User behavior anomaly detection method and device, terminal equipment and storage medium

Abstract

The embodiment of the invention discloses a user behavior anomaly detection method and device, terminal equipment and a storage medium. According to the scheme, the multi-dimensional operation data of the user on the front-end page can be collected in real time, the multi-dimensional operation data is preprocessed, the feature vector of the preprocessed multi-dimensional operation data is extracted based on the graph neural network, the dynamic behavior model is constructed, the feature vector is input into the dynamic behavior model, and the abnormal score of the multi-dimensional operation data is output. And if the abnormal score exceeds a preset score threshold, feeding back the multi-dimensional operation data. According to the scheme provided by the embodiment of the invention, the multi-dimensional operation data of the user can be analyzed, and the abnormal score of the multi-dimensional operation data is calculated by constructing the dynamic behavior model, so that the abnormal behavior is quickly identified, and the user behavior identification efficiency is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, terminal device, and storage medium for detecting abnormalities in user behavior. Background Art

[0002] With the rapid development of internet technology, front-end applications have become the core entry point for users to interact with digital services. Traditional front-end monitoring technologies primarily focus on performance metrics (such as page load time and resource loading success rate) and basic logging (such as user click events and error logs), using rule engines or statistical thresholds to identify system anomalies.

[0003] During actual use, the applicant found that current monitoring solutions often only capture simple operations such as user clicks, scrolling, and loading time, and lack in-depth monitoring of multi-dimensional operation behaviors (such as mouse trajectory dynamics and operation timing correlation). At the same time, the detection mechanism based on fixed rules cannot adapt to dynamic behavior patterns, such as the gradual operation changes caused by the user learning curve, especially the lack of generalization ability when responding to new attacks. At the same time, with the exponential growth of user behavior data, traditional monitoring systems adopt a centralized data processing architecture, which faces problems of resource contention and response delays in high-concurrency scenarios, seriously reducing the efficiency of user behavior recognition. Summary of the Invention

[0004] The embodiments of the present application provide a method, apparatus, terminal device, and storage medium for detecting anomalies in user behavior, which can analyze the user's multi-dimensional operation data and calculate the anomaly score of the multi-dimensional operation data by constructing a dynamic behavior model, thereby quickly identifying abnormal behavior and effectively improving the efficiency of user behavior identification.

[0005] This embodiment of the present application provides a method for detecting abnormalities in user behavior, including:

[0006] Real-time collection of multi-dimensional operation data of users on the front-end page;

[0007] Preprocessing the multidimensional operation data, and extracting feature vectors of the preprocessed multidimensional operation data based on a graph neural network;

[0008] constructing a dynamic behavior model and inputting the feature vector into the dynamic behavior model to output an anomaly score of the multi-dimensional operation data;

[0009] If the abnormality score exceeds a preset score threshold, the multi-dimensional operation data is fed back.

[0010] In one embodiment, the real-time collection of multi-dimensional operation data of users on the front-end page includes:

[0011] Collect multi-dimensional operation data of users on the front-end page through the preset stream processing framework;

[0012] Calculating difference data between the multi-dimensional operation data currently collected and the multi-dimensional operation data collected last time;

[0013] The multi-dimensional operation data currently collected is differentially compressed according to the difference data.

[0014] In one embodiment, the preprocessing of the multi-dimensional operation data includes:

[0015] performing cluster analysis on the multidimensional operation data to remove noise in the multidimensional operation data;

[0016] The target variable in the multidimensional operation data after noise removal is determined through principal component analysis, and the multidimensional operation data is subjected to dimensionality reduction processing according to the target variable.

[0017] In one embodiment, the constructing of the dynamic behavior model includes:

[0018] Collecting historical operation data of the user on the front-end page, and extracting time series feature vectors and context feature vectors from the historical operation data;

[0019] The time series feature vector and the context feature vector are concatenated and input into a multi-layer perceptron for modeling to construct the dynamic behavior model.

[0020] In one embodiment, the method further comprises:

[0021] Obtain the user's historical operation data on the front-end page;

[0022] Obtain the operating parameters and operating scenarios of the terminal device;

[0023] The preset score threshold is dynamically adjusted according to the historical operation data, operation parameters and operation scenarios.

[0024] In one embodiment, the feeding back the multi-dimensional operation data includes:

[0025] Stop executing the instruction corresponding to the multi-dimensional operation data and generate a prompt message;

[0026] Obtain log data associated with the front-end page to perform log analysis.

[0027] In one embodiment, the method further comprises:

[0028] Collecting user feedback on the front-end page;

[0029] The front-end page and the associated application are adjusted according to the feedback information.

[0030] The present application also provides a device for detecting abnormalities in user behavior, including:

[0031] The collection unit is used to collect multi-dimensional operation data of users on the front-end page in real time;

[0032] an extraction unit, configured to preprocess the multidimensional operation data and extract a feature vector of the preprocessed multidimensional operation data based on a graph neural network;

[0033] an output unit, configured to construct a dynamic behavior model and input the feature vector into the dynamic behavior model to output an anomaly score of the multi-dimensional operation data;

[0034] A feedback unit is configured to provide feedback on the multi-dimensional operation data if the anomaly score exceeds a preset score threshold.

[0035] An embodiment of the present application also provides a terminal device, which includes: a memory and a processor, wherein an application processing program is stored on the memory, and when the application processing program is executed by the processor, the steps of the user behavior anomaly detection method provided in any one of the embodiments of the present application are implemented.

[0036] An embodiment of the present application also provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute any user behavior anomaly detection method provided in the embodiment of the present application.

[0037] The user behavior anomaly detection method provided in the embodiments of the present application can collect multidimensional operation data of users on the front-end page in real time, preprocess the multidimensional operation data, and extract feature vectors of the preprocessed multidimensional operation data based on a graph neural network. A dynamic behavior model is constructed and the feature vectors are input into the dynamic behavior model to output an anomaly score for the multidimensional operation data. If the anomaly score exceeds a preset score threshold, the multidimensional operation data is fed back. The solution provided in the embodiments of the present application can analyze the user's multidimensional operation data and calculate the anomaly score of the multidimensional operation data by constructing a dynamic behavior model, thereby quickly identifying abnormal behavior and effectively improving the efficiency of user behavior identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 This is a first flow chart of the method for detecting abnormalities in user behavior provided by an embodiment of the present application;

[0040] Figure 2 This is a second flow chart of the method for detecting abnormal user behavior provided in an embodiment of the present application;

[0041] Figure 3 This is a schematic diagram of the first structure of the device for detecting abnormalities in user behavior provided in an embodiment of the present application;

[0042] Figure 4 It is a structural diagram of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0044] It should be noted that, in this document, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, components, features, and elements with the same name in different embodiments of the present application may have the same meaning or different meanings, and their specific meanings need to be determined by their explanation in the specific embodiment or further combined with the context of the specific embodiment.

[0045] It should be understood that, although the various steps in the flowchart in the embodiment of the present application are shown in sequence according to the indication of the arrows, these steps are not necessarily performed in sequence in the order indicated by the arrows. Unless clearly stated herein, the execution of these steps is not strictly limited in order, and they can be performed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and their execution order is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0046] It should be noted that in this article, step codes such as 101 and 102 are used for the purpose of expressing the corresponding content more clearly and concisely, and do not constitute a substantial limitation on the order. Those skilled in the art may execute 102 first and then 101, etc. during specific implementation, but these should all be within the scope of protection of this application.

[0047] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0048] An embodiment of the present application provides a method for detecting anomalies in user behavior. The executor of the method for detecting anomalies in user behavior may be the device for detecting anomalies in user behavior provided in the embodiment of the present application, or a terminal device (smart terminal, server, etc.) that integrates the device for detecting anomalies in user behavior, wherein the device for detecting anomalies in user behavior may be implemented in hardware or software.

[0049] For details, please refer to Figure 1 , Figure 1 This is a first flow chart of the method for detecting abnormal user behavior provided by an embodiment of the present application. The specific flow of the method for detecting abnormal user behavior may be as follows:

[0050] 101. Collect multi-dimensional operation data of users on the front-end page in real time.

[0051] In one embodiment, the multi-dimensional operation data may include user interactions with the front-end page, such as basic interaction data such as click events, mouse tracks, and input content. In addition, the multi-dimensional operation data may include timing information about the interaction, such as operation timestamps, event sequence intervals, and session duration. Furthermore, the multi-dimensional operation data may further include context-related data, such as current device resolution, browser version, network latency, and geographic location.

[0052] In one embodiment, a lightweight JavaScript script can be embedded in the front-end page, and then the raw data can be captured through event monitoring. To reduce the amount of data transmitted and network bandwidth usage, this embodiment can also use incremental encoding technology to transmit only the operational data that has changed. For example, for mouse movements, only the offset relative to the previous position can be transmitted. Furthermore, accurate timestamps can be used to record the exact time at which each operational event occurred, ensuring the temporal integrity of the data.

[0053] In one embodiment, in addition to traditional data collection, the terminal device's sensors can also be combined to obtain the terminal device's acceleration, gyroscope data, etc. For applications on mobile terminal devices, the user's operating habits can be captured more accurately, such as special actions such as tilting operations and rapid shaking when the user holds the mobile terminal device, thereby achieving more comprehensive multi-dimensional operation data collection.

[0054] 102. Preprocess the multidimensional operation data, and extract feature vectors of the preprocessed multidimensional operation data based on a graph neural network.

[0055] In one embodiment, preprocessing the multidimensional operational data may include data cleaning of the multidimensional operational data. For example, cluster analysis can be used to automatically identify and remove abnormal data, such as abnormal click data caused by network jitter or erroneous input caused by terminal device failure. Another example is the use of a machine learning-driven outlier detection algorithm (such as density-based clustering DBSCAN) to automatically identify and remove interference data caused by accidental device touches, network jitter, etc., which has higher data cleaning efficiency than traditional manual rule filtering.

[0056] Furthermore, this embodiment can also spatially and temporally align multidimensional operational data with environmental data (e.g., delayed operational responses due to network latency, rendering lags on older devices), to construct a composite dataset containing a "behavior-environment" relationship. For example, a user's high frequency of clicks on a 4G network may be due to page load delays and needs to be distinguished from malicious rapid clicks.

[0057] In one embodiment, preprocessing the multidimensional operation data may further include standardizing the multidimensional operation data to unify different types of operation data into the same time scale and value range, thereby eliminating dimensional differences.

[0058] Furthermore, user operation sequences can be abstracted into a directed graph structure, with each operation event as a node containing features such as timestamp, operation type, and target element attributes. The edges between two nodes represent the operation sequence or element association, such as the path from clicking button A to jumping to page B. The dependencies between nodes are then learned using a graph convolutional network (GCN) or a graph attention network (GAT). Finally, the output high-dimensional graph is embedded into a vector, forming a high-dimensional feature vector that includes social network features, influence features, and temporal dependency features.

[0059] In one embodiment, the high-dimensional feature vectors can be compressed using an autoencoder to reduce computational complexity and enhance the ability to characterize key behavioral patterns. This embodiment automatically extracts high-level features of user behavior by introducing a feature extraction method based on a graph neural network (GNN). This method can more comprehensively capture the complexity of user behavior and enhance the correlation between features through graph structures, thereby improving the expressiveness and accuracy of the model.

[0060] 103. Construct a dynamic behavior model and input the feature vector into the dynamic behavior model to output an anomaly score of the multi-dimensional operation data.

[0061] In one embodiment, a dynamic behavior model can be constructed based on the Transformer architecture, and the model can be trained using a large amount of normal operation data to establish a baseline model of normal operation. In the real-time detection stage, the extracted feature vector is input into the trained dynamic behavior model. The dynamic behavior model analyzes the input feature vector and calculates an anomaly score by comparing it with the baseline model. For example, the dynamic behavior model compares the time interval, operation sequence, operation mode and other features of the real-time behavior with the normal behavior baseline, and gives a corresponding anomaly score based on the degree of difference.

[0062] In one embodiment, a reinforcement learning algorithm can also be integrated to enable the dynamic behavior model to continuously adjust its own parameters and decision-making strategies according to the detection results during operation. For example, when the dynamic behavior model detects an abnormal operation and receives feedback (such as confirming that the abnormal operation is a false alarm or missed report), the weight of the dynamic behavior model is updated through the reinforcement learning algorithm, making it more accurate in subsequent detections. In addition, multimodal information fusion technology can be introduced. In addition to the feature vectors of user operation data, multimodal information such as voice data and image data can also be integrated into the dynamic behavior model, thereby improving the dynamic behavior model's understanding of complex behavior patterns and the accuracy of anomaly detection.

[0063] 104. If the abnormal score exceeds the preset score threshold, feedback is provided on the multi-dimensional operation data.

[0064] In one embodiment, when the anomaly score output by the dynamic behavior model exceeds a preset score threshold, the system will immediately activate a feedback mechanism. On the one hand, measures are taken to prevent malicious behavior, such as preventing further execution of related operations for possible malicious operations such as rapid clicks and script injection, thereby protecting the security and stability of the system. On the other hand, alarms can be triggered in a variety of ways, such as sending an email notification to the administrator, the email content of which contains information such as the time when the abnormal behavior occurred, operation data, and anomaly score; or pushing the abnormal information to the relevant monitoring system or management platform through an API interface. At the same time, the relevant log data of this abnormal behavior is recorded for subsequent optimization and adjustment of the dynamic behavior model. In this way, in the subsequent analysis and processing of abnormal behavior, the entire process of the abnormality can be accurately traced back, thereby improving the security and reliability of the system. That is, the above-mentioned step of providing feedback on multi-dimensional operation data can include stopping the execution of instructions corresponding to the multi-dimensional operation data, generating prompt information, and obtaining log data associated with the front-end page for log analysis.

[0065] In one embodiment, an adaptive feedback strategy can also be established, which can automatically adjust the feedback method and handling measures based on the different types of abnormal behaviors and the severity of the anomaly score. For example, for minor anomalies (anomaly scores slightly above a preset score threshold), the system can first record and observe, and instead of triggering an alarm immediately, continue to monitor for a period of time. For serious anomalies, more stringent measures can be taken, such as temporarily restricting some of the user's operating permissions and promptly notifying the administrator for intervention.

[0066] In one embodiment, it is also possible to obtain the historical operation data of the user on the front-end page, obtain the operating parameters and operating scenarios of the terminal device, and dynamically adjust the preset score based on the historical operation data, operating parameters and operating scenarios. Specifically, the historical operation data may include various operations on the front-end page from the first visit to the present, such as click frequency, operation path, page dwell time and other information. Operating parameters can be collected in real time through device monitoring tools and system interfaces, such as CPU usage, memory occupancy, network bandwidth and other hardware-related indicators. The operating scenario of the terminal device may include whether the terminal device is in a charging state or battery-powered, the geographical location of the terminal device (obtained through GPS positioning or base station positioning), the current time (used to distinguish different scenarios such as working hours and rest periods), etc.

[0067] Furthermore, this embodiment can construct an intelligent analysis model that uses the acquired historical operation data, operating parameters, and operating scenarios as input. For example, if it is found that the user's historical operation behavior in a specific operating scenario (such as when the network signal is weak) is manifested as reduced operation frequency and prolonged response time, and the operating parameters of the terminal device show that the network bandwidth is low, then when the abnormal score of the current operation is detected, the preset score threshold is appropriately increased. This is because in this case, some seemingly abnormal operations may be normal changes caused by the terminal device or network environment, rather than real abnormal behavior. On the contrary, if the terminal device operating parameters are good, but the user's historical operation data shows that it has maintained a stable operating mode in the current operating scenario, and the current operation has a large deviation, then the preset score threshold is lowered to more strictly detect abnormal behavior. This dynamic adjustment mechanism enables the anomaly detection system to better adapt to the personalized behavior patterns of different users and changes in terminal devices and environments, effectively reducing the occurrence of false positives and false negatives, and improving the accuracy of anomaly detection.

[0068] As described above, the user behavior anomaly detection method proposed in the embodiment of the present application can collect the multi-dimensional operation data of the user on the front-end page in real time, pre-process the multi-dimensional operation data, and extract the feature vector of the pre-processed multi-dimensional operation data based on the graph neural network, build a dynamic behavior model and input the feature vector into the dynamic behavior model to output the anomaly score of the multi-dimensional operation data. If the anomaly score exceeds the preset score threshold, the multi-dimensional operation data is fed back. The solution provided in the embodiment of the present application can analyze the user's multi-dimensional operation data and calculate the anomaly score of the multi-dimensional operation data by building a dynamic behavior model, thereby quickly identifying abnormal behavior and effectively improving the efficiency of user behavior recognition.

[0069] The method described in the above embodiment will be further described below.

[0070] See also Figure 2 , Figure 2 This is a second flow chart of the method for detecting abnormal user behavior provided in an embodiment of the present application. The method includes:

[0071] 201. Collect the multi-dimensional operation data of the user currently on the front-end page through the preset stream processing framework.

[0072] In one embodiment, a stream processing framework such as Apache Kafka can be used to capture various user operations using event monitoring scripts. When a user performs operations such as mouse clicks, movement, keyboard input, and page scrolling, the script will promptly capture these events and encapsulate the relevant data (such as operation type, timestamp, coordinate location, etc.) into messages in a specific format. The specific format refers to the data storage format after data conversion and encapsulation, such as JSON, Protocol Buffers, Avro format, etc. These messages will be sent to the Kafka Producer, which is responsible for sending the messages to the Kafka cluster. During the sending process, the messages will be partitioned according to their characteristics (such as time, user ID, etc.) for subsequent efficient processing. After receiving the messages, the Kafka cluster will further store these messages according to partitions and order for subsequent processing and analysis. This method enables the system to identify and respond to abnormal user behavior within milliseconds.

[0073] 202. Calculate difference data between the currently collected multi-dimensional operation data and the last collected multi-dimensional operation data, and perform differential compression on the currently collected multi-dimensional operation data according to the difference data.

[0074] In one embodiment, differential coding can also be used to collect the multidimensional operation data. The core of differential coding is to compare the currently collected multidimensional operation data with the previously collected multidimensional operation data, identify the differences between the two, and encode these differences. By identifying and extracting these differences, the amount of data required for transmission can be significantly reduced. Differential compression, based on differential coding, further exploits the redundancy of data to compress the difference data, thereby utilizing less storage space and transmission bandwidth for data transmission.

[0075] Specifically, multi-dimensional operation data for the front-end page is collected at preset intervals (such as 1ms). When collecting multi-dimensional operation data, every time new multi-dimensional operation data is captured, it will be automatically compared with the multi-dimensional operation data collected last time. For example, for mouse movement data, the coordinate difference between the current mouse position and the last recorded position will be calculated; for input content, it will be compared character by character to find out the newly added, deleted or modified parts. These difference data are encoded according to specific encoding rules. A simple encoding format can also be defined. For coordinate differences, relative coordinates are used to represent them; for changes in text content, specific instructions (such as insertion, deletion, replacement) and specific content are used to describe them. The encoded difference data is differentially compressed. Common compression algorithms such as Huffman coding and LZ77 algorithm are used to compress the difference data to generate compressed data packets.

[0076] 203. Preprocess the multidimensional operation data after differential compression, and extract feature vectors of the preprocessed multidimensional operation data based on a graph neural network.

[0077] In one embodiment, the step of preprocessing the differentially compressed multidimensional operational data may include: performing cluster analysis on the differentially compressed multidimensional operational data to remove noise from the multidimensional operational data; determining a target variable in the noise-removed multidimensional operational data through principal component analysis; and performing dimensionality reduction on the multidimensional operational data based on the target variable. For example, a K-Means clustering algorithm may be used. The number of clusters, K, is predefined. The multidimensional operational data is input. The K-Means clustering algorithm randomly selects K data points as initial cluster centers. Next, the distance between each data point and each cluster center is calculated and assigned to the cluster with the closest distance. The center position of each cluster, i.e., the mean of all data points within the cluster, is then recalculated. The above steps are repeated, and the cluster assignments are continuously adjusted until the cluster divisions remain unchanged or change minimally, at which point the clustering process converges. In the clustering results, clusters with very few data points or that are significantly different from other clusters contain noise data. Data points in these clusters can be removed from the original dataset to remove noise from the multidimensional operational data.

[0078] Furthermore, PCA (principal components analysis) is a method that transforms a set of potentially correlated variables into a set of linearly uncorrelated variables (principal components) through an orthogonal transformation. In multidimensional operational data, PCA can identify variables that have a significant impact on overall data variation, namely the target variables. Specifically, after removing noise, the multidimensional operational data is normalized, converting data of different dimensions to the same scale to prevent certain variables with large values from dominating the analysis results. The covariance matrix of the normalized data is calculated, reflecting the correlations between the variables. Eigenvalue decomposition is performed on the covariance matrix to obtain eigenvalues and eigenvectors. Eigenvalues represent the variance of the corresponding principal component, while eigenvectors represent the linear combination relationship between the principal component and the original variables. Eigenvalues and eigenvectors are sorted in descending order of eigenvalue. Based on actual needs and data characteristics, the first few principal components with the largest variance are selected as target variables. These target variables retain most of the important information in the original data and can represent the main characteristics of the multidimensional operational data. Based on the target variables determined previously, the multidimensional operation data is projected into the low-dimensional space composed of these principal components, thereby achieving data dimensionality reduction. This reduces the dimension of the data while retaining the key information of the data, thereby reducing the complexity of subsequent calculations.

[0079] In one embodiment, after preprocessing the multi-dimensional operation data, the user operation can be abstracted into a graph structure, where nodes can represent operation events and edges can represent the correlation between operation events. Then, through multi-layer GNN aggregation of node and neighborhood information, high-order features can be extracted, and finally a low-dimensional vector containing temporal, spatial and semantic information can be generated.

[0080] 204. Collect the user's historical operation data on the front-end page, and extract the time series feature vector and context feature vector from the historical operation data.

[0081] 205. The time series feature vector and the context feature vector are concatenated and input into the multi-layer perceptron for modeling to construct a dynamic behavior model.

[0082] In one embodiment, a database can be queried to collect historical user operation data on the front-end page, and the time series feature vector and context feature vector can be extracted from the historical operation data. The time series feature vector reflects the temporal changes in user operations, such as the time interval between operations and the change in operation frequency. The context feature vector contains information about the environment in which the operation occurred, such as the front-end page on which it occurred and the associated business process.

[0083] The previously extracted time series feature vectors and context feature vectors are concatenated sequentially to form a new long vector. This concatenated long vector integrates the temporal characteristics of the operation and contextual information, providing more comprehensive data for subsequent modeling. A multilayer perceptron (MLP) consists of an input layer, multiple hidden layers, and an output layer. The concatenated long vector serves as the input layer's input. In the hidden layer, neurons are connected to the input layer via a weight matrix. Each neuron performs a weighted sum of its inputs and performs a nonlinear transformation using an activation function. This process learns complex patterns and relationships between features in the input data. The output layer can use a sigmoid function to output anomaly probabilities, or a regression layer to output anomaly scores. If a sigmoid function is used, it maps the hidden layer output to a probability value between 0 and 1. 0 indicates that the operation is highly likely normal, 1 indicates that the operation is highly likely abnormal, and intermediate values indicate the degree of anomaly probability. If a regression layer is used to output anomaly scores, it directly outputs a numerical value based on the patterns learned during training. The anomaly score intuitively reflects the degree to which the user operation deviates from normal behavior.

[0084] 206. Input the feature vector into the dynamic behavior model and output an anomaly score of the multi-dimensional operation data.

[0085] 207. If the abnormality score exceeds the preset score threshold, feedback is provided on the multi-dimensional operation data.

[0086] In one embodiment, when the anomaly score output by the dynamic behavior model exceeds a preset threshold, the system immediately activates a feedback mechanism. For example, for potentially malicious operations such as rapid clicks and script injection, further execution of the relevant operation is blocked, protecting the security and stability of the system. Another example is sending an email notification to the administrator, containing information such as the time the abnormal behavior occurred, the operation data, and the anomaly score. Alternatively, the anomaly information can be pushed to the relevant monitoring system or management platform via an API interface.

[0087] In one embodiment, the method may further include collecting user feedback regarding the front-end page and adjusting the front-end page and associated applications based on the feedback. For example, a dedicated feedback portal, such as user comments or questionnaires, may be provided on the front-end page. Simultaneously, the system may automatically collect user operation logs and error messages as part of the feedback. The collected feedback information may be categorized, for example, into interface design, function usage, performance issues, and so on.

[0088] For example, for interface design feedback, if users report problems such as unreasonable front-end page layout and inconsistent color matching, the HTML and CSS code of the front-end page can be modified based on the feedback, and the page layout and color scheme can be optimized to improve the visual effects and user experience of the front-end page. For function usage feedback, if users raise issues such as the complexity of certain functions or the lack of necessary functions, the code of the associated application can be modified and optimized to simplify the operation process and add new functions. For performance problem feedback, such as slow page loading and untimely response, the front-end code can be optimized, such as compressing images, optimizing code structure, and adopting caching technology. At the same time, the back-end services of the associated applications can be adjusted, such as optimizing database queries and increasing server resources, to improve the performance and response speed of the system.

[0089] As described above, the user behavior anomaly detection method proposed in the embodiment of the present application can collect the multi-dimensional operation data of the user currently on the front-end page in real time through a preset stream processing framework, calculate the difference data between the multi-dimensional operation data currently collected and the multi-dimensional operation data collected last time, perform differential compression on the multi-dimensional operation data currently collected according to the difference data, pre-process the multi-dimensional operation data after differential compression, and extract the feature vector of the multi-dimensional operation data based on the graph neural network, collect the historical operation data of the user on the front-end page, and extract the time series feature vector and context feature vector in the historical operation data, splice the time series feature vector and the context feature vector and input them into the multi-layer perceptron for modeling to construct a dynamic behavior model, input the feature vector into the dynamic behavior model, output the anomaly score of the multi-dimensional operation data, and if the anomaly score exceeds the preset score threshold, feedback is given to the multi-dimensional operation data. The solution provided in the embodiment of the present application can analyze the multi-dimensional operation data of the user and calculate the anomaly score of the multi-dimensional operation data by constructing a dynamic behavior model, thereby quickly identifying abnormal behavior and effectively improving the efficiency of user behavior recognition.

[0090] For example, Figure 3 FIG. 1 is a schematic diagram of a first structural embodiment of a user behavior anomaly detection device provided in an embodiment of the present application. The user behavior anomaly detection device may include:

[0091] The collection unit 301 is used to collect multi-dimensional operation data of users on the front-end page in real time;

[0092] An extraction unit 302 is configured to preprocess the multidimensional operation data and extract feature vectors of the preprocessed multidimensional operation data based on a graph neural network;

[0093] an output unit 303 for constructing a dynamic behavior model and inputting the feature vector into the dynamic behavior model to output an abnormality score of the multi-dimensional operation data;

[0094] The feedback unit 304 is configured to provide feedback on the multi-dimensional operation data if the anomaly score exceeds a preset score threshold.

[0095] The user behavior anomaly detection device proposed in the embodiment of the present application can collect multi-dimensional operation data of users on the front-end page in real time, pre-process the multi-dimensional operation data, and extract the feature vector of the pre-processed multi-dimensional operation data based on a graph neural network. It then constructs a dynamic behavior model and inputs the feature vector into the dynamic behavior model to output an anomaly score for the multi-dimensional operation data. If the anomaly score exceeds a preset score threshold, the multi-dimensional operation data is fed back. The solution provided in the embodiment of the present application can analyze the user's multi-dimensional operation data and calculate the anomaly score of the multi-dimensional operation data by constructing a dynamic behavior model, thereby quickly identifying abnormal behavior and effectively improving the efficiency of user behavior recognition.

[0096] The present application also provides a terminal device, such as Figure 4 As shown, the terminal device 400 may include a memory 401 and a processor 402, wherein the memory 401 stores an application processing program, and when the application processing program is executed by the processor 402, the steps of the above-mentioned user behavior anomaly detection method in this embodiment are implemented.

[0097] Specifically, in this embodiment, the processor 402 in the terminal device 400 loads the executable files corresponding to one or more application processes into the memory 401 according to the following instructions, and the processor 402 runs the application stored in the memory 401 to implement various functions:

[0098] Real-time collection of multi-dimensional operation data of users on the front-end page;

[0099] Preprocessing the multidimensional operation data, and extracting feature vectors of the preprocessed multidimensional operation data based on a graph neural network;

[0100] constructing a dynamic behavior model and inputting the feature vector into the dynamic behavior model to output an anomaly score of the multi-dimensional operation data;

[0101] If the abnormality score exceeds a preset score threshold, the multi-dimensional operation data is fed back.

[0102] In the above embodiments, the description of each embodiment has its own focus. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the abnormality detection method for user behavior above, which will not be repeated here.

[0103] As can be seen from the above, the terminal device of the embodiment of the present application can collect the multi-dimensional operation data of the user on the front-end page in real time, pre-process the multi-dimensional operation data, and extract the feature vector of the pre-processed multi-dimensional operation data based on the graph neural network, build a dynamic behavior model and input the feature vector into the dynamic behavior model to output the anomaly score of the multi-dimensional operation data. If the anomaly score exceeds the preset score threshold, the multi-dimensional operation data is fed back. The solution provided by the embodiment of the present application can analyze the multi-dimensional operation data of the user and calculate the anomaly score of the multi-dimensional operation data by building a dynamic behavior model, thereby quickly identifying abnormal behavior and effectively improving the efficiency of user behavior recognition.

[0104] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0105] To this end, an embodiment of the present application provides a computer-readable storage medium, which stores multiple instructions that can be loaded by a processor to execute the steps in any user behavior anomaly detection method provided in the embodiment of the present application.

[0106] The storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0107] Since the instructions stored in the storage medium can execute the steps in any of the user behavior anomaly detection methods provided in the embodiments of the present application, the beneficial effects that can be achieved by any of the user behavior anomaly detection methods provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0108] The above is a detailed introduction to the user behavior anomaly detection method, device, terminal device and storage medium provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, based on the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting abnormalities in user behavior, characterized in that: include: Real-time collection of multi-dimensional operation data of users on the front-end page; Preprocessing the multidimensional operation data, and extracting feature vectors of the preprocessed multidimensional operation data based on a graph neural network; constructing a dynamic behavior model and inputting the feature vector into the dynamic behavior model to output an anomaly score of the multi-dimensional operation data; If the abnormality score exceeds a preset score threshold, the multi-dimensional operation data is fed back.

2. The method for detecting abnormal user behavior according to claim 1, wherein: The real-time collection of multi-dimensional operation data of users on the front-end page includes: Collect multi-dimensional operation data of users on the front-end page through the preset stream processing framework; Calculating difference data between the multi-dimensional operation data currently collected and the multi-dimensional operation data collected last time; The multi-dimensional operation data currently collected is differentially compressed according to the difference data.

3. The method for detecting abnormal user behavior according to claim 1, wherein: The preprocessing of the multi-dimensional operation data includes: performing cluster analysis on the multidimensional operation data to remove noise in the multidimensional operation data; The target variable in the multidimensional operation data after noise removal is determined through principal component analysis, and the multidimensional operation data is subjected to dimensionality reduction processing according to the target variable.

4. The method for detecting abnormal user behavior according to claim 1, wherein: The constructing of the dynamic behavior model includes: Collecting historical operation data of the user on the front-end page, and extracting time series feature vectors and context feature vectors from the historical operation data; The time series feature vector and the context feature vector are concatenated and input into a multi-layer perceptron for modeling to construct the dynamic behavior model.

5. The method for detecting abnormalities in user behavior according to claim 1, wherein: The method further comprises: Obtain the user's historical operation data on the front-end page; Obtain the operating parameters and operating scenarios of the terminal device; The preset score threshold is dynamically adjusted according to the historical operation data, operation parameters and operation scenarios.

6. The method for detecting abnormal user behavior according to claim 1, wherein: The feeding back of the multi-dimensional operation data includes: Stop executing the instruction corresponding to the multi-dimensional operation data and generate a prompt message; Obtain log data associated with the front-end page to perform log analysis.

7. The method for detecting abnormal user behavior according to any one of claims 1 to 6, wherein: The method further comprises: Collecting user feedback on the front-end page; The front-end page and the associated application are adjusted according to the feedback information.

8. A device for detecting abnormalities in user behavior, characterized in that: include: The collection unit is used to collect multi-dimensional operation data of users on the front-end page in real time; an extraction unit, configured to preprocess the multidimensional operation data and extract a feature vector of the preprocessed multidimensional operation data based on a graph neural network; an output unit, configured to construct a dynamic behavior model and input the feature vector into the dynamic behavior model to output an anomaly score of the multi-dimensional operation data; A feedback unit is configured to provide feedback on the multi-dimensional operation data if the anomaly score exceeds a preset score threshold.

9. A terminal device, characterized in that: The terminal device includes: a memory and a processor, wherein the memory stores an application processing program, and when the application processing program is executed by the processor, the steps of the user behavior anomaly detection method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The storage medium stores a plurality of instructions, which are suitable for loading by a processor to execute the method for detecting abnormalities in user behavior according to any one of claims 1 to 7.

Images