypergraph structure, extract high-order correlation features of user behavior through a multi-layer hypergraph convolutional network to generate a high-order feature matrix; Based on the high-order feature matrix, generate a permission approval threshold through a causal reinforcement learning framework, construct a user behavior causal graph, generate policy network parameters through a time-series decay function, and store them in the distributed nodes of the regional data center; Based on the policy network parameters stored in the distributed nodes, use secure multi-party computing and perform cross-node collaborative optimization to obtain the local parameter aggregation result, and generate global defense policy parameters through a secure aggregation algorithm; According to the global defense policy parameters, calculate the deviation between the user behavior characteristics and the permission approval threshold in real time. When the deviation exceeds the preset tolerance threshold, it is determined as an abnormal access behavior.

2. The access anomaly analysis method based on multi-dimensional features and user behavior according to claim 1, wherein: The user access behavior metadata includes user identity characteristics, device fingerprint characteristics, operation type characteristics, access behavior records, permission change logs, and device switching events; The device fingerprint characteristics include a device type field.

3. The access anomaly analysis method based on multi-dimensional features and user behavior according to claim 2, wherein: The steps of obtaining user access behavior metadata, performing normalization processing, and constructing a dynamic hypergraph structure are as follows. Encode the device type field into discrete numerical values, and perform Z-score normalization on the user identity characteristics, device fingerprint characteristics, and operation type characteristics to generate a standardized feature vector; Based on the standardized feature vector, generate an initial hyperedge set according to the spatio-temporal correlation of the operation type characteristics, and perform dynamic weight adjustment and abnormal node removal through a sliding time window statistic and outlier detection to construct a dynamic hypergraph structure.

4. The access anomaly analysis method based on multi-dimensional features and user behavior according to claim 3, wherein: The steps of extracting high-order correlation features of user behavior through a multi-layer hypergraph convolutional network based on the dynamic hypergraph structure to generate a high-order feature matrix are as follows. Extract the standardized feature vectors of user nodes, device nodes, and operation nodes through the predefined node type identifiers in the dynamic hypergraph structure, and form an initial node feature matrix according to the node type; Input the initial node feature matrix into the multi-layer hypergraph convolutional network, and layer by layer extract the second-order correlation features of user behavior and the third-order correlation features of cross-device operations through the node-hyperedge feature propagation mechanism to generate a multi-level cascade feature matrix; Horizontally splice the multi-level cascade feature matrix, and through weight fusion and non-linear activation function mapping, generate a high-order feature matrix that fuses spatio-temporal correlation.

5. The access anomaly analysis method based on multi-dimensional features and user behavior according to claim 4, characterized in that: The steps of generating a permission approval threshold through a causal reinforcement learning framework based on the high-order feature matrix, constructing a user behavior causal graph, generating policy network parameters through a time-series decay function, and storing them in the distributed nodes of the regional data center are as follows. Input the high-order feature matrix that fuses spatio-temporal correlation into the causal reinforcement learning framework, and obtain the permission approval threshold through the time-series action value network; Establish a three-dimensional topological node based on user nodes, device nodes, and operation nodes, combine the real-time risk level feature vector and the historical behavior security score to dynamically map the association strength between nodes, verify the causal edge weight through Granger causality test, and construct and generate a user behavior causal graph; Fuse the causal edge weights in the user behavior causal graph with the normalized eigenvectors of the nodes through tensor fusion, and calculate the dynamic permission risk value through a time-series decay function; Input the dynamic permission evaluation parameters into the policy network parameter generator, and update the causal graph node weights through the gradient backpropagation algorithm to generate policy network parameters; After the policy network parameters are verified by consensus, store them in the distributed nodes of the regional data center in the form of blockchain sharding.

6. The access anomaly analysis method based on multi-dimensional features and user behavior according to claim 5, characterized in that: For the policy network parameters stored based on distributed nodes, use secure multi-party computing and perform cross-node collaborative optimization to obtain the local parameter aggregation result, and generate the global defense policy parameters through the secure aggregation algorithm. The specific steps are as follows. Based on the policy network parameters stored in the distributed nodes, use secure multi-party computing and perform homomorphic encryption processing to generate an encrypted parameter vector; Distribute the encrypted parameter vector to adjacent nodes through the cross-node communication protocol, and perform local parameter aggregation on the encrypted parameter vector based on the gradient residual correction algorithm; Perform weighted fusion on the local parameter aggregation result through the secure aggregation algorithm to generate global defense policy parameters, and store them in the distributed nodes in the form of blockchain sharding.

7. The access anomaly analysis method based on multi-dimensional features and user behavior according to claim 6, characterized in that: For the access control based on the global defense policy parameters, calculate the deviation between the user behavior characteristics and the permission approval threshold in real time. When the deviation exceeds the preset tolerance threshold, it is determined as an abnormal access behavior. The specific steps are as follows. Based on the global defense policy parameters stored in the distributed nodes, construct the basic policy matrix for access control; According to the basic policy matrix, parse the user access behavior metadata in real time to generate a dynamic feature vector; Compare the dynamic feature vector with the permission approval threshold dimension by dimension, and generate a dynamic deviation metric value through the linear weighted algorithm; When the dynamic deviation metric value exceeds the preset tolerance threshold, it is determined as an abnormal access behavior, and the access blocking instruction and security warning log are executed.

8. An access anomaly analysis system based on multi-dimensional features and user behavior, based on the access anomaly analysis method based on multi-dimensional features and user behavior according to any one of claims 1 to 7, characterized in that: Including A hypergraph construction module, which is used to obtain user access behavior metadata, perform normalization processing, and construct a dynamic hypergraph structure; A hypergraph convolution module, which is used to extract the high-order correlation features of user behavior through a multi-layer hypergraph convolution network based on the dynamic hypergraph structure to generate a high-order feature matrix; A causal policy module, which is used to generate a permission approval threshold through a causal reinforcement learning framework based on the high-order feature matrix, construct a user behavior causal graph, generate policy network parameters through a time-series decay function, and store them in the distributed nodes of the regional data center; A secure aggregation module, which is used to perform secure multi-party computing and cross-node collaborative optimization based on the policy network parameters stored in the distributed nodes to obtain the local parameter aggregation result, and generate global defense policy parameters through the secure aggregation algorithm; An abnormal blocking module, which is used to perform access control according to the global defense policy parameters, calculate the deviation between the user behavior characteristics and the permission approval threshold in real time, and determine it as an abnormal access behavior when the deviation exceeds the preset tolerance.

9. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the access anomaly analysis method based on multi-dimensional features and user behavior according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the access anomaly analysis method based on multi-dimensional features and user behavior according to any one of claims 1 to 7.

Images