Key anomaly detection method and device based on behavior model

Abstract

The invention provides a key anomaly detection method and device based on a behavior model, and the method comprises the steps: obtaining a key operation data set, carrying out the behavior feature extraction of the key operation data set, obtaining a key operation behavior feature set corresponding to each piece of user identification information, and carrying out the detection of the key anomaly. And inputting the key operation behavior feature set into a pre-constructed key behavior analysis model, generating a key behavior dynamic score of each piece of user identification information, carrying out anomaly comparison processing based on the key behavior dynamic score and a preset historical behavior score threshold, generating a key anomaly detection result set of the target user, and sending the key anomaly detection result set to the target user. And triggering a corresponding key security response operation according to the key anomaly detection result set. The method can provide technical support with both behavior traceability and adaptive protection characteristics for security authentication medium management in the power industry, and meets the requirements of a protection system of a power monitoring system.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and device for detecting key anomalies based on a behavior model. Background Art

[0002] With the deepening transformation of power systems towards intelligent systems, secure authentication media management technology for power monitoring systems has become a critical component in ensuring the safe operation of core grid services. Existing U-KEY key management technologies often rely on manual registration combined with a fixed rule-based monitoring approach. These technologies store media in physical cabinets and maintain paper ledgers, relying on manual verification of operation logs for anomaly warnings. Traditional methods separate identity verification from access operations, preventing the dynamic binding of operator identities to key usage behavior, creating the risk of impersonation and making tracing difficult. Furthermore, existing ledger management models struggle to capture dynamic behavioral characteristics such as key borrowing and return frequency and operation time distribution, resulting in a delayed response to risks such as abnormal retention and unconventional access during irregular periods. Furthermore, existing technologies lack a hierarchical response strategy based on operational behavior patterns, making them incapable of adapting to complex scenarios such as temporary authorization revocation and dynamic permission demotion. Existing systems lack the ability to continuously model key behavior throughout their lifecycle, unable to construct individualized usage baselines through multi-dimensional correlation analysis of operation timestamps, user identities, and action types. This results in high false positive rates and blind spots in defense against emerging attack vectors. Summary of the Invention

[0003] In view of this, the present application provides a method and device for detecting key anomalies based on a behavioral model.

[0004] The technical solution of the embodiment of the present application is implemented as follows: On the one hand, an embodiment of the present application provides a key anomaly detection method based on a behavioral model, the method comprising: obtaining a key operation data set, the key operation data set comprising multiple key operation records, each key operation record comprising user identification information, key operation type information and operation timestamp information; performing behavioral feature extraction processing on the key operation data set to obtain a key operation behavior feature set corresponding to each user identification information; inputting the key operation behavior feature set into a pre-built key behavior analysis model to generate a key behavior dynamic score for each user identification information; performing anomaly comparison processing based on the key behavior dynamic score and a preset historical behavior score threshold to generate a key anomaly detection result set for the target user; triggering a corresponding key security response operation according to the key anomaly detection result set, the key security response operation comprising a key disabling operation or an operation authority downgrade operation.

[0005] On the other hand, an embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, the steps in the above method are implemented.

[0006] The behavior model-based key anomaly detection method provided by the present invention constructs a holographic behavior portrait of the security authentication medium in the power monitoring scenario by integrating multi-dimensional data collection of user identity verification information, key operation type and precise timestamp; adopts the synergistic effect of dynamic feature extraction and intelligent behavior analysis model to convert U-KEY access records into a quantitative indicator set containing operation frequency, time period distribution and behavior sequence characteristics; generates dynamic detection thresholds based on individualized historical behavior baselines, breaking through the defect of disconnection between identity verification and operation behavior in the traditional physical cabinet management model, and realizing real-time dynamic binding of operator identity and key usage behavior; combines multi-level security response strategies with intelligent return reminder mechanisms to form a closed-loop management and control system covering the entire life cycle of keys. This method effectively solves the pain points of difficult manual ledger tracing and delayed detection of abnormal retention in traditional key management of power monitoring systems. It eliminates the risk of impersonation through in-depth correlation analysis of operation logs and identity authentication data, accurately identifies hidden anomalies such as calls during irregular time periods using time series behavior modeling, and significantly reduces the rate of key expiration retention with the help of an intelligent reminder mechanism. At the same time, it realizes the upgrade from single disablement to temporary authorization recovery, dynamic adjustment of permissions and other refined management and control, providing technical support for the management of secure authentication media in the power industry with both behavioral traceability and adaptive protection characteristics, meeting the protection system requirements of the power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 A schematic diagram of the implementation flow of a key anomaly detection method based on a behavioral model provided in an embodiment of the present application.

[0008] Figure 2 A hardware entity diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0009] The present invention provides a method for detecting key anomalies based on a behavioral model, which can be executed by a processor of a computer device, wherein the computer device can refer to a device with data processing capabilities, such as a server or a desktop computer.

[0010] Figure 1 A schematic diagram of the implementation flow of a key anomaly detection method based on a behavioral model provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes: Step S100: Acquire a key operation data set, where the key operation data set includes multiple key operation records, and each key operation record includes user identification information, key operation type information, and operation timestamp information.

[0011] A key operation data set refers to the collection of all key operation-related data collected within a set time period. This data exists in the form of records, with each record representing a specific key operation. User identification information is used to uniquely identify the user performing the key operation. It can be a unique identifier such as the user's work number or account number. Key operation type information describes the specific operation behavior, such as key generation, call, and deletion. Operation timestamp information records the specific time when the key operation occurred, accurate to a specific moment. The process of obtaining key operation data sets can be achieved by setting up a data acquisition module in the key management system. This module can monitor all key operation events within the system in real time, record the user identification information, key operation type information, and operation timestamp information of each operation, and store it in a designated database.

[0012] Step S200: performing behavior feature extraction processing on the key operation data set to obtain a key operation behavior feature set corresponding to each user identification information.

[0013] Behavioral feature extraction refers to the process of extracting features that reflect user operational behavior from key operation data sets. By analyzing and processing a large number of key operation records, the user behavior patterns and regularities contained therein are discovered. The key operation behavior feature set corresponding to each user's identification information is a collection of multiple features that comprehensively describe the user's key operation behavior. Behavioral feature extraction from key operation data sets can employ a variety of data analysis and machine learning methods. For example, statistical analysis methods can be used to analyze the time and type information in operation records to calculate features such as operation frequency and operation time distribution. Machine learning algorithms can also be used to model the operation records to extract more complex behavioral features.

[0014] As an implementation manner, step S200 may specifically include the following steps S210 to S240: Step S210: performing time dimension decomposition processing on each key operation record in the key operation data set to generate operation time distribution features corresponding to each user identification information.

[0015] Time-dimension decomposition involves breaking down and analyzing key operation records according to the time dimension to uncover temporal distribution patterns. Operation time distribution features reflect the distribution of key operations performed by users at different times, such as the frequency distribution of operations in different time periods of the day and the periodicity of operations. The following method can be used to perform time-dimension decomposition on each key operation record in a key operation data set. First, the operation timestamp information is extracted from each operation record. Time is then divided into pre-defined time granularities (e.g., hours or days), and the operation frequency within each time interval is counted. This frequency data is then further analyzed and processed, such as by calculating a sliding window mean or performing time series analysis, to generate a more comprehensive operation time distribution feature.

[0016] As an implementation manner, step S210 may specifically include the following steps S211 to S214: Step S211: extracting operation timestamp information from the key operation record, and generating time series segments according to a preset time granularity division rule.

[0017] Operation timestamp information records the specific time when a key operation occurred. Extracting operation timestamp information from key operation records can be achieved by parsing the records. The preset time granularity rule refers to a pre-set rule for dividing time into different intervals, such as hours, days, or weeks. Time series segments are the time intervals obtained by dividing the operation timestamp information according to the time granularity rule. Operation timestamp information can be extracted from key operation records using string processing functions in programming languages or database query statements. For example, if a database stores key operation records, SQL queries can easily extract the operation timestamp information from each record. Then, according to the preset time granularity rule, this timestamp information is divided into time series segments. Assuming the preset time granularity is hours, the operation timestamp information is divided by hour, and the time interval corresponding to each hour is a time series segment. For example, if a key operation record occurs within a day, dividing it by hour will produce 24 time series segments, each representing a one-hour time interval.

[0018] Step S212: Count the key operation frequency in each time series segment to generate time dimension operation frequency distribution data.

[0019] Time-dimensional operation frequency distribution data refers to data that reflects the frequency distribution of key operations within different time intervals. Counting the key operation frequency within each time series segment can be achieved by traversing all time series segments and counting the operation records within each segment. For example, in the time series segments divided by hours mentioned above, for each time series segment corresponding to an hour, counting the number of key operation records within that segment yields the key operation frequency within that hour. Summarizing the operation frequencies of all time series segments generates time-dimensional operation frequency distribution data. Taking a power company's key management system as an example, by counting the key operation frequency within each hour, the operation frequency distribution at different hours of the day is obtained. This is the time-dimensional operation frequency distribution data, which intuitively reflects the temporal distribution pattern of key operations within a day.

[0020] Step S213: performing sliding window mean calculation processing on the time dimension operation frequency distribution data to obtain the dynamic change characteristics of the time dimension; wherein the window length of the sliding window mean calculation processing is adjusted according to the historical operation cycle of the user identification information.

[0021] Sliding window mean calculation is a method used to smooth data and identify dynamic trends in data. It slides a fixed-length window across the time-dimension operation frequency distribution data and calculates the mean of the data within the window, thereby generating a series of mean values. Dynamic time-dimension changes refer to characteristics that reflect the dynamic temporal trends in key operation frequency. The window length for the sliding window mean calculation is adjusted based on the historical operation cycle of the user identification information, allowing for more accurate capture of the operational patterns of different users. For example, if a user has a short historical operation cycle, the window length can be set smaller; if the historical operation cycle is longer, the window length can be set larger. Sliding window mean calculation on time-dimension operation frequency distribution data can be implemented using loops and array operations in programming languages. The specific steps are as follows: First, the window length is determined based on the historical operation cycle of the user identification information. Then, starting from the starting position of the time-dimension operation frequency distribution data, data segments of length equal to the window length are sequentially selected. The mean within each data segment is calculated and used as the calculation result for the current window position. Next, the window is moved back one position, and the above calculation process is repeated until all data has been traversed. For example, for hourly statistics of operation frequency distribution data in the time dimension, the window length is set to 3 hours. Starting from the first hour, the average operation frequency of the first 3 hours is calculated to obtain the calculation result of the first window position; then the window is slid back one hour, and the average operation frequency of the 2nd to 4th hours is calculated to obtain the calculation result of the second window position. And so on, finally a series of average data are obtained. These average data constitute the dynamic change characteristics of the time dimension.

[0022] Step S214: performing feature combination processing on the time dimension operation frequency distribution data and the time dimension dynamic change feature to generate an operation time distribution feature.

[0023] Feature combination processing involves integrating and fusing different types of features to generate more comprehensive and valuable features. There are various methods for combining time-dimensional operation frequency distribution data with time-dimensional dynamic change features, such as concatenating the two or performing a weighted summation. The operation time distribution feature combines both the operation frequency distribution and dynamic change trends, providing a more comprehensive picture of a user's key operation behavior over time. For example, a simple concatenation method involves concatenating the time-dimensional operation frequency distribution data and the time-dimensional dynamic change features according to their corresponding time series to generate a new feature vector. This feature vector constitutes the operation time distribution feature. For example, for hourly time-dimensional operation frequency distribution data and the corresponding time-dimensional dynamic change features, the operation frequency data and dynamic change feature data for each hour are concatenated sequentially to generate a new feature vector containing both operation frequency and dynamic change information. This feature vector, the operation time distribution feature, more accurately describes the user's key operation behavior patterns over time.

[0024] Step S220: performing operation type dimension decomposition processing on each key operation record in the key operation data set to generate operation type distribution features corresponding to each user identification information.

[0025] Operation type dimension decomposition involves breaking down and analyzing key operation records by operation type to uncover the distribution patterns of these operation types. Operation type distribution features reflect the distribution of user operations across different operation types, such as the frequency of occurrence of different operation types and the transition relationships between operation types. The following method can be used to perform operation type dimension decomposition on each key operation record in a key operation data set. First, key operation type information is extracted from each operation record. This information is then classified and statistically analyzed to calculate the frequency of occurrence of each operation type. Next, the correlation between consecutive operations of different operation types is analyzed, for example, by calculating the transition probability between operation types. Finally, these statistical and analytical results are integrated to generate an operation type distribution feature. For example, in a power monitoring system, for a user's key operation records, the frequency of the user's key generation, call, and deletion operations, as well as the transition probability between these operations, are statistically analyzed. This information constitutes the user's operation type distribution feature.

[0026] As an implementation manner, step S220 may specifically include the following steps S221 to S225: Step S221: Parse the key operation type information and identify three basic operation types: key generation operation, key call operation and key deletion operation.

[0027] Parsing key operation type information involves extracting information representing the operation type from key operation records, interpreting it, and classifying it. A key generation operation is an operation that creates a new key; a key call operation is an operation that uses an existing key; and a key deletion operation is an operation that deletes a key that is no longer needed. Parsing key operation type information can be achieved by performing string matching or regular expression matching on the operation type field in the operation record. For example, in a database storing key operation records, the value of the operation type field might be a string such as "key generation," "key call," or "key deletion." Using a string matching function, these values can be matched against the three predefined basic operation types, thereby identifying the operation type corresponding to each operation record.

[0028] Step S222: Count the occurrence frequencies of each basic operation type within a preset time period to generate operation type frequency distribution data.

[0029] A preset time period refers to a pre-set time range, such as a day or a week. Counting the frequency of each basic operation type within the preset time period can be achieved by traversing all key operation records within that time period and counting the records for each basic operation type. Operation type frequency distribution data refers to data reflecting the distribution of the frequency of each basic operation type within the preset time period. For example, if the preset time period is one day, the frequency of key generation, call, and deletion operations within that day can be counted to obtain distribution data that includes the frequencies of the three operation types.

[0030] Step S223: Calculate the continuous operation association between the basic operation types and generate an operation type conversion probability matrix.

[0031] The degree of continuous operation correlation refers to the degree of association between different basic operation types during consecutive operations. It can be measured by calculating the transition probabilities between operation types. The operation type transition probability matrix is a matrix whose elements represent the probability of transitioning from one operation type to another. Calculating the degree of continuous operation correlation between basic operation types can be achieved through the following steps. First, all key operation records are traversed, adjacent pairs of operation records are found, and the number of transitions for each operation type is counted. Then, based on the statistical results, the probability of each transition is calculated and these probabilities are added to the matrix to generate the operation type transition probability matrix. For example, in a sequence of key operation records, the number of transitions from key generation operation to key recall operation is counted as 15, and the number of transitions from key generation operation to key deletion operation is counted as 5. Based on these statistical results, the corresponding transition probabilities are calculated, such as the probability of transitioning from key generation operation to key recall operation is 15 / (15+5)=0.75. These probabilities are then combined into a 3x3 matrix, which is the operation type transition probability matrix, which reflects the transition patterns between different operation types.

[0032] Step S224: performing feature fusion processing on the operation type frequency distribution data and the operation type conversion probability matrix to generate a multi-dimensional operation type association feature.

[0033] Feature fusion processing involves integrating and fusing different types of features to generate more comprehensive and valuable features. There are various methods for fusing operation type frequency distribution data with the operation type conversion probability matrix, such as concatenating the two or performing a weighted summation. The multidimensional operation type association feature combines the operation type frequency distribution and the operation type conversion relationship, providing a more comprehensive reflection of users' key operation behaviors across the operation type dimension.

[0034] Step S225: performing feature dimensionality reduction processing on the multi-dimensional operation type association features to obtain operation type distribution features.

[0035] Feature dimensionality reduction involves reducing the dimensionality of features without losing too much important information, thereby improving data processing efficiency and model generalization. Various algorithms can be used to reduce the dimensionality of multidimensional operation type-related features, such as principal component analysis (PCA) and linear discriminant analysis (LDA). The operation type distribution feature, obtained after dimensionality reduction, retains the key information in the multidimensional operation type-related features and can more concisely reflect the characteristics of users' key operation behaviors along the operation type dimension. Taking the principal component analysis algorithm as an example, the specific steps for reducing the dimensionality of multidimensional operation type-related features are as follows. First, the multidimensional operation type-related features are normalized to have the same scale and range. Then, the covariance matrix of the features is calculated. By solving the eigenvalues and eigenvectors of the covariance matrix, the principal components of the data are obtained. The first N principal components with the largest eigenvalues are selected as the main features. The original features are projected onto these principal components to obtain the reduced eigenvectors. This reduced eigenvector is the operation type distribution feature.

[0036] Step S230: performing feature fusion processing on the operation time distribution feature and the operation type distribution feature to obtain an initial behavior feature vector of each user identification information.

[0037] Feature fusion involves integrating and fusing different types of features to generate more comprehensive and valuable features. Various methods can be used to fuse the operation time distribution features with the operation type distribution features, such as concatenating the two or performing a weighted summation. The initial behavior feature vector combines the operation time distribution and operation type distribution information, and can more comprehensively reflect each user's key operation behavior.

[0038] Step S240: Call the pre-trained feature enhancement network, perform feature space mapping processing on the initial behavior feature vector, and generate a key operation behavior feature set; wherein, the feature enhancement network is trained by normal operation feature samples in the historical key operation data set, and the feature space mapping processing is used to enhance the differences in the operation behavior characteristics of different user identification information.

[0039] The pre-trained feature enhancement network is a pre-trained neural network model that processes and transforms input features to enhance their expressiveness. Feature space mapping involves mapping the initial behavior feature vector from the original feature space to a new feature space. In this new feature space, the differences in the operational behavior characteristics of different user identification information are enhanced. The feature enhancement network is trained using samples of normal operation features from the historical key operation data set. This allows the network to learn the characteristic patterns of normal operation and better process new features. The specific process of calling the pre-trained feature enhancement network to perform feature space mapping on the initial behavior feature vector is as follows. First, the initial behavior feature vector is input to the feature enhancement network. The network then performs a series of processing and transformations on the input features, including encoding, decoupling, and nonlinear transformation. Finally, the network outputs the mapped feature vectors, which constitute the key operation behavior feature set. For example, in an electric power monitoring system, a pre-trained feature enhancement network is used to input a user's initial behavior feature vector into the network. After processing, the network outputs a set of new feature vectors. These feature vectors constitute the user's key operation behavior feature set, which can more clearly reflect the user's key operation behavior characteristics, and the feature differences between different users are enhanced.

[0040] As an implementation manner, step S240 may specifically include the following steps S241 to S249: Step S241: calling the first encoding processing layer in the feature enhancement network to perform multi-dimensional feature encoding processing on the initial behavior feature vector to generate an intermediate feature vector.

[0041] The first encoding layer is a crucial component of the feature enhancement network. It encodes input features, converting them into more expressive feature representations. Multi-dimensional feature encoding involves encoding the initial behavior feature vector along multiple dimensions to extract more feature information. The intermediate feature vector, obtained after processing by the first encoding layer, retains the key information in the initial behavior feature vector and, after encoding, has enhanced expressiveness. The first encoding layer in the feature enhancement network can perform multi-dimensional feature encoding on the initial behavior feature vector using a variety of encoding algorithms, such as autoencoders and convolutional neural networks (CNNs). For example, in an autoencoder, the first encoding layer can be the encoder portion of the autoencoder. It inputs the initial behavior feature vector, processes it through a series of neurons and activation functions, and compresses it into an intermediate feature vector.

[0042] Step S242: calling the feature decoupling layer in the feature enhancement network to separate the user behavior features from the operation mode features on the intermediate feature vector to obtain the user behavior feature vector and the operation mode feature vector.

[0043] The feature decoupling layer is a special layer in the feature enhancement network. Its main function is to separate the user behavior features and operation mode features in the intermediate feature vector. The user behavior feature vector is a feature vector that reflects the characteristics of individual user behavior, while the operation mode feature vector is a feature vector that reflects the common patterns and regularities of operation. Various methods can be used to separate the user behavior features from the operation mode features in the intermediate feature vector, such as independent component analysis (ICA) and factor analysis. Taking independent component analysis as an example, the feature decoupling layer takes the intermediate feature vector as input and decomposes it into the user behavior feature vector and the operation mode feature vector using the independent component analysis algorithm.

[0044] Step S243: calling the nonlinear transformation layer in the feature enhancement network to perform feature space nonlinear transformation processing on the user behavior feature vector to generate an enhanced user behavior feature vector.

[0045] The nonlinear transformation layer is a crucial component of the feature enhancement network. It performs nonlinear transformations on input features to enhance their expressiveness and discriminability. Nonlinear transformation of the feature space involves mapping the user behavior feature vector from the original feature space to a new nonlinear feature space. In this new feature space, the variability of user behavior features is enhanced. The nonlinear transformation layer in the feature enhancement network can be used to perform nonlinear transformations on the user behavior feature vector using various nonlinear functions, such as the ReLU function and the Sigmoid function. Taking the ReLU function as an example, the nonlinear transformation layer can take each element of the user behavior feature vector as input and perform a nonlinear transformation using the ReLU function to generate an enhanced user behavior feature vector. For example, for a user behavior feature vector containing multiple elements, after processing it through the nonlinear transformation layer, each element value is transformed using the ReLU function, resulting in a new feature vector. This feature vector is the enhanced user behavior feature vector, which has greater expressiveness and discriminability in the nonlinear feature space.

[0046] Step S244: calling the template matching layer in the feature enhancement network, performing pattern matching processing on the operation mode feature vector and the pre-stored historical normal operation mode feature template set, and generating a pattern difference feature vector.

[0047] The template matching layer is a special layer in the feature enhancement network. It matches the operation mode feature vector against a pre-stored set of historical normal operation mode feature templates, identifying the differences between the operation mode feature vector and the normal templates. The historical normal operation mode feature template set refers to a series of pre-stored feature templates representing normal operation modes. These templates are extracted by analyzing and extracting normal operation modes from historical key operation data. Pattern matching involves calculating the similarity between the operation mode feature vector and each historical normal operation mode feature template, identifying the best matching template, and calculating the difference between the operation mode feature vector and this template. The resulting pattern difference feature vector reflects the degree of difference between the operation mode feature vector and the normal operation mode. The template matching layer in the feature enhancement network can use a variety of similarity calculation methods for pattern matching, such as Euclidean distance and cosine similarity. Taking Euclidean distance as an example, the template matching layer calculates the Euclidean distance between the operation mode feature vector and each historical normal operation mode feature template, identifying the template with the smallest distance as the best match, and then calculating the difference between the operation mode feature vector and this template to obtain the pattern difference feature vector.

[0048] Step S245: calling the feature fusion layer in the feature enhancement network to perform cross-dimensional feature fusion processing on the enhanced user behavior feature vector and the pattern difference feature vector to generate a fused feature vector.

[0049] The feature fusion layer is an important component of the feature enhancement network. It can fuse different types of features to generate more comprehensive and valuable features. Cross-dimensional feature fusion processing refers to the fusion of enhanced user behavior feature vectors and pattern difference feature vectors in different dimensions to comprehensively consider user behavior characteristics and operation mode difference information. The generated fused feature vector is a feature vector that combines the enhanced user behavior characteristics and pattern difference characteristics. It can more comprehensively reflect the characteristics of the user's key operation behavior. Calling the feature fusion layer in the feature enhancement network to perform cross-dimensional feature fusion processing on the enhanced user behavior feature vector and the pattern difference feature vector can adopt various methods, such as splicing, weighted summation, etc.

[0050] Step S246: calling the second encoding processing layer in the feature enhancement network to perform low-dimensional space projection processing on the fused feature vector to generate a standardized behavior feature vector.

[0051] The second encoding layer is a crucial component of the feature enhancement network. It encodes the input features and projects them into a low-dimensional space. Low-dimensional space projection involves mapping the fused feature vector from a high-dimensional feature space to a low-dimensional space, reducing the dimensionality of the features and improving data processing efficiency and model generalization. The standardized behavioral feature vector is the feature vector obtained after processing by the second encoding layer. It has a standardized form in low-dimensional space, facilitating subsequent processing and analysis. The second encoding layer in the feature enhancement network can be used to project the fused feature vector into a low-dimensional space using various encoding algorithms, such as principal component analysis (PCA) and linear discriminant analysis (LDA). Taking PCA as an example, the second encoding layer takes the fused feature vector as input and projects it into a low-dimensional space using the PCA algorithm to generate a standardized behavioral feature vector.

[0052] Step S247: Perform residual connection processing on the standardized behavior feature vector and the user behavior feature vector to generate a final enhanced feature vector.

[0053] Residual connection processing is a commonly used technique in neural networks that connects the outputs of different layers to retain more information and features. Residual connection processing of the standardized behavior feature vector and the user behavior feature vector can be achieved by adding the two together. The final enhanced feature vector is the feature vector obtained after residual connection processing. It combines the information of standardized behavior features and user behavior features and has stronger expressive power and discrimination. For example, for a standardized behavior feature vector containing multiple elements and a user behavior feature vector containing multiple elements, their corresponding elements are added together to obtain a new feature vector. This feature vector is the final enhanced feature vector. In an electric power monitoring system, the standardized behavior feature vector and the user behavior feature vector are fused through residual connection processing. The final enhanced feature vector obtained can more comprehensively reflect the user's key operation behavior characteristics and has better performance in subsequent analysis and detection.

[0054] Step S248: Match the target cluster center vector from a preset feature cluster center set according to the feature dimension distribution of the final enhanced feature vector.

[0055] The preset feature cluster center set refers to a series of pre-set cluster center vectors, which represent different cluster categories. According to the feature dimension distribution of the final enhanced feature vector, matching the target cluster center vector from the preset feature cluster center set can be achieved by calculating the similarity between the final enhanced feature vector and each cluster center vector. The target cluster center vector is the cluster center vector that is most similar to the final enhanced feature vector, which represents the cluster category to which the final enhanced feature vector belongs. There are many methods that can be used to calculate the similarity between the final enhanced feature vector and each cluster center vector, such as Euclidean distance, cosine similarity, etc. Taking Euclidean distance as an example, for the final enhanced feature vector and each cluster center vector in the preset feature cluster center set, the Euclidean distance between them is calculated, and the cluster center vector with the smallest distance is found as the target cluster center vector.

[0056] Step S249: performing feature alignment processing on the final enhanced feature vector and the target cluster center vector to generate a key operation behavior feature set.

[0057] Feature alignment processing refers to adjusting and matching the final enhanced feature vector with the target cluster center vector to eliminate the feature distribution offset between them, so that the final enhanced feature vector is more consistent with the cluster category represented by the target cluster center vector. The generated key operation behavior feature set is a feature set obtained after feature alignment processing. It can more accurately reflect the user's key operation behavior characteristics, and the feature differences between different users are further enhanced. There are many methods that can be used to perform feature alignment processing on the final enhanced feature vector and the target cluster center vector, such as linear transformation, normalization, etc. Taking linear transformation as an example, the final enhanced feature vector can be linearly transformed by calculating the linear transformation relationship between the final enhanced feature vector and the target cluster center vector to align it with the target cluster center vector.

[0058] Step S300: Inputting the key operation behavior feature set into a pre-built key behavior analysis model to generate a key behavior dynamic score for each user identification information.

[0059] The pre-built key behavior analysis model is a pre-trained model that analyzes and processes the input key operation behavior feature set to generate a dynamic key behavior score for each user identity. This score reflects the similarity between a user's key operation behavior and normal behavior patterns. A higher score indicates a closer approximation to normal behavior, while a lower score indicates a higher likelihood of abnormal behavior. When the key operation behavior feature set is input into the pre-built key behavior analysis model, the model performs a series of processing and calculations on the input features, including feature matching, anomaly detection, and trend prediction, ultimately generating a dynamic key behavior score for each user identity.

[0060] As an implementation manner, step S300 may specifically include the following steps S310 to S340: Step S310: calling the feature matching layer in the key behavior analysis model, performing similarity calculation processing on the key operation behavior feature set and the historical normal behavior feature template, and generating an initial behavior matching score.

[0061] The feature matching layer is an important component of the key behavior analysis model. It can perform similarity calculations on the input key operation behavior feature set and the historical normal behavior feature templates to find the degree of matching between the key operation behavior features and the normal templates. The historical normal behavior feature templates refer to a series of pre-stored feature templates representing normal operation behaviors. These templates are obtained by analyzing and extracting normal operation behaviors in historical key operation data. The similarity calculation process refers to performing similarity calculations on each feature vector in the key operation behavior feature set and each historical normal behavior feature template to find the most matching template and calculate the matching score. The generated initial behavior matching score reflects the degree of similarity between the key operation behavior features and the normal behavior pattern. A variety of similarity calculation methods can be used to call the feature matching layer in the key behavior analysis model for similarity calculation processing, such as Euclidean distance, cosine similarity, etc.

[0062] As an implementation manner, step S310 may specifically include the following steps S311 to S3110: Step S311: obtaining historical operation time period division data corresponding to the user identification information, and extracting periodic operation feature segments based on the historical operation time period division data.

[0063] Historical operation time period division data refers to the division information of different operation time periods during the user's historical operation process, such as dividing a day into different time periods, each time period corresponding to a different operation mode. Periodic operation feature segments refer to operation feature segments with periodic patterns extracted from historical operation data. These feature segments can reflect the periodic patterns of the user's operation behavior over time. Obtaining the historical operation time period division data corresponding to user identification information can be achieved by querying the historical operation record database. The database records information such as each user's operation time and operation type. By analyzing and processing this information, the historical operation time period division data can be obtained. Time series analysis methods such as Fourier transform and wavelet transform can be used to extract periodic operation feature segments based on historical operation time period division data.

[0064] Step S312: Perform dynamic time warping on the key operation behavior feature set to generate a timing matching feature vector aligned with the periodic operation feature segment.

[0065] Dynamic time warping is a method for processing time series data that can find the optimal match between two time series, regardless of their length or time interval. Dynamic time warping is performed on a key operation behavior feature set to align it with a periodic operation feature segment and find the optimal match between them. The resulting time series matching feature vector is a feature vector obtained after dynamic time warping. It is temporally aligned with the periodic operation feature segment, facilitating subsequent similarity calculation and matching. Dynamic time warping of key operation behavior feature sets can be performed using a dynamic programming algorithm, such as the dynamic time warping (DTW) algorithm. This algorithm constructs a two-dimensional cost matrix and calculates the optimal matching path between the two time series, thereby achieving time series alignment. For example, in an electric power monitoring system, the key operation behavior feature set represents the current operation behavior features, and the periodic operation feature segment represents the historical periodic operation features. The key operation behavior feature set is processed using a dynamic time warping algorithm to generate a timing matching feature vector aligned with the periodic operation feature segment. This vector can more accurately reflect the matching relationship between the current operation behavior and the historical periodic operation behavior.

[0066] Step S313: performing time window sliding feature extraction processing on the time series matching feature vector to generate a multi-scale time series correlation feature set.

[0067] Time window sliding feature extraction involves sliding a fixed-length window across the time series matching feature vector to extract feature information within the window and generate multi-scale time series correlation features. A multi-scale time series correlation feature set is a collection of time series correlation features at multiple scales. These features reflect the correlation between the time series matching feature vectors at different time scales. The following steps can be used to perform time window sliding feature extraction on the time series matching feature vector. First, the length of the time window and the sliding step size are determined. Then, starting from the starting position of the time series matching feature vector, data segments with a length equal to the window length are sequentially selected and feature extraction is performed on these data segments, such as calculating statistical features such as mean, variance, maximum, and minimum values. Next, the window is slid backward by one step size, and the above feature extraction process is repeated until all data has been traversed. Finally, all extracted features are combined into a multi-scale time series correlation feature set.

[0068] Step S314: performing layer-by-layer similarity comparison processing on the multi-scale time series correlation feature set and the historical normal behavior feature template to generate initial matching degree distribution data.

[0069] Layer-by-layer similarity comparison involves calculating the similarity between each feature vector in the multi-scale temporal correlation feature set and the historical normal behavior feature template to determine the degree of match. The initial matching distribution data contains multiple matching scores, reflecting the distribution of the matching degree between the multi-scale temporal correlation feature set and the historical normal behavior feature template across different feature vectors. Layer-by-layer similarity comparisons between the multi-scale temporal correlation feature set and the historical normal behavior feature template can be performed using a variety of similarity calculation methods, such as Euclidean distance and cosine similarity.

[0070] Step S315: Perform attention weight allocation processing on the initial matching degree distribution data to generate matching degree weight coefficients for each time window.

[0071] Attention weighting involves assigning different weights to each match score in the initial match distribution data based on the importance of the feature dimension, thereby highlighting the impact of important features. The resulting match weight coefficient for each time window is a set of multiple weight coefficients that reflect the importance of each time window's match score in the final score. Various methods can be used to assign attention weights to the initial match distribution data, such as weighted averaging based on feature importance and deep learning-based attention mechanisms. For example, the weighted averaging method can analyze the impact of each feature dimension on the final score and assign different weights to each match score. For example, feature dimensions closely related to operational behavior patterns can be assigned higher weights, while feature dimensions less relevant to operational behavior patterns can be assigned lower weights. Applying these weight coefficients to the initial match distribution data generates the match weight coefficients for each time window.

[0072] Step S316: performing weighted fusion processing on the multi-scale temporal correlation feature set based on the matching weight coefficient to generate a comprehensive matching feature vector.

[0073] Weighted fusion processing involves weighting and summing each eigenvector in a multi-scale time series correlation feature set according to a matching weight coefficient to generate a comprehensive feature vector. The comprehensive matching feature vector is the feature vector obtained after weighted fusion. It integrates the information of each eigenvector in the multi-scale time series correlation feature set and takes into account the importance of each eigenvector. Weighted fusion processing of a multi-scale time series correlation feature set based on matching weight coefficients can be performed using the following steps. First, each eigenvector in the multi-scale time series correlation feature set is multiplied by the corresponding matching weight coefficient. Then, all multiplied eigenvectors are summed to obtain a comprehensive matching feature vector. For example, for a multi-scale time series correlation feature set containing multiple eigenvectors, each eigenvector corresponds to a matching weight coefficient. Each eigenvector is multiplied by the corresponding weight coefficient, and then all multiplied eigenvectors are summed to obtain a new feature vector, which is the comprehensive matching feature vector.

[0074] Step S317: Generate a dynamic attenuation coefficient according to the interval between the current operation timestamp and the historical normal operation time period.

[0075] The dynamic attenuation coefficient is a coefficient used to reflect the impact of the time interval between the current operation behavior and the historical normal operation behavior. The longer the time interval, the smaller the dynamic attenuation coefficient, indicating that the correlation between the current operation behavior and the historical normal operation behavior is lower. An exponential decay function can be used to generate the dynamic attenuation coefficient based on the interval length between the current operation timestamp and the historical normal operation time period. The specific steps are as follows: First, calculate the interval length between the current operation timestamp and the historical normal operation time period. Then, substitute the interval length into the exponential decay function to calculate the dynamic attenuation coefficient. For example, the exponential decay function can be expressed as: f(t)=e -αt , where t is the interval duration and α is the attenuation coefficient, which is adjusted according to actual conditions. In a power monitoring system, the current operation timestamp represents the time when the current operation occurred, and the historical normal operation time period is the time period when normal operations occurred in history. By calculating the interval duration between them and substituting it into the exponential decay function, the dynamic attenuation coefficient is obtained. This coefficient can be used in subsequent product operations to consider the impact of the time interval on the matching degree.

[0076] Step S318: Perform a product operation on the comprehensive matching degree feature vector and the dynamic attenuation coefficient to generate an attenuation-corrected matching degree index.

[0077] The product operation involves multiplying each element in the comprehensive matching feature vector by the dynamic attenuation coefficient to obtain a matching index that has been adjusted for attenuation. This attenuation-corrected matching index, obtained after the product operation, takes into account the time interval between the current operating behavior and historically normal operating behavior, more accurately reflecting the degree of match between the current operating behavior and the normal behavior pattern. The following steps can be used to perform the product operation on the comprehensive matching feature vector and the dynamic attenuation coefficient. First, each element in the comprehensive matching feature vector is multiplied by the dynamic attenuation coefficient. Then, the multiplied elements are combined into a new vector, which is the attenuation-corrected matching index. For example, for a comprehensive matching feature vector containing multiple elements, each element is multiplied by the dynamic attenuation coefficient to obtain a new vector, which is the attenuation-corrected matching index. In a power monitoring system, the attenuation-corrected matching index obtained by multiplying the comprehensive matching feature vector by the dynamic attenuation coefficient can more accurately reflect the degree of normality of the current operating behavior after accounting for the time interval.

[0078] Step S319: performing nonlinear activation processing on the attenuation-corrected matching index to generate a normalized matching score.

[0079] Nonlinear activation involves transforming the decay-corrected matching index through a nonlinear function to map it to a set range, typically [0, 1], thereby obtaining a normalized matching score. This nonlinear activation can be performed using a variety of nonlinear functions, such as the Sigmoid function and the ReLU function.

[0080] Step S3110: performing a difference calculation between the normalized matching score and a preset benchmark matching threshold to generate an initial behavior matching score.

[0081] The preset baseline match threshold is a pre-set threshold used to determine whether operational behavior is normal. It represents the boundary between normal and abnormal operational behavior. The difference between the normalized match score and the preset baseline match threshold is calculated to obtain a score that reflects the degree to which the current operational behavior deviates from the normal behavior pattern. The initial behavioral match score generated after this difference calculation can be used to preliminarily determine whether the current operational behavior is normal. The difference between the normalized match score and the preset baseline match threshold can be calculated using the following steps. First, the preset baseline match threshold is subtracted from the normalized match score. Then, based on the sign and magnitude of the difference, the initial behavioral match score is obtained. For example, if the difference is positive, it indicates that the current operational behavior closely matches the normal behavior pattern, and the initial behavioral match score can be set to a higher value. If the difference is negative, it indicates that the current operational behavior closely matches the normal behavior pattern, and the initial behavioral match score can be set to a lower value.

[0082] Step S320: calling the anomaly detection layer in the key behavior analysis model, performing outlier analysis on the key operation behavior feature set, and generating a behavior deviation score.

[0083] The anomaly detection layer is a critical component of the key behavior analysis model. It detects anomalies in the input key operation behavior feature set, identifying outliers and determining whether the operation behavior is abnormal. Outlier analysis involves analyzing the data distribution within the key operation behavior feature set to identify points that deviate significantly from the majority. These points are considered outliers and may represent abnormal operation behavior. The behavior deviation score reflects the degree to which key operation behavior deviates from normal patterns. A higher score indicates a greater deviation from normal patterns and a higher likelihood of anomaly. The anomaly detection layer in the key behavior analysis model can perform outlier analysis on the key operation behavior feature set using various methods, such as statistical and machine learning. For example, statistical methods can calculate the mean and standard deviation of each feature vector in the key operation behavior feature set. Based on these values, points that deviate from the mean by more than a preset multiple of the standard deviation are identified as outliers. The behavior deviation score is calculated based on the number and degree of deviation of the outliers.

[0084] Step S330: calling the trend prediction layer in the key behavior analysis model to predict the behavior trend change value in the future time period based on the key operation behavior feature set.

[0085] The trend prediction layer predicts behavior trend changes for future time periods based on the input key operation behavior feature set. This behavior trend change value reflects the potential change trend of key operation behavior in the future time period, helping to detect potential abnormal operation behavior in advance. The trend prediction layer in the key behavior analysis model can use various time series prediction methods, such as ARIMA models and LSTM models, to predict behavior trend changes for future time periods based on the key operation behavior feature set. For example, the LSTM model is a long short-term memory network that can handle long-term dependencies in time series data. The key operation behavior feature set is fed into the LSTM model, which learns the time series patterns in the data and then predicts behavior trend changes for future time periods based on these patterns. For example, in a power monitoring system, the key operation behavior feature set represents the current operation behavior. The trend prediction layer predicts behavior trend changes for future time periods, which can be used to provide early warning of potential abnormal operation behavior.

[0086] Step S340: The initial behavior matching score, the behavior deviation score and the behavior trend change value are weighted and fused to generate a key behavior dynamic score; wherein the weight coefficient of the weighted fusion processing is dynamically adjusted according to the historical operation stability of the user identification information.

[0087] Weighted fusion processing involves weighting and summing the initial behavior match score, behavior deviation score, and behavior trend change value according to their respective weighting coefficients to generate a comprehensive score. The dynamic key behavior score is the score obtained after this weighted fusion process. It integrates information such as the initial behavior match, behavior deviation, and behavior trend change, more comprehensively reflecting the similarity between a user's key operation behavior and normal behavior patterns. The weighting coefficients in this weighted fusion process are dynamically adjusted based on the historical stability of the user's identification information. The more stable the user's historical operation, the higher the weight coefficient of the initial behavior match score; the more unstable the user's historical operation, the higher the weight coefficients of the behavior deviation score and behavior trend change value. The weighted fusion process for the initial behavior match score, behavior deviation score, and behavior trend change value can be performed using the following steps. First, the weight coefficients for each score are determined based on the historical stability of the user's identification information. Then, the initial behavior match score, behavior deviation score, and behavior trend change value are multiplied by the corresponding weight coefficients. Finally, the multiplied results are summed to obtain the dynamic key behavior score.

[0088] As an implementation method, the process of constructing the key behavior analysis model includes the following steps S101 to S1010: Step S101: Obtain key operation log data corresponding to all user identification information within a historical time period, and annotate abnormal operations to generate a training sample set.

[0089] The historical time period refers to a pre-defined time range during which key operation log data corresponding to all user identification information is collected. Key operation log data records all user operations during key usage, including information such as operation time, operation type, and user identification. Abnormal operation annotation refers to the process of marking abnormal operations in the key operation log data for subsequent training and detection. The generated training sample set, consisting of both normal and abnormal operation samples, is used to train the key behavior analysis model. Key operation log data corresponding to all user identification information within the historical time period can be obtained by querying the key management system's log database. The database records key operation log information for each user. By setting time ranges and user identification conditions, the required log data can be retrieved. Abnormal operation annotation can be performed manually or through rule-based automatic annotation. Manual annotation requires professional personnel to carefully analyze the log data, determine whether each operation is abnormal, and then label it accordingly. Rule-based automatic annotation automatically determines whether an operation is abnormal and labels it accordingly based on pre-set rules, such as operation time and operation type. For example, in an electric power monitoring system, the key operation log data of all users in the past month is obtained by querying the log database, and then a rule-based automatic labeling method is used to mark the key operations performed during irregular periods as abnormal operations. Finally, a training sample set containing normal operation samples and abnormal operation samples is generated for subsequent model training.

[0090] Step S102: performing time dimension segmentation processing on the training sample set to generate a training data block set and a verification data block set with continuous operation characteristics.

[0091] Time dimension segmentation processing refers to dividing the training sample set in chronological order and splitting it into multiple data blocks with continuous operation characteristics. A data block with continuous operation characteristics refers to a set of operation samples that are continuous in time. These samples reflect the user's continuous operation behavior over a period of time. The generated training data block set is used to train the key behavior analysis model, and the verification data block set is used to verify the performance of the model. The time dimension segmentation processing of the training sample set can be performed using a fixed time window segmentation method or a sliding time window segmentation method. Fixed time window segmentation refers to dividing the training sample set according to a fixed time length. For example, a training sample set of one month is segmented according to a time length of one week to obtain multiple data blocks of one week length; sliding time window segmentation refers to using a fixed-length time window to slide on the training sample set, each sliding with a fixed step size, to obtain multiple overlapping or non-overlapping data blocks.

[0092] Step S103: Initialize the behavior analysis model structure, which includes a cascade processing unit of a feature interaction layer, a dynamic scoring layer, and an abnormality discrimination layer.

[0093] The structure of a behavior analysis model refers to its overall architecture and components, which determine its functionality and performance. The feature interaction layer, dynamic scoring layer, and anomaly detection layer are three key components of a behavior analysis model. These are connected through cascaded processing units to form a complete model structure. The feature interaction layer interacts and fuses input features to extract more valuable feature information. The dynamic scoring layer generates dynamic scores based on feature information, reflecting the similarity between user behavior and normal patterns. The anomaly detection layer determines whether the behavior is abnormal based on the dynamic scores. Initializing the behavior analysis model structure can use model building methods within deep learning frameworks. During model construction, the structure and parameters of each layer are defined. For example, the feature interaction layer can use a multilayer perceptron (MLP) structure, the dynamic scoring layer a linear regression model, and the anomaly detection layer a logistic regression model. For example, in a power monitoring system, the feature interaction layer is defined as an MLP structure with two hidden layers, the dynamic scoring layer a linear regression model, and the anomaly detection layer a logistic regression model. These three layers are connected through cascaded processing units to complete the model initialization.

[0094] Step S104: using the training data block set to perform multiple rounds of comparative training on the feature interaction layer to optimize the clustering density of the normal operation features in the latent space.

[0095] Multi-round contrastive training involves repeatedly training the feature interaction layer using a set of training data blocks. By comparing normal and abnormal operation features, the parameters of the feature interaction layer are optimized, resulting in tighter clustering of normal operation features in the latent space. The latent space is the abstract space to which the feature interaction layer maps input features. In this space, feature representation is more compact and discriminative. Optimizing the tightness of clustering of normal operation features in the latent space improves the model's ability to distinguish between normal and abnormal operation behaviors. Multi-round contrastive training of the feature interaction layer using a set of training data blocks can be performed using the following steps. First, samples of normal operation features and samples of abnormal operation features are randomly sampled from the training data blocks to form a set of positive and negative sample pairs. Then, the latent space distance between the two normal operation features in each positive pair is calculated to generate a feature similarity metric. The cross-category difference between the normal and abnormal operation features in each negative pair is calculated to generate a feature discrimination index. Next, a contrastive loss function is constructed based on the feature similarity metric and the feature discrimination index to drive the parameter update direction of the feature interaction layer. During training, a difficult sample screening mechanism is introduced to repeatedly sample and enhance sample pairs in boundary regions of the feature space. Dynamic weighting of the contrast loss function is also applied to balance the learning intensity of samples from different operation types. After each training cycle, a feature cluster separation index is calculated using a validation data set, and the sample sampling ratio for the next cycle is dynamically adjusted. Training is terminated when the feature cluster separation index reaches a preset convergence threshold, generating optimized feature interaction layer parameters.

[0096] As an implementation manner, step S104 may specifically include the following steps S1041 to S1048: Step S1041: Randomly extract normal operation feature samples and abnormal operation feature samples from the training data block set to form a set of positive and negative sample pairs.

[0097] Normal operation feature samples refer to feature samples in the training data block set that represent normal operation behavior, and abnormal operation feature samples refer to feature samples that represent abnormal operation behavior. A positive and negative sample pair set is a set containing positive sample pairs and negative sample pairs, where a positive sample pair consists of two normal operation feature samples, and a negative sample pair consists of one normal operation feature sample and one abnormal operation feature sample. A random sampling method can be used to randomly extract normal operation feature samples and abnormal operation feature samples from the training data block set to form a positive and negative sample pair set. For example, in an electric power monitoring system, the training data block set contains a large number of normal operation feature samples and abnormal operation feature samples. Using a random sampling method, a preset number of normal operation feature samples and abnormal operation feature samples are randomly extracted from the training data block set, and they are combined into a positive and negative sample pair set for subsequent comparative training processing.

[0098] Step S1042: performing latent space distance calculation on the two normal operation features in each positive sample pair to generate a feature similarity measurement value.

[0099] Latent space distance calculation involves mapping the two normal operation features in a positive sample pair into the latent space of the feature interaction layer and calculating their distance in the latent space. The feature similarity metric reflects the degree of similarity between two normal operation features in the latent space; the smaller the distance, the higher the similarity. Various distance calculation methods can be used to calculate the latent space distance between the two normal operation features in each positive sample pair, such as Euclidean distance and cosine similarity.

[0100] Step S1043: performing cross-category difference calculation processing on the normal operation features and abnormal operation features in each negative sample pair to generate a feature discrimination index.

[0101] Cross-category dissimilarity calculation involves mapping the normal and abnormal operating features in a negative sample pair into the latent space of the feature interaction layer and calculating their degree of difference in the latent space. The feature discrimination metric reflects the degree of distinction between normal and abnormal operating features in the latent space; greater differences indicate higher discrimination. Various dissimilarity calculation methods can be used to calculate the cross-category dissimilarity between the normal and abnormal operating features in each negative sample pair, such as Euclidean distance and Mahalanobis distance.

[0102] Step S1044: constructing a contrast loss function based on the feature similarity measure and the feature discrimination index to drive the parameter update direction of the feature interaction layer.

[0103] The contrastive loss function is a function used to measure the similarity and difference between positive and negative sample pairs in the latent space. Its goal is to make the two normal operation features in the positive sample pair closer in the latent space, and the normal operation feature and abnormal operation feature in the negative sample pair further apart in the latent space. The contrastive loss function can be constructed based on the feature similarity metric and the feature discrimination index using the following formula: ; Where N is the number of sample pairs, y i is the label of the sample pair (y i =0 indicates a positive sample pair, y i =1 indicates a negative sample pair), d iis the distance between pairs of samples in the latent space (feature similarity for positive pairs and feature discrimination for negative pairs), m is a preset boundary value, and α and β are weight coefficients. By minimizing the contrastive loss function, we can drive the parameter update direction of the feature interaction layer, so that normal operation features are more closely clustered in the latent space and abnormal operation features are further separated from normal operation features in the latent space.

[0104] Step S1045: introduce a difficult sample screening mechanism to perform repeated sampling enhancement processing on sample pairs in the boundary area of the feature space.

[0105] The difficult sample screening mechanism involves filtering out sample pairs that are difficult to distinguish during training, specifically those in the border region of the feature space. These pairs are then repeatedly sampled and augmented to improve the model's ability to learn these difficult samples. Sample pairs in the border region of the feature space are those where the normal and abnormal operation features are close in the latent space, posing a challenge to the model's ability to distinguish them. Density-based screening methods, such as the DBSCAN algorithm, can be used to introduce this difficult sample screening mechanism. This algorithm identifies sample pairs in the border region based on the density distribution of samples in the feature space. Repeated sampling and augmentation of these sample pairs increases their proportion in the training data, allowing the model to focus more on these difficult samples.

[0106] Step S1046: Dynamically weight the contrast loss function to balance the learning intensity of samples of different operation types.

[0107] Dynamic weight allocation refers to the dynamic adjustment of the weight coefficients in the contrastive loss function based on the number and importance of samples of different operation types to balance the learning intensity of samples of different operation types. The number of samples of different operation types may be unbalanced, with some operation types having more samples and others having fewer samples. Without weight allocation, the model may tend to learn operation types with more samples and ignore operation types with fewer samples. Dynamic weight allocation for the contrastive loss function can use a weight allocation method based on the number of samples, such as allocating weights based on the inverse of the number of samples of different operation types. The fewer the number of samples of an operation type, the larger the corresponding weight coefficient, which makes the model pay more attention to operation types with fewer samples.

[0108] Step S1047: After each training cycle, the verification data block set is used to calculate the feature cluster separation index, and the sample sampling ratio of the next cycle is dynamically adjusted.

[0109] The feature cluster separation index reflects the degree of cluster separation between normal and abnormal operation features in the latent space. It can measure the performance of the model in the current training cycle. After each training cycle, the feature cluster separation index is calculated using a validation data set by calculating indicators such as the center distance and cluster radius of normal and abnormal operation features in the latent space. Dynamically adjusting the sample sampling ratio for the next cycle refers to adjusting the sampling ratio of normal and abnormal operation feature samples in the next cycle based on the size of the feature cluster separation index. If the feature cluster separation index is small, it indicates that the degree of cluster separation between normal and abnormal operation features in the latent space is poor. In this case, the sampling ratio of abnormal operation feature samples should be increased to make the model pay more attention to abnormal operation features. If the feature cluster separation index is large, it indicates that the degree of cluster separation between normal and abnormal operation features in the latent space is good. In this case, the sampling ratio of abnormal operation feature samples can be appropriately reduced.

[0110] Step S1048: When the feature cluster separation index reaches a preset convergence threshold, the training process is terminated and optimized feature interaction layer parameters are generated.

[0111] The preset convergence threshold is a pre-set threshold used to determine whether the training process has converged. When the feature cluster separation index reaches the preset convergence threshold, it indicates that the model has learned sufficient information and that normal and abnormal operation features have achieved a good degree of cluster separation in the latent space. At this point, the training process can be terminated. The generated optimized feature interaction layer parameters are those obtained after multiple iterative updates during the training process. These parameters enable the feature interaction layer to better interact and fuse input features, extracting more valuable feature information.

[0112] Step S105: Using the verification data block set to perform stability verification processing on the dynamic scoring layer, and adjusting the time-sensitive parameters of the scoring generation logic.

[0113] Stability verification involves using a set of validation data blocks to verify the performance of the dynamic scoring layer and check whether the scores generated by the dynamic scoring layer are stable and reliable. The time-sensitive parameters of the scoring generation logic refer to time-related parameters that affect the scores generated by the dynamic scoring layer, such as the time decay factor. Adjusting the time-sensitive parameters of the scoring generation logic is intended to ensure that the scores generated by the dynamic scoring layer more accurately reflect the similarity between user operations and normal behavior patterns. Using a set of validation data blocks to verify the stability of the dynamic scoring layer can be achieved by calculating statistical indicators such as the standard deviation and variance of the scores generated by the dynamic scoring layer. If the standard deviation or variance of the scores is large, it indicates that the scores are unstable, and the time-sensitive parameters of the scoring generation logic need to be adjusted.

[0114] Step S106: inject historical abnormal operation mode features into the abnormality discrimination layer, generate an abnormal feature matching template library and establish a dynamic update mechanism.

[0115] Historical abnormal operation pattern features are features extracted from historical operation data that represent abnormal operation patterns. Injecting these features into the anomaly detection layer enables it to better identify abnormal operation behavior. The abnormal feature matching template library contains multiple abnormal feature matching templates. These templates can be used to match input operation features to determine whether the operation behavior is abnormal. Establishing a dynamic update mechanism involves incrementally updating the abnormal feature matching template library based on newly detected abnormal pattern features, ensuring that the template library promptly reflects the latest abnormal operation patterns. Injecting historical abnormal operation pattern features into the anomaly detection layer can be achieved by storing them in the memory of the anomaly detection layer and comparing them with the input operation features during the detection process. Generating the abnormal feature matching template library allows clustering and extracting the historical abnormal operation pattern features to generate multiple representative abnormal feature matching templates. The dynamic update mechanism can employ incremental learning. When new abnormal pattern features are detected, they are added to the abnormal feature matching template library, and the cluster centers and classification rules of the template library are updated.

[0116] Step S107: performing cross-level feature fusion processing on the enhanced feature vector output by the feature interaction layer to generate an input feature set for the dynamic scoring layer.

[0117] Cross-level feature fusion involves fusing the enhanced feature vectors output by the feature interaction layer with other relevant features to generate a more comprehensive and valuable feature set. The dynamic scoring layer's input feature set consists of multiple features, which serve as input to the dynamic scoring layer to generate dynamic scores. Various methods can be used to perform cross-level feature fusion on the enhanced feature vectors output by the feature interaction layer, such as concatenation and weighted summation.

[0118] Step S108: Introduce a time decay factor calculation unit into the dynamic scoring layer to establish a negative correlation between the scoring result and the historical operation time interval.

[0119] The time decay factor calculation unit is a unit for calculating the time decay factor, which is a factor that reflects the impact of historical operation time intervals on the scoring result. Establishing a negative correlation between the scoring result and the historical operation time interval means that as the historical operation time interval increases, the scoring result gradually decreases, indicating that the longer the historical operation time interval, the lower the correlation between the current operation behavior and the historical normal operation behavior. Introducing the time decay factor calculation unit in the dynamic scoring layer can use an exponential decay function (such as the function in step S317) to calculate the time decay factor. The time decay factor is multiplied by the original scoring result generated by the dynamic scoring layer to obtain the final scoring result, thereby establishing a negative correlation between the scoring result and the historical operation time interval.

[0120] Step S109: Iteratively tune the complete model by verifying the data block set to select model parameters that meet the preset accuracy and real-time requirements.

[0121] Iterative tuning refers to the use of a set of validation data blocks to perform multiple iterative training and adjustments on the complete model to optimize the model's parameters and improve its performance. Preset accuracy and real-time requirements refer to the pre-set accuracy and real-time requirements of the model, such as an accuracy rate of over 90% and real-time requirements that require a test to be completed within a set time. The following steps can be used to iteratively tune the complete model using a set of validation data blocks. First, the complete model is evaluated using the validation data block set to calculate the model's accuracy and real-time indicators. Then, the model's parameters are adjusted based on the evaluation results, such as adjusting the parameters of the feature interaction layer and the time-sensitive parameters of the dynamic scoring layer. Next, the adjusted model is evaluated again using the validation data block set, and the above process is repeated until the model meets the preset accuracy and real-time requirements.

[0122] Step S1010: Solidify and deploy the tuned model parameters to the production environment, and establish a real-time data interface between the model output results and the security response system.

[0123] Deploying the tuned model parameters to the production environment means saving the model parameters obtained after iterative tuning and deploying them to the actual production environment, allowing the model to operate normally in the production environment. Establishing a real-time data interface between the model output results and the security response system means transmitting the anomaly detection results output by the model to the security response system in real time, allowing the security response system to take appropriate measures in a timely manner. Deploying the tuned model parameters to the production environment can be done by using model saving and loading methods. For example, using the model saving function in the deep learning framework to save the model parameters to a file, and then using the model loading function in the production environment to load these parameters. Establishing a real-time data interface between the model output results and the security response system can use technologies such as message queues and RESTful APIs.

[0124] Step S400: performing anomaly comparison processing based on the dynamic score of key behavior and a preset historical behavior score threshold to generate a key anomaly detection result set of the target user.

[0125] Anomaly comparison processing involves comparing the dynamic score of key behavior with a preset historical behavior score threshold to determine whether the user's key operation behavior is abnormal. The preset historical behavior score threshold is a pre-set threshold used to determine whether operation behavior is normal. It represents the boundary between normal and abnormal operation behavior. The generated target user's key anomaly detection result set is a set of multiple anomaly detection results. These results reflect whether the target user's key operation behavior is abnormal at different time points. The following steps can be used to perform anomaly comparison processing based on the dynamic score of key behavior and the preset historical behavior score threshold. First, obtain the dynamic score of key behavior of the target user. Then, compare the dynamic score of key behavior with the preset historical behavior score threshold. If the dynamic score of key behavior is lower than the threshold, the operation behavior at that time point is considered abnormal; if the dynamic score of key behavior is higher than the threshold, the operation behavior at that time point is considered normal. Finally, the anomaly detection results of all time points are combined into a set to obtain the target user's key anomaly detection result set.

[0126] As an implementation manner, step S400 may specifically include the following steps S410 to S4100: Step S410: Obtain a historical behavior score distribution curve corresponding to the user identification information, and perform sliding window mean processing on the historical behavior score distribution curve to generate a dynamic benchmark score sequence.

[0127] The historical behavior score distribution curve records the time-varying changes in a user's key behavior score during their historical operations. It reflects the historical stability and normality of the user's operational behavior. Sliding window averaging involves sliding a fixed-length window across the historical behavior score distribution curve and calculating the mean of the scores within the window, thereby generating a series of mean data. A dynamic baseline score sequence is a sequence of multiple mean data points, representing the user's dynamic baseline score at different points in time and used for subsequent anomaly comparison. Obtaining the historical behavior score distribution curve corresponding to user identification information can be achieved by querying the historical operation record database, which records the changes in each user's key behavior score over time. Sliding window averaging of the historical behavior score distribution curve can be performed using the following steps. First, determine the length of the sliding window. Then, starting from the starting position of the historical behavior score distribution curve, select data segments of length equal to the window length and calculate the mean of the scores within each data segment. Next, slide the window back one position and repeat the above calculation process until all data has been traversed. Finally, combine all calculated mean data into a sequence to obtain the dynamic baseline score sequence.

[0128] Step S420: Perform time series conversion processing on the dynamic score of the key behavior to generate a real-time score sequence that is time-aligned with the dynamic benchmark score sequence.

[0129] Time series conversion involves arranging the dynamic scores of key behavior in chronological order to form a time series. Generating a real-time score sequence time-aligned with a dynamic baseline score sequence involves aligning the time series of the dynamic scores with the dynamic baseline score sequence, aligning them temporally to facilitate subsequent comparison and analysis. Time series conversion of the dynamic scores of key behavior can be performed using a time sorting method, sorting the dynamic scores by operation time to produce a time series. Generating a real-time score sequence time-aligned with a dynamic baseline score sequence can be achieved through interpolation or sampling. For example, if the time intervals of the dynamic scores of key behavior do not align with the time intervals of the dynamic baseline score sequence, linear interpolation can be used to interpolate the time series of the dynamic scores of key behavior to align them with the dynamic baseline score sequence. For example, in a power monitoring system, a user's dynamic scores of key behavior are sorted by operation time to produce a time series. This time series is then aligned with the dynamic baseline score sequence using linear interpolation to generate a real-time score sequence time-aligned with the dynamic baseline score sequence. This sequence allows for more accurate comparison with the dynamic baseline score sequence.

[0130] Step S430: Calculate a set of standard deviations between the scores at each time point in the real-time scoring sequence and the scores at the corresponding time points in the dynamic benchmark scoring sequence.

[0131] The standard deviation deviation value refers to the multiple of the difference between the score at each time point in the real-time scoring sequence and the score at the corresponding time point in the dynamic benchmark scoring sequence relative to the standard deviation of the dynamic benchmark scoring sequence. It reflects the degree of deviation of the real-time score from the dynamic benchmark score. The following steps can be used to calculate the standard deviation deviation value set of the score at each time point in the real-time scoring sequence and the score at the corresponding time point in the dynamic benchmark scoring sequence. First, calculate the standard deviation of the dynamic benchmark scoring sequence. Then, for each time point in the real-time scoring sequence, calculate the difference between the score at that time point and the score at the corresponding time point in the dynamic benchmark scoring sequence. Next, divide the difference by the standard deviation of the dynamic benchmark scoring sequence to obtain the standard deviation deviation value for that time point. Finally, combine the standard deviation deviation values of all time points into a set to obtain a standard deviation deviation value set. For example, in an electric power monitoring system, the standard deviation of a user's dynamic benchmark score sequence is calculated. Then, for each time point in the user's real-time score sequence, the difference between the score at that time point and the score at the corresponding time point in the dynamic benchmark score sequence is calculated. The difference is divided by the standard deviation to obtain the standard deviation deviation value of the time point. Finally, the standard deviation deviation values of all time points are combined into a set. This set can reflect the degree of deviation of the user's real-time score from the dynamic benchmark score.

[0132] Step S440: performing continuous abnormal event detection processing on the set of standard deviation deviation values to identify a set of abnormal time points exceeding a preset deviation threshold.

[0133] Continuous abnormal event detection processing refers to finding continuous time points that exceed the preset deviation threshold in the standard deviation deviation value set. These time points constitute abnormal events. The preset deviation threshold is a pre-set threshold for determining whether it is an abnormality. When the standard deviation deviation value exceeds the threshold, the operation behavior at that time point is considered abnormal. The following steps can be used to identify the set of abnormal time points that exceed the preset deviation threshold. First, traverse the standard deviation deviation value set to find all time points that exceed the preset deviation threshold. Then, these time points are continuously grouped and the continuous time points are classified as an abnormal event. Finally, the time points in all abnormal events are combined into a set to obtain the abnormal time point set.

[0134] Step S450: performing time window expansion processing on the abnormal time point set to generate an abnormal operation period set including the leading operation period.

[0135] Time window expansion processing refers to extending the set time window forward based on the abnormal time point set to include the leading operation period, forming a more complete abnormal operation period. The generated abnormal operation period set is a set containing multiple abnormal operation periods, which reflect the range of occurrence of abnormal operation behaviors. The following steps can be used to perform time window expansion processing on the abnormal time point set. First, determine the length of the time window. Then, for each abnormal time point in the abnormal time point set, extend the time window forward to obtain an abnormal operation period that includes the leading operation period. Finally, combine all abnormal operation periods into a set to obtain the abnormal operation period set.

[0136] Step S460: extract the key operation behavior feature subset corresponding to the abnormal operation time period set, perform feature distribution deviation verification processing, and generate a secondary verification deviation indicator set.

[0137] The key operation behavior feature subset refers to the feature subset corresponding to the abnormal operation period set extracted from the key operation behavior feature set, which reflects the operation behavior characteristics within the abnormal operation period. Feature distribution deviation verification processing refers to analyzing the feature distribution of the key operation behavior feature subset to determine the degree of deviation from the normal operation behavior feature distribution. The generated secondary verification deviation index set is a set containing multiple secondary verification deviation indicators, which reflect the degree of deviation between the operation behavior characteristics within the abnormal operation period and the normal operation behavior characteristics. Extracting the key operation behavior feature subset corresponding to the abnormal operation period set can be achieved by screening the features corresponding to the abnormal operation period in the key operation behavior feature set. There are many methods for feature distribution deviation verification processing, such as calculating the mean, variance, covariance and other statistical indicators of the feature subset, and comparing them with the corresponding indicators of the normal operation behavior feature distribution to obtain the deviation index. For example, in an electric power monitoring system, a subset of key operation behavior characteristics corresponding to a user's abnormal operation time period set is extracted, the mean and variance of the subset are calculated, and compared with the mean and variance of the normal operation behavior characteristic distribution to obtain a secondary verification deviation index. Finally, the secondary verification deviation indicators of all abnormal operation time periods are combined into a set, which can further verify the authenticity of the abnormal operation behavior.

[0138] Step S470: performing hierarchical comparison processing on the secondary verification deviation index set and the preset multi-level abnormality determination threshold to generate a primary abnormal event set and a secondary abnormal event set.

[0139] The preset multi-level anomaly determination threshold is a set of thresholds at multiple levels, used to determine the severity of anomaly events. Hierarchical comparison processing involves comparing each indicator in the secondary verification deviation indicator set with the preset multi-level anomaly determination threshold. Based on the comparison results, anomaly events are classified as primary anomaly events and secondary anomaly events. The generated primary anomaly event set is a set of multiple primary anomaly events with relatively low severity; the secondary anomaly event set is a set of multiple secondary anomaly events with relatively high severity. The hierarchical comparison processing of the secondary verification deviation indicator set with the preset multi-level anomaly determination threshold can be performed using the following steps. First, the levels and threshold ranges of the multi-level anomaly determination thresholds are determined. Then, for each indicator in the secondary verification deviation indicator set, the threshold range within which it falls is determined. If the indicator falls within the lower threshold range, the corresponding anomaly event is classified as a primary anomaly event; if the indicator falls within the higher threshold range, the corresponding anomaly event is classified as a secondary anomaly event. Finally, all primary anomaly events are combined into a single set to form a primary anomaly event set; and all secondary anomaly events are combined into a single set to form a secondary anomaly event set. For example, in an electric power monitoring system, the preset multi-level abnormality determination threshold is divided into two levels: the first-level threshold is 1-2, and the second-level threshold is above 2. For each indicator in a user's secondary verification deviation indicator set, the threshold range within which it falls is determined. Abnormal events that fall within the first-level threshold range are classified as primary abnormal events, and abnormal events that fall within the second-level threshold range are classified as secondary abnormal events. Ultimately, the primary abnormal event set and the secondary abnormal event set are obtained. These two sets can help distinguish the severity of abnormal events.

[0140] Step S480: Performing time continuity analysis on the primary abnormal event set to identify aggregated abnormal event segments that meet the continuous triggering conditions.

[0141] Temporal continuity analysis and processing involves analyzing the abnormal events in the primary abnormal event set to determine whether they are temporally continuous. A continuous trigger condition refers to a pre-set time range and number of abnormal events. When a certain number of abnormal events occur continuously within this time range, these abnormal events are considered to constitute an aggregated abnormal event segment. The following steps can be used to identify aggregated abnormal event segments that meet the continuous trigger condition. First, the abnormal events in the primary abnormal event set are sorted chronologically. Then, the sorted abnormal event set is traversed to identify continuous abnormal events. Next, a determination is made as to whether these continuous abnormal events meet the continuous trigger condition. If so, these abnormal events are combined into an aggregated abnormal event segment. Finally, all aggregated abnormal event segments that meet the continuous trigger condition are combined into a set to obtain an aggregated abnormal event segment set. For example, in an electric power monitoring system, the continuous trigger condition is the occurrence of more than three abnormal events in three hours. The time continuity analysis of a user's primary abnormal event set is performed to find the aggregated abnormal event segments that meet the condition. Finally, all aggregated abnormal event segments are combined into a set. This set can reflect the temporal aggregation of the user's primary abnormal events and further determine the severity of the abnormal events.

[0142] Step S490: performing correlation matching processing on the aggregated abnormal event segment and the secondary abnormal event set to generate a cross-time period abnormal correlation map.

[0143] Correlation matching involves analyzing the correlation between aggregated abnormal event segments and sets of secondary abnormal events to determine whether they have a causal relationship or temporal sequence. A cross-period anomaly correlation map is a map that displays the correlation between aggregated abnormal event segments and sets of secondary abnormal events. It can help analyze the occurrence mechanism and propagation path of abnormal events. Correlation matching between aggregated abnormal event segments and sets of secondary abnormal events can be performed using the following steps. First, determine the correlation matching rules, such as temporal sequence and abnormal event type. Then, for each abnormal event segment in the aggregated abnormal event segment, identify the associated abnormal events in the set of secondary abnormal events. Next, connect the associated abnormal events with lines to form a correlation map. Finally, visualize the correlation map to obtain a cross-period anomaly correlation map. For example, in a power monitoring system, the correlation matching rule is temporal sequence. That is, if an aggregated abnormal event segment occurs before a secondary abnormal event, and the two abnormal event types are related, then they are considered to be correlated. Perform correlation matching on a user's aggregated abnormal event segments and secondary abnormal event sets to generate a cross-period abnormal correlation map. This map can help analyze the correlation between the user's abnormal events.

[0144] Step S4100: Generate a final anomaly detection result set based on the topological density distribution of abnormal nodes in the cross-time period anomaly association graph.

[0145] The topological density distribution of abnormal nodes refers to the distribution density of abnormal nodes in the cross-time anomaly association map. It reflects the degree of aggregation of abnormal events in different time periods and of different types. Based on the topological density distribution of abnormal nodes in the cross-time anomaly association map, the following steps can be used to generate the final anomaly detection result set. First, calculate the topological density of each abnormal node in the cross-time anomaly association map. Then, sort the abnormal nodes according to the size of the topological density. Then, based on the preset density threshold, filter out abnormal nodes whose topological density exceeds the threshold. Finally, combine the abnormal events corresponding to the filtered abnormal nodes into a set to obtain the final anomaly detection result set.

[0146] Step S500: triggering a corresponding key security response operation according to the key anomaly detection result set, where the key security response operation includes a key disabling operation or an operation authority downgrading operation.

[0147] A key security response action refers to taking appropriate measures to ensure the secure use of keys based on anomalies in the key anomaly detection result set. A key disable action prohibits a user from performing key operations, while an operation privilege downgrade reduces a user's key access privileges, such as reducing the frequency of key usage or limiting the scope of accessible system resources. The following steps can be used to trigger a corresponding key security response action based on a key anomaly detection result set. First, parse the anomaly level identification information in the key anomaly detection result set to determine the severity of the anomaly event. Then, based on the severity of the anomaly event, select the corresponding key security response action. If the severity of the anomaly event is high, select the key disable action; if the severity of the anomaly event is low, select the operation privilege downgrade action. Finally, execute the selected key security response action, and record the execution time and operation type. For example, in an electric power monitoring system, the abnormality level identification information in a user's key abnormality detection result set is parsed to determine the severity of the abnormal event. If it is a serious abnormal event, the key disabling operation is immediately executed, and the execution time and operation type information of the operation are recorded; if it is a general abnormal event, the operation authority downgrade operation is executed, such as lowering the key usage frequency threshold, and relevant information is recorded to ensure the safe use of the key.

[0148] As an implementation manner, step S500 may specifically include the following steps S510 to S550: Step S510: Parsing the abnormality level identification information in the key abnormality detection result set.

[0149] Abnormality level identification information refers to information used to identify the severity of abnormal events in a key abnormality detection result set. It can be a level identifier, such as level 1 abnormality or level 2 abnormality, or a numerical severity score. Parsing abnormality level identification information from a key abnormality detection result set can be achieved by parsing and extracting data from the key abnormality detection result set. For example, in a power monitoring system, a key abnormality detection result set is stored in JSON format, containing detailed information about each abnormal event, including abnormality level identification information.

[0150] Step S520: When a level one abnormality detection result is detected, a key disabling operation is immediately performed and a security warning notification is generated.

[0151] A level 1 anomaly detection result is the most severe anomaly detected within the anomaly level identification information. Key disabling prohibits a user from performing any key operations to prevent anomalous behavior from causing further harm to the system. A security alert notification is a notification used to alert system administrators or relevant personnel of an anomaly. The notification content may include details about the anomaly and the time of occurrence. When a level 1 anomaly detection result is detected, immediate key disabling can be achieved by modifying the user's permission settings in the key management system, disabling the user's key usage rights. Security alert notifications can be generated through push notifications, email notifications, and other methods. For example, in a power monitoring system, when a level 1 anomaly detection result is detected for a user, the user's permission settings in the key management system are immediately modified to disable their key usage. A security alert notification is then sent to the system administrator via SMS and email, containing details about the anomaly and the time of occurrence, allowing the administrator to promptly address the issue.

[0152] Step S530: When a secondary abnormality detection result is detected, the key call permission is restricted and an operation review request is generated.

[0153] A Level 2 anomaly detection result refers to a result indicating a more severe anomaly within the anomaly level identification information. Restricting key access permissions means reducing a user's key usage privileges, for example, by reducing the frequency of key usage or limiting the scope of accessible system resources. An operation review request is a request for a system administrator or relevant personnel to review a user's operation to confirm its legitimacy. When a Level 2 anomaly detection result is detected, restricting key access permissions can be achieved by modifying the user's permission settings in the key management system, such as lowering the key usage frequency threshold or limiting accessible system modules. Operation review requests can be generated through push notifications, system prompts, and other methods. For example, in a power monitoring system, when a Level 2 anomaly detection result is detected for a user, the user's permission settings in the key management system are modified to reduce the key usage frequency threshold to half of its original value. An operation review request is then generated in the system, prompting the administrator to review the user's operation to ensure its legitimacy.

[0154] Step S540: Send the security alarm notification or operation review request to the preset security management terminal.

[0155] A pre-set security management terminal is a pre-defined terminal device used to receive security alert notifications and operation review requests. It can be a system administrator's computer, mobile phone, or other device. Network communication technologies such as HTTP and MQTT can be used to send security alert notifications or operation review requests to the pre-set security management terminal. For example, in a power monitoring system, HTTP can be used to send security alert notifications or operation review requests to the pre-set security management terminal, ensuring that administrators receive notifications and requests promptly so they can take appropriate action.

[0156] Step S550: Record the execution time and operation type information of all security response operations and generate a security response log.

[0157] A security response log is a log that records the execution time and operation type information of all security response operations, which can be used for subsequent auditing and analysis. Recording the execution time and operation type information of all security response operations can be achieved by adding a logging module to the key management system. This module can automatically record the execution time and operation type information of the operation each time a security response operation is performed, and store it in a log file. The generated security response log can help administrators understand the security status and exception handling of the system, and provide a basis for subsequent security management. For example, in an electric power monitoring system, when a key disabling operation or an operation authority downgrade operation is performed, the logging module automatically records the execution time and operation type information of the operation and stores it in a log file to generate a security response log. Administrators can understand the security response status of the system by viewing the log.

[0158] In power monitoring systems, traditional key management methods have many problems, such as difficulty in manual ledger tracing, delayed detection of abnormal retention, high risk of fraudulent use, and high false alarm rate. The key anomaly detection method based on the behavioral model of the present invention comprehensively collects user identity verification information, key operation type and accurate timestamp through multi-dimensional data acquisition, constructs a holographic behavioral portrait of the security authentication medium, and can more accurately reflect the user's key operation behavior. The synergistic effect of dynamic feature extraction and intelligent behavior analysis model converts U-KEY access records into a set of quantitative indicators, providing a more scientific and accurate basis for anomaly detection. Based on the individualized historical behavior baseline, dynamic detection thresholds are generated to achieve real-time dynamic binding between operator identity and key usage behavior, thereby improving the accuracy and reliability of anomaly detection. The combination of multi-level security response strategy and intelligent return reminder mechanism forms a closed-loop control system covering the entire life cycle of the key, which can promptly detect and handle abnormal situations and ensure the safe operation of the power monitoring system. This method eliminates the risk of fraudulent use through deep correlation analysis of operation logs and identity authentication data, and uses temporal behavior modeling to accurately identify hidden anomalies and reduce the false alarm rate. At the same time, it has achieved an upgrade from single disabling disposal to refined management and control, providing more powerful technical support for the management of security authentication media in the power industry and meeting the requirements of the power monitoring system protection system.

[0159] It is understandable that the various algorithms involved in the above-mentioned introductions of the embodiments of the present invention, such as the Euclidean distance algorithm, the cosine distance algorithm, the time warping algorithm, the DBSCAN algorithm, etc., can all be learned from the relevant content in the prior art. In order to save space, they will not be expanded too much in the embodiments of this application. In addition, when implementing the scheme of this application, those skilled in the art can supplement the details according to the common knowledge in this field. For example, according to the common knowledge in this field, normalization can be used to eliminate dimensional conflicts before feature fusion, interpolation can be used to eliminate dimensional differences, and historical data, experience or business scenario requirements can be combined to reasonably set the threshold, and the model can be trained based on the general model training method, etc. This application will no longer provide redundant introductions to the overly detailed implementation process.

[0160] Figure 2 A hardware entity diagram of a computer device provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the hardware entity of the computer device 1000 includes: a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program that can be run on the processor 1001, and when the processor 1001 executes the program, the steps in the method of any of the above embodiments are implemented.

[0161] The memory 1002 stores computer programs that can be run on the processor. The memory 1002 is configured to store instructions and applications executable by the processor 1001. It can also cache data to be processed or processed by the processor 1001 and various modules in the computer device 1000 (for example, image data, audio data, voice communication data, and video communication data). This can be achieved through flash memory (FLASH) or random access memory (RAM).

[0162] When the processor 1001 executes the program, the steps of any of the above-mentioned methods for detecting key anomalies based on a behavioral model are implemented. The processor 1001 generally controls the overall operation of the computer device 1000.

Claims

1. A key anomaly detection method based on a behavioral model, characterized in that: The method comprises: Acquire a key operation data set, wherein the key operation data set includes a plurality of key operation records, each key operation record including user identification information, key operation type information, and operation timestamp information; Performing behavior feature extraction processing on the key operation data set to obtain a key operation behavior feature set corresponding to each user identification information; Inputting the key operation behavior feature set into a pre-built key behavior analysis model to generate a key behavior dynamic score for each user identification information; Perform anomaly comparison processing based on the dynamic score of key behavior and the preset historical behavior score threshold to generate a key anomaly detection result set for the target user; A corresponding key security response operation is triggered according to the key anomaly detection result set, and the key security response operation includes a key disabling operation or an operation authority downgrade operation.

2. The method according to claim 1, characterized in that The performing behavior feature extraction processing on the key operation data set to obtain a key operation behavior feature set corresponding to each user identification information includes: Performing time dimension decomposition processing on each key operation record in the key operation data set to generate an operation time distribution feature corresponding to each user identification information; Performing operation type dimension decomposition processing on each key operation record in the key operation data set to generate an operation type distribution feature corresponding to each user identification information; Performing feature fusion processing on the operation time distribution feature and the operation type distribution feature to obtain an initial behavior feature vector of each user identification information; Calling a pre-trained feature enhancement network to perform feature space mapping processing on the initial behavior feature vector to generate the key operation behavior feature set; The feature enhancement network is trained using normal operation feature samples in a historical key operation data set, and the feature space mapping process is used to enhance the differences in operation behavior features of different user identification information.

3. The method according to claim 2, characterized in that The performing time dimension decomposition processing on each key operation record in the key operation data set to generate an operation time distribution feature corresponding to each user identification information includes: Extracting the operation timestamp information from the key operation record and generating time series segments according to a preset time granularity division rule; Counting the key operation frequency in each of the time series segments to generate time dimension operation frequency distribution data; Performing sliding window mean calculation processing on the time dimension operation frequency distribution data to obtain the time dimension dynamic change characteristics; Performing feature combination processing on the time dimension operation frequency distribution data and the time dimension dynamic change feature to generate the operation time distribution feature; The window length of the sliding window mean calculation process is adjusted according to the historical operation cycle of the user identification information.

4. The method according to claim 2, characterized in that The step of performing operation type dimension decomposition processing on each key operation record in the key operation data set to generate an operation type distribution feature corresponding to each user identification information includes: Parsing the key operation type information to identify three basic operation types: key generation operation, key call operation, and key deletion operation; Count the occurrence frequency of each basic operation type within a preset time period and generate operation type frequency distribution data; Calculate the continuous operation correlation between each basic operation type and generate the operation type conversion probability matrix; Performing feature fusion processing on the operation type frequency distribution data and the operation type conversion probability matrix to generate a multi-dimensional operation type association feature; Performing feature dimensionality reduction processing on the multi-dimensional operation type association features to obtain the operation type distribution features.

5. The method according to claim 2, characterized in that The calling of the pre-trained feature enhancement network to perform feature space mapping processing on the initial behavior feature vector to generate the key operation behavior feature set includes: Calling the first encoding processing layer in the feature enhancement network to perform multi-dimensional feature encoding processing on the initial behavior feature vector to generate an intermediate feature vector; calling a feature decoupling layer in the feature enhancement network to separate user behavior features from operation mode features on the intermediate feature vector to obtain a user behavior feature vector and an operation mode feature vector; Calling the nonlinear transformation layer in the feature enhancement network to perform feature space nonlinear transformation processing on the user behavior feature vector to generate an enhanced user behavior feature vector; Calling the template matching layer in the feature enhancement network to perform pattern matching processing on the operation mode feature vector and a pre-stored historical normal operation mode feature template set to generate a pattern difference feature vector; Calling a feature fusion layer in the feature enhancement network to perform cross-dimensional feature fusion processing on the enhanced user behavior feature vector and the pattern difference feature vector to generate a fused feature vector; calling the second encoding processing layer in the feature enhancement network to perform low-dimensional space projection processing on the fused feature vector to generate a standardized behavior feature vector; Performing residual connection processing on the standardized behavior feature vector and the user behavior feature vector to generate a final enhanced feature vector; Matching a target cluster center vector from a preset feature cluster center set according to the feature dimension distribution of the final enhanced feature vector; Performing feature alignment processing on the final enhanced feature vector and the target cluster center vector to generate the key operation behavior feature set; The historical normal operation mode feature template set is generated by analyzing typical operation modes of different user identification information within a historical time period, and the feature alignment process is used to eliminate the distribution offset of operation behavior features of different user identification information.

6. The method according to claim 1, characterized in that The step of inputting the key operation behavior feature set into a pre-built key behavior analysis model to generate a key behavior dynamic score for each user identification information includes: Calling the feature matching layer in the key behavior analysis model to perform similarity calculation on the key operation behavior feature set and the historical normal behavior feature template to generate an initial behavior matching score; Invoking the anomaly detection layer in the key behavior analysis model to perform outlier analysis on the key operation behavior feature set to generate a behavior deviation score; Calling the trend prediction layer in the key behavior analysis model to predict the behavior trend change value in the future time period based on the key operation behavior feature set; Performing weighted fusion processing on the initial behavior matching score, the behavior deviation score, and the behavior trend change value to generate the key behavior dynamic score; The weight coefficient of the weighted fusion process is dynamically adjusted according to the historical operation stability of the user identification information.

7. The method according to claim 6, characterized in that The calling of the feature matching layer in the key behavior analysis model to perform similarity calculation processing on the key operation behavior feature set and the historical normal behavior feature template to generate an initial behavior matching score includes: Acquire historical operation time period division data corresponding to the user identification information, and extract periodic operation feature segments based on the historical operation time period division data; Performing dynamic time warping on the key operation behavior feature set to generate a timing matching feature vector aligned with the periodic operation feature segment; Performing time window sliding feature extraction processing on the time series matching feature vector to generate a multi-scale time series correlation feature set; Performing layer-by-layer similarity comparison processing on the multi-scale time series correlation feature set and the historical normal behavior feature template to generate initial matching degree distribution data; Performing attention weight distribution processing on the initial matching degree distribution data to generate a matching degree weight coefficient for each time window; Performing weighted fusion processing on the multi-scale temporal correlation feature set based on the matching weight coefficient to generate a comprehensive matching feature vector; Generate a dynamic attenuation coefficient based on the interval between the current operation timestamp and the historical normal operation time period; Performing a product operation on the comprehensive matching degree feature vector and the dynamic attenuation coefficient to generate an attenuation-corrected matching degree index; Performing nonlinear activation processing on the attenuation-corrected matching index to generate a normalized matching score; Performing a difference calculation between the normalized matching score and a preset benchmark matching threshold to generate the initial behavior matching score; Among them, the dynamic time warping processing is used to eliminate the timing differences of behavioral features in different operation time periods, and the attention weight allocation processing dynamically adjusts the weight distribution based on the importance of the feature dimension.

8. The method according to claim 1, characterized in that The abnormality comparison processing based on the dynamic score of the key behavior and the preset historical behavior score threshold is performed to generate a key abnormality detection result set of the target user, including: Obtaining a historical behavior score distribution curve corresponding to the user identification information, and performing sliding window mean processing on the historical behavior score distribution curve to generate a dynamic benchmark score sequence; Performing time series conversion processing on the dynamic score of the key behavior to generate a real-time score sequence that is time-aligned with the dynamic benchmark score sequence; Calculate a set of standard deviations between the scores at each time point in the real-time scoring sequence and the scores at corresponding time points in the dynamic benchmark scoring sequence; Performing continuous abnormal event detection processing on the set of standard deviation deviation values to identify a set of abnormal time points exceeding a preset deviation threshold; Performing time window expansion processing on the abnormal time point set to generate an abnormal operation period set including a leading operation period; Extracting a subset of key operation behavior features corresponding to the abnormal operation time period set, performing feature distribution deviation verification processing, and generating a secondary verification deviation indicator set; Performing a hierarchical comparison process on the secondary verification deviation index set and the preset multi-level abnormality determination threshold to generate a primary abnormal event set and a secondary abnormal event set; Performing temporal continuity analysis on the primary abnormal event set to identify aggregated abnormal event segments that meet continuous triggering conditions; Perform correlation matching processing on the aggregated abnormal event segment and the secondary abnormal event set to generate a cross-time period abnormal correlation map; Generating a final anomaly detection result set based on the topological density distribution of anomaly nodes in the cross-time anomaly association graph; The window length of the dynamic benchmark scoring sequence is adjusted according to the user operation activity, and the time window expansion process covers a preset proportion of historical operation data before the abnormal time point.

9. The method according to claim 1, characterized in that The triggering of a corresponding key security response operation according to the key anomaly detection result set includes: Parsing the abnormality level identification information in the key abnormality detection result set; When the first-level abnormal detection result is detected, the key disabling operation is immediately performed and a security warning notification is generated; When the secondary abnormality detection result is detected, restricting key call permissions and generating an operation review request; Sending the security alert notification or operation review request to a preset security management terminal; Record the execution time and operation type information of all security response operations and generate security response logs; The key call permission restriction includes lowering the key usage frequency threshold or limiting the scope of accessible system resources.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images