Cross-domain user abnormal behavior detection method and system based on self-information entropy

Abstract

The invention relates to a cross-domain user abnormal behavior detection method and system based on self-information entropy, specifically, user behavior data from at least two different network domains are collected, and the network domains comprise a telecommunication network, the Internet and / or the mobile Internet; processing the fused user behavior data, extracting multi-dimensional behavior features, and constructing a user behavior sequence; modeling the user behavior sequence by using a Markov model to capture a transition probability of a user behavior state; calculating a self-condition information entropy of each behavior in a user behavior sequence based on the Markov model; and judging whether the behavior of the user is abnormal or not according to the self-conditional information entropy obtained by calculation. The multi-source heterogeneous data can be effectively integrated, the accuracy and efficiency of abnormal behavior detection are improved, and the method has important application value.

Description

Technical Field

[0001] The present invention relates to the field of behavior detection, and specifically to a cross-network domain user abnormal behavior detection method and system based on self-information entropy. Background Art

[0002] With the rapid development of information technology, the telecommunications network, the Internet, and the mobile Internet (hereinafter referred to as the "three networks") have been deeply integrated into people's daily lives, and the behavioral data of users in these networks has shown explosive growth. These behavioral data not only reflect users' personal preferences and habits but also contain potential abnormal behavior patterns, such as fraud, account theft, malicious attacks, etc. Traditional abnormal user detection methods are usually limited to a single network domain. For example, only analyzing the call records of the telecommunications network or the browsing logs of the Internet makes it difficult to comprehensively depict users' behavioral characteristics, resulting in limited detection accuracy.

[0003] In recent years, cross-network domain user behavior analysis has gradually become a research hotspot. By integrating users' behavioral data from different network domains, a more comprehensive user portrait can be constructed, thereby improving the accuracy and efficiency of abnormal user detection. For example, by combining the call records of the telecommunications network, the browsing history of the Internet, and the usage of mobile Internet apps, abnormal users can be identified more accurately. However, cross-network domain user behavior analysis also faces many challenges: data heterogeneity, there are significant differences in the format, structure, and semantics of the behavioral data of users in the three networks, making it difficult to directly conduct fusion analysis; data sparsity, the behavioral data of a single user in the three networks may be very sparse, making it difficult to construct a complete user behavior sequence; the complexity of behavior patterns, the behavior patterns of users in the three networks are complex and changeable, and traditional abnormal detection algorithms are difficult to effectively identify. Summary of the Invention

[0004] In view of the problems of single data source and one-sided user portrait in the prior art, in the first aspect of the present invention, a cross-network domain user abnormal behavior detection method based on self-information entropy is provided, and the method includes:

[0005] Collect users' behavioral data from at least two different network domains, where the network domains include the telecommunications network, the Internet, and / or the mobile Internet.

[0006] Process the fused users' behavioral data, extract multi-dimensional behavioral characteristics, and construct a user behavior sequence.

[0007] Use a Markov model to model the user behavior sequence to capture the transition probability of the user behavior state.

[0008] Based on the Markov model, calculate the self-conditional information entropy of each behavior in the user behavior sequence.

[0009] Based on the calculated self - conditional information entropy, determine whether the user's behavior is abnormal.

[0010] Preferably, the user behavior data is collected from at least two different network domains, specifically:

[0011] Perform time - series alignment and anomaly cleaning on user behavior data from different sources.

[0012] Preferably, the step of extracting multi - dimensional behavior features includes extracting at least one of the following features: time - series features, context features, and cross - network - domain association features.

[0013] Preferably, the use of the Markov model to model the user behavior sequence is specifically as follows:

[0014] Construct a state transition matrix \(P = [p_{ij}]\), where \(p_{ij}\) ij represents the probability value of the transition from behavior \(i\) to behavior \(j\), ij where \(count(i\rightarrow j)\) represents the frequency of the transition from behavior \(i\) to behavior \(j\), and \(n\) is the number of user behaviors in the network space.

[0015]

[0016]

[0017] Preferably, the determination of whether the user's behavior is abnormal based on the calculated self - conditional information entropy is specifically as follows:

[0018] Calculate the self - conditional information entropy of each behavior \(X_i\) in the user behavior sequence t relative to its previous behavior \(X_{i - 1}\): t-1

[0019] \(I(X_i|X_{i - 1})=-p(X_i|X_{i - 1})\log p(X_i|X_{i - 1})\) t t-1 t t-1 t t-1

[0020]

[0021] Based on the user's specific time - series behavior chain, determine whether the user's behavior is abnormal through the change in conditional entropy.

[0021] In the second aspect of the present invention, a cross - network - domain user abnormal behavior detection system based on self - information entropy is provided. The system includes:

[0022] A data collection module for collecting user behavior data from at least two different network domains, where the network domains include a telecommunications network, the Internet, and / or a mobile Internet.

[0023] ​​​​​​The behavior sequence construction module is used to process the fused user behavior data, extract multi-dimensional behavior features, and construct a user behavior sequence.

[0024] The transition probability calculation module is used to model the user behavior sequence using a Markov model to capture the transition probability of the user behavior state.

[0025] The self-conditional information entropy calculation module is used to calculate the self-conditional information entropy of each behavior in the user behavior sequence based on the Markov model.

[0026] The abnormal behavior detection module is used to determine whether the user's behavior is abnormal according to the calculated self-conditional information entropy.

[0027] Preferably, the user behavior data is collected from at least two different network domains, specifically:

[0028] Perform time series alignment and abnormal cleaning on the user behavior data from different sources.

[0029] Preferably, the steps of extracting multi-dimensional behavior features include extracting at least one of the following features: time series features, context features, and cross-network domain association features.

[0030] Preferably, the modeling of the user behavior sequence using the Markov model is specifically as follows:

[0031] Construct a state transition matrix P = [p ij , where p ij represents the probability value of the transition from behavior i to behavior j,

[0032]

[0033] where count(i→j) represents the frequency of the transition from behavior i to behavior j, and n is the number of user behaviors in the network space.

[0034] Preferably, the determination of whether the user's behavior is abnormal according to the calculated self-conditional information entropy is specifically as follows:

[0035] Calculate the self-conditional information entropy of each behavior X t in the user behavior sequence relative to its previous behavior X t-1 :

[0036] I(X t |X t-1 ) = -p(X t |X t-1 ) log p(X t |X t-1 )

[0037] Based on the specific timing behavior chain of the user, it is determined whether the user behavior is abnormal through the change of conditional entropy.

[0038] Finally, the present invention also provides a computer-readable storage medium, on which a computer program is stored, and the computer program realizes the method described in the first aspect when executed by a processor.

[0039] The present invention breaks through the limitation of traditional methods confined to a single network domain, innovatively integrates the user behavior data of the three network domains of the telecommunications network, the Internet, and the mobile Internet, constructs a cross-network domain Markov behavior sequence, can more comprehensively and accurately depict the user behavior characteristics, and provides a richer information basis for abnormal user identification. In addition, using the Markov model to model the user behavior sequence can effectively capture the transition probability and dynamic change law of the user behavior state. Compared with traditional methods that only focus on static behavior characteristics, it can better reflect the essential characteristics of user behavior and improve the accuracy of abnormal user identification.

[0040] Furthermore, the present invention uses the self-information entropy model to quantify the abnormality degree of the user behavior sequence, can effectively measure the degree of deviation of the user behavior from the normal mode. Compared with the traditional method based on threshold judgment, the identification result is more accurate and reliable, reducing the false alarm rate and the missed alarm rate. Description of the Drawings

[0041] Figure 1 Is the flowchart of Embodiment 1;

[0042] Figure 2 Is the overall logic flowchart of the present invention;

[0043] Figure 3 Is the schematic diagram of the reference state and abnormal deviation;

[0044] Figure 4 Is Figure 3 The schematic diagram of the corresponding entropy change situation;

[0045] Figure 5 Is the structural diagram of Embodiment 2. Detailed Embodiments

[0046] In the embodiments of the present invention, words such as "exemplary" or "for example" are used to represent examples, illustrations or explanations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Exactly, using words such as "exemplary" or "for example" is intended to present relevant concepts in a specific way for easy understanding.

[0047] It will be understood that the "embodiments" referred to throughout the specification mean that specific features, structures, or characteristics related to the embodiments are included in at least one embodiment of the present application. Thus, the various embodiments referred to throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. It will be understood that in the various embodiments of the present application, the magnitude of the serial numbers of the various processes does not imply the order of execution, and the order of execution of the various processes should be determined by their functions and internal logics, and should not constitute any limitation to the implementation process of the embodiments of the present application.

[0048] In the present invention, unless otherwise specified, the same or similar parts between the various embodiments may be referred to each other. In the various embodiments of the present invention, and in each implementation manner / implementation method / realization method in each embodiment, if there is no special specification and logical conflict, the terms and / or descriptions between different embodiments, and between each implementation manner / implementation method / realization method in each embodiment are consistent and may be referred to each other. The technical features in different embodiments, and in each implementation manner / implementation method / realization method in each embodiment, may be combined according to their internal logical relationships to form new embodiments, implementation manners, implementation methods, or realization methods. The implementation manners of the present application described below do not constitute a limitation to the protection scope of the present application.

[0049] It should be noted that in each specific implementation manner of the present application, when it comes to relevant processing that needs to be carried out according to data related to the user's identity or characteristics, such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiments of the present application need to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained by means such as popping up a window or jumping to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for the normal operation of the embodiments of the present application will be obtained.

[0050] Figure 1 The first embodiment of the present invention is shown, as Figure 1 shown in the cross-network domain user abnormal behavior detection method based on self-information entropy, including:

[0051] S101, collecting user behavior data from at least two different network domains, where the network domains include a telecommunications network, the Internet, and / or a mobile Internet.

[0052] Collect user behavior data from different network domains, such as through data interface docking with different service providers, telecom operators, Internet service providers, APP developers, etc., or obtaining data through web crawlers, log analysis, etc. Traditional abnormal behavior detection may only focus on the behavior of users in a single network. However, the abnormal behavior of users often manifests as a linkage effect across multiple networks. The present invention integrates the behavior data from different networks to make a more comprehensive judgment. In one embodiment, the telecom network refers to the traditional telephone communication network, and the user behavior data of the telecom network includes but is not limited to the calling number, called number, call duration, call time, call type, base station location information, sending / receiving number, SMS content, sending / receiving time, traffic usage record, etc. The user behavior data of the Internet includes but is not limited to the website URL visited by the user, access time, stay duration, search keywords, purchased goods, order amount, payment method, delivery address, etc. The user behavior data of the mobile Internet includes but is not limited to the time, frequency of opening, closing, and using the APP, functions used, generated traffic, geographical location information, payment amount, payment time, payment object, payment method, etc.

[0053] S102. Process the fused user behavior data, extract multi-dimensional behavior features, and construct a user behavior sequence.

[0054] Due to different data formats and timestamps in the collected data, further process the data. Data processing includes but is not limited to time series alignment, anomaly cleaning, data conversion, etc. Extract multi-dimensional features from the processed data, including time series features, context features, cross-network domain association features, etc. Among them, the time series feature is the time statistics of the occurrence of behaviors. For example, within a specified time window, the frequency statistics of how many calls the user made, how many times the user switched the APP, how many websites the user visited, etc. The context feature includes the features composed of the behavior type, target object, and timestamp. The behavior type is such as a call, opening an APP, etc. The target object is the application type or contact person, etc., and the timestamp is the occurrence time. The cross-network domain association feature is the behavior sequence associated between different network domains. For example, "the user first switched the base station (mobile network), and then opened the payment APP (mobile Internet)", and the behaviors in this process constitute a specific event or pattern. Use hash coding to combine the features from different network domains into a unique state ID. For example, state S 25 represents that the user made a short call on the telecom network, accessed a bank website on the Internet, and the location on the mobile Internet deviated from the resident area. Represent the user's behavior as a series of state identifiers, such as S1, S2, S3, etc., and sorting them by time gives the user behavior sequence.

[0055] S103. Model the user behavior sequence using a Markov model to capture the transition probability of the user behavior state.

[0056] Modeling the user behavior sequence using a Markov model specifically includes:

[0057] Construct a state transition matrix P = [p ij , where p ij represents the probability value of the transition from behavior i to behavior j.

[0058]

[0059] Among them, count(i→j) represents the frequency of the transition from behavior i to behavior j, and n is the number of user behaviors in the cyberspace.

[0060] In one embodiment, S103 is for all users, that is, the transition probability matrix is obtained using the behaviors of all users.

[0061] S104. Based on the Markov model, calculate the self-conditional information entropy of each behavior in the user behavior sequence.

[0062] S105. According to the calculated self-conditional information entropy, determine whether the user's behavior is abnormal.

[0063] For each behavior in the user behavior sequence, find the probability of the transition from the previous behavior state to the current behavior state in the Markov model, and calculate the self-conditional information entropy using the above formula. If the probability of this transition is very low, then its self-conditional information entropy will be very high, indicating that this behavior is relatively unexpected compared to the previous behavior. After calculating the self-conditional information entropy of each behavior in the user behavior sequence, determine whether the user's behavior is abnormal according to the entropy value. In one embodiment, it is calculated in the way of a behavior anomaly function:

[0064]

[0065] Among them, T is the length of the behavior sequence. If the calculated MIC value of the behavior anomaly function is greater than or equal to the threshold δ, the user's behavior is an abnormal behavior or a suspected abnormal behavior.

[0066] The following further describes the present invention in conjunction with Figures 2 - 4 S201. Multi-source heterogeneous data collection and fusion. Perform time series alignment and anomaly cleaning on the XDR data obtained from the telecommunications network, the APP Internet access logs obtained from the mobile Internet, and the social media data obtained from the Internet.

[0067] S201. Multi-source heterogeneous data collection and fusion. Align the time series and clean the anomalies of the XDR data obtained from the telecommunications network, the APP Internet access logs obtained from the mobile Internet, and the social media data obtained from the Internet.

[0068] S202. Multi-dimensional behavior feature extraction. Temporal features - discretize the time axis into 5-minute windows and count the behavior frequencies within each window, such as the number of calls and the number of APP switches; Context features - construct a behavior context vector, such as [behavior type, target object, time slot], where "target object" can be encoded as a classification label, such as "social APP" and "financial website", etc.; Cross-domain association features - identify cross-domain behavior chains, such as "base station handover → open payment APP → access e-commerce website" as a composite event; Construct a state space - use hash encoding to map the feature combination to a unique state identifier.

[0069] S203. Cross-domain behavior sequence modeling. The behavior at the current moment is only related to the behavior at the past moment and satisfies

[0070] H(X T |X T-1 …X1) = H(X T |X T-1 )

[0071] Denote the state transition matrix as:

[0072]

[0073] where n is the number of user behaviors in the network space, and p ij represents the probability value of the transition from behavior i to behavior j, and p ij represents the frequency of the transition from behavior i to behavior j, which is calculated based on the historical behavior information of this user.

[0074] S204. Self-conditional information entropy calculation.

[0075] Definition 1. Let the random variables be X1, …, X T , and given the random variables X1, …, X T-1 , the conditional information entropy H(X T |X T …X1) of the uncertainty of the random variable X T-1 is defined as

[0076]

[0077] where the joint probability

[0078] H(X T |X T-1 …X1) physically means the uncertainty of the current behavior given the past behaviors. X T represents the behavior at the current moment.

[0079] S205. Calculate the behavior anomaly function. Since the lengths of the behavior chains of different users within a unit time are different, there will be a certain deviation in using a consistent metric function to quantify the anomaly of behaviors. Therefore, based on the specific time-series behavior chain of the user, design a behavior anomaly function V(X) through the conditional entropy index of the behavior changing over time to measure the behavior anomaly situation.

[0080]

[0081] Among them, T represents the time period, t represents the moment, and V(X) is the accumulation at each moment.

[0082] Users generally have fixed behavior patterns, relatively stable states, with a small degree of state deviation, and are regular, consistent, and unified. For example Figure 3 and 4 shown, when p ∈ [t - k, s], the individual behavior state is relatively stable and the entropy value is low; when p ∈ [s, t], the individual behavior shows deviation or anomaly, and the self-conditional entropy increases; when p ∈ [t, t + q], the individual behavior reaches a new stability and the self-conditional entropy decreases. Denote the threshold parameter as δ. When V(X) ≥ δ, the behavior of this user is a suspected abnormal behavior, otherwise it is a normal user behavior.

[0083] In addition, calculating the conditional entropy value of the system has a certain complexity and may cover up the original user behavior information. At the same time, since the behavior is a random variable, the computational complexity of the algorithm increases exponentially with each additional dimension. Therefore, design a conditional information function as the behavior anomaly function based on the conditional self-information I(Y|X) of the amount of information of the data itself:

[0084] [[ID=2l]]

[0085] Among them, the information entropy is defined as H(X1 = x1) = -p(x1)logp(x1). According to the properties of the Markov chain, it can be known that the self-conditional entropy satisfies H(x i |x i-1 ,..., x1) = -p(x i |x i-1 )logp(x i |x i-1 ).

[0086] Therefore, the metric function of the Markov chain self-conditional information entropy model (MIC) is defined as:

[0087]

[0088] S206. Establish a real-time feedback optimization mechanism. Based on the distributed message queue (Kafka), establish a real-time data pipeline to temporally align the marked results of detected suspicious abnormal behaviors with the manual review conclusions, and adjust and optimize the sliding window and threshold parameters of the behavior sequence according to the results.

[0089] Figure 5 The structural diagram of the second embodiment of the present invention is shown, as Figure 5 The cross-network domain user abnormal behavior detection system based on self-information entropy shown includes:

[0090] A data acquisition module, configured to acquire user behavior data from at least two different network domains, where the network domains include a telecommunications network, the Internet, and / or a mobile Internet.

[0091] A behavior sequence construction module, configured to process the fused user behavior data, extract multi-dimensional behavior features, and construct a user behavior sequence.

[0092] A transition probability calculation module, configured to model the user behavior sequence using a Markov model to capture the transition probability of the user behavior state.

[0093] A self-conditional information entropy calculation module, configured to calculate the self-conditional information entropy of each behavior in the user behavior sequence based on the Markov model.

[0094] An abnormal behavior detection module, configured to determine whether the user's behavior is abnormal according to the calculated self-conditional information entropy.

[0095] Preferably, the acquisition of user behavior data from at least two different network domains is specifically:

[0096] Perform temporal alignment and abnormal cleaning on user behavior data from different sources.

[0097] Preferably, the step of extracting multi-dimensional behavior features includes extracting at least one of the following features: temporal features, context features, and cross-network domain association features.

[0098] Preferably, the modeling of the user behavior sequence using a Markov model is specifically:

[0099] Construct a state transition matrix P = [p ij , where p ij represents the probability value of the transition from behavior i to behavior j,

[0100]

[0101] where count(i→j) represents the frequency of the transition from behavior i to behavior j, and n is the number of user behaviors in the network space.

[0102] Preferably, it is determined whether the user's behavior is abnormal according to the calculated self-conditional information entropy, specifically as follows:

[0103] Calculate the self-conditional information entropy of each behavior X in the user behavior sequence t relative to its previous behavior X t-1 :

[0104] I(X t |X t-1 ) = -logp(X t |X t-1 )

[0105] Based on the specific time-series behavior chain of the user, it is determined whether the user's behavior is abnormal through the change of conditional entropy.

[0106] The above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more integrated available media. The available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

[0107] The steps of the methods or algorithms described in the embodiments of the present application can be directly embedded in hardware, software units executed by a processor, or a combination of the two. The software units may be stored in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium in the art. Exemplarily, the storage medium may be connected to the processor so that the processor can read information from the storage medium and write information to the storage medium. Optionally, the storage medium may also be integrated into the processor. The processor and the storage medium may be provided in an ASIC.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are executed on the computer or other programmable apparatus to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one process or multiple processes and / or blocks Figure 1 one process or multiple processes and / or blocks Figure 1 or steps for implementing the functions specified in one block or multiple blocks.

[0109] Although the present application has been described in connection with specific features and their embodiments, it is obvious that various modifications and combinations can be made without departing from the spirit and scope of the present application. Accordingly, the present specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these changes and modifications.

Claims

1. A cross-network domain user abnormal behavior detection method based on self-information entropy, characterized in that The method includes: Collecting user behavior data from at least two different network domains, where the network domains include telecommunications networks, the Internet, and / or mobile Internet; Processing the fused user behavior data, extracting multi-dimensional behavior features, and constructing a user behavior sequence; Using a Markov model to model the user behavior sequence to capture the transition probability of user behavior states; Based on the Markov model, calculating the self-conditional information entropy of each behavior in the user behavior sequence; Judging whether the user's behavior is abnormal according to the calculated self-conditional information entropy.

2. The cross-network domain user abnormal behavior detection method according to claim 1, wherein The collecting of user behavior data from at least two different network domains is specifically: Performing time series alignment and abnormal cleaning on user behavior data from different sources.

3. The cross-network domain user abnormal behavior detection method according to claim 1, characterized in that The step of extracting multi-dimensional behavior features includes extracting at least one of the following features: Time series features, context features, and cross-network domain association features.

4. The cross-domain user abnormal behavior detection method according to claim 1, characterized in that The using of a Markov model to model the user behavior sequence is specifically: Construct the state transition matrix \(P = [p ij \), where \(p ij \) represents the probability value of the transition from behavior \(i\) to behavior \(j\). where count(i→j) represents the frequency of behavior i transitioning to behavior j, and n is the number of user behaviors in the network space.

5. The cross-domain user abnormal behavior detection method according to claim 1, characterized in that, The judging whether the user's behavior is abnormal according to the calculated self-conditional information entropy is specifically: Calculate each behavior X in the user behavior sequence t with respect to its previous behavior X t-1 of the self-conditional information entropy: I(X t |X t-1 ) = -p(X t |X t-1 ) log p(X t |X t-1 ) Based on the user's specific time series behavior chain, determining whether the user's behavior is abnormal through the change in conditional entropy.

6. A cross-network domain user abnormal behavior detection system based on self-information entropy, characterized in that, The system includes: A data collection module for collecting user behavior data from at least two different network domains, where the network domains include telecommunications networks, the Internet, and / or mobile Internet; A behavior sequence construction module for processing the fused user behavior data, extracting multi-dimensional behavior features, and constructing a user behavior sequence; A transition probability calculation module for using a Markov model to model the user behavior sequence to capture the transition probability of user behavior states; A self-conditional information entropy calculation module for calculating the self-conditional information entropy of each behavior in the user behavior sequence based on the Markov model; An abnormal behavior detection module for judging whether the user's behavior is abnormal according to the calculated self-conditional information entropy.

7. The cross-network domain user abnormal behavior detection system according to claim 6, wherein The collecting of user behavior data from at least two different network domains is specifically: Performing time series alignment and abnormal cleaning on user behavior data from different sources.

8. The cross-domain user abnormal behavior detection system according to claim 6, characterized in that, The step of extracting multi-dimensional behavior features includes extracting at least one of the following features: Time series features, context features, and cross-network domain association features.

9. The cross-network domain user abnormal behavior detection system according to claim 6, characterized in that The using of a Markov model to model the user behavior sequence is specifically: Construct the state transition matrix P = [p ij , where p ij represents the probability value of the transition from behavior i to behavior j. where count(i→j) represents the frequency of behavior i transitioning to behavior j, and n is the number of user behaviors in the network space.

10. The cross-network domain user abnormal behavior detection system according to claim 6, characterized in that, The judging whether the user's behavior is abnormal according to the calculated self-conditional information entropy is specifically: Calculate the self-conditional information entropy of each behavior X in the user behavior sequence t relative to its previous behavior X t-1 : I(X t |X t-1 ) = -p(X t |X t-1 ) log p(X t |X t-1 ) Based on the user's specific time series behavior chain, determining whether the user's behavior is abnormal through the change in conditional entropy.

Images