User abnormal data monitoring method and system based on artificial intelligence

Abstract

The present invention discloses a method and system for monitoring abnormal user data based on artificial intelligence. The method includes data collection, user behavior evaluation model design, normal behavior training design, labeled abnormality calibration design, balanced weighted design, training connection strategy, abnormality evaluation, parameter adjustment and user abnormal data monitoring. The present invention belongs to the field of behavior monitoring, and specifically refers to a method and system for monitoring abnormal user data based on artificial intelligence. The scheme is based on abnormality score transformation and is sensitive to minor abnormalities; by introducing sample balance coefficient and abnormality difficulty adaptive weighting, the false alarm gradient of normal samples is controlled, and the detection ability of abnormal samples is improved; based on personalized abnormality evaluation method, cross-user deviation is reduced; fine-grained perturbation search and parameter bit flip mutation strategy are adopted to improve the reliability of end-user abnormal data monitoring; the step size is smoothly updated by the convergence coefficient to avoid unnecessary resource waste, thereby improving the efficiency of user abnormal data monitoring.

Description

Technical Field

[0001] The present invention relates to the field of behavior monitoring technology, and specifically to a method and system for monitoring abnormal user data based on artificial intelligence. Background Art

[0002] Abnormal user data monitoring methods analyze user-generated data and, through methods like setting specific rules and building models, identify data that deviates from normal patterns within massive amounts of data. However, typical abnormal user data monitoring methods are overly sensitive to abnormal behavior, unable to accurately depict normal behavior patterns, suffer from large cross-user deviations, and fail to accurately reflect each user's normal distribution, leading to poor monitoring accuracy. They also suffer from inefficient parameter adjustment for abnormal user data monitoring, lack adaptive capabilities, and are unable to cope with complex user behavior data, resulting in poor monitoring results. Summary of the Invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a method and system for monitoring user abnormal data based on artificial intelligence. In view of the problem that the general user abnormal data monitoring method is too sensitive to abnormal behavior, cannot accurately characterize normal behavior patterns, has large deviations across users, and cannot accurately reflect the normal distribution of each user, which leads to poor monitoring accuracy, this solution only uses normal user data to learn the normal behavior distribution, and based on the abnormal score transformation, it approximates a quadratic curve for small deviations, is sensitive to tiny abnormalities, and discovers potential abnormal signals in the early stage of the problem; by introducing the sample balance coefficient and the adaptive weighting of the abnormal difficulty, the false alarm gradient of the normal sample is controlled to avoid the normal sparse signal being submerged, reduce the misjudgment rate of abnormal samples, and improve the abnormal The detection capability of samples; based on personalized anomaly assessment methods, it reduces cross-user deviations, improves the accuracy of anomaly detection, and reduces the false positive rate; in view of the problems that general user anomaly data monitoring methods have low efficiency in parameter adjustment for user anomaly data monitoring, lack of adaptive capabilities, and cannot cope with complex user behavior data, which leads to poor monitoring effects, this solution adopts fine-grained perturbation search and parameter bit flipping mutation strategies to perturb and mutate some parameter adjustment individuals, and inject random perturbations to continuously explore new parameter spaces and jump out of local optimal areas, thereby improving the reliability of end-user anomaly data monitoring; by smoothly updating the step size through the convergence coefficient, overshoot is suppressed, and unnecessary waste of resources is avoided, thereby improving the efficiency of user anomaly data monitoring.

[0004] The technical solution adopted by the present invention is as follows: The user abnormal data monitoring method based on artificial intelligence provided by the present invention comprises the following steps:

[0005] Step S1: data collection;

[0006] Step S2: User behavior evaluation model design;

[0007] Step S3: Normal behavior training design;

[0008] Step S4: abnormal calibration design has been marked;

[0009] Step S5: balanced weighted design;

[0010] Step S6: training the connection strategy;

[0011] Step S7: abnormality assessment;

[0012] Step S8: parameter adjustment;

[0013] Step S9: Monitoring abnormal user data.

[0014] Furthermore, in step S1, the data collection is to collect historical user behavior data; mark the user behavior type as a data label; the user behavior type includes normal and abnormal; perform feature engineering processing, and construct a user behavior data set.

[0015] Furthermore, in step S2, the user behavior evaluation model is designed to construct an MLP-based feature extractor for the user behavior dataset, and use a lightweight feedforward network to map each user behavior data into a behavior potential vector z i , the network structure is expressed as: ;in, It is a mapping function, which represents the combination of multi-layer full connection + BatchNorm + ReLU; are all the trainable parameters of the MLP network; is user behavior data; i is the sample index.

[0016] Furthermore, in step S3, the normal behavior training design is to use only normal user data to learn the normal behavior distribution, and i Gathered near the center of the hypersphere; the loss formula is expressed as: ; Anomaly score transformation Expressed as: ;in, It is a loss of normal behavioral training; is the total number of normal user behavior samples; u is the dimension of the behavior latent vector.

[0017] Furthermore, in step S4, the anomaly calibration design is to explicitly utilize the known abnormal behavior data during training, and define the normal probability as: ; The loss formula is expressed as: ;in, is the probability that the j-th dimension of the i-th sample is judged to be normal; yes jth dimension; Is a known label. If the i-th sample label is abnormal, then , otherwise 0; j is the dimension index.

[0018] Furthermore, in step S5, the balanced weighted design is to perform a priori weight adjustment on the categories and define the sample balance coefficient, which is expressed as: ; ; ; Where N is the total sample; is the total number of abnormal user behavior samples; is the prior probability of anomaly; and are the class balance coefficients of abnormal and normal samples, respectively; is a very small constant; the abnormal difficulty adaptive weighting is introduced, which is expressed as: ;in, is the difficulty index of the jth dimension of the i-th sample; and are the maximum and minimum values ​​of the difficulty index respectively; is the sigmoid function; and are the location parameter and the scale parameter respectively; and Corresponding to normal samples and abnormal samples respectively ; The loss formula is expressed as: ; ; ;in, is the balanced weighted loss; and are the dynamic weights of normal samples and abnormal samples respectively.

[0019] Furthermore, in step S6, the training connection strategy is to use two-stage training for the user behavior evaluation model. Stage A first uses train epochs, and then use train epochs; the loss used in stage B is train epochs; is the balance coefficient; and the user behavior evaluation model is obtained.

[0020] Furthermore, in step S7, the anomaly assessment is to obtain the behavior potential vector output by the user behavior assessment model based on the user behavior data, measure the distance to the user's own center, and perform an anomaly score assessment, which is expressed as: ; ;in, and are the normal centers of the t+1th training and the tth training respectively; is the momentum coefficient; W is the sample set used for center update; is the anomaly score; set the anomaly threshold ,like , the user behavior is judged as abnormal and an alarm is triggered.

[0021] Furthermore, in step S8, the parameter adjustment is to introduce the gray wolf search algorithm to adjust the parameters of the user behavior evaluation model; specifically, the following contents are included:

[0022] Step S81: Initialize the wolf pack; define a hyperparameter vector based on the parameters to be adjusted of the user behavior evaluation model; initialize the individual positions of the wolf pack;

[0023] Step S82: Fitness evaluation: Divide the user behavior data set into a test set and a training set, perform a training connection strategy based on the training set for each wolf pack individual, and use the F1-score of the user behavior evaluation model on the test set as the individual fitness; and mark the individual positions with the top three fitness values ​​as 、 and ;

[0024] Step S83: iterative update; including:

[0025] Step S831: Calculate the convergence coefficient, and update the step size based on the convergence coefficient. Expressed as: ; ;in, is an auxiliary parameter, and are random numbers uniformly distributed from 0 to 1 and are independent of each other;

[0026] Step S832: Individual position update; for each wolf : ; ; ; ; ; ; Where A and C are control vectors; 、 and is the candidate position vector; a is the convergence factor; and are the positions of the individual before and after the update, respectively;

[0027] Step S833: Fine-grained perturbation search; first define the mapping as ;in, and are the n+1th and nth mapping parameters respectively; P is the threshold parameter; the perturbation solution is generated for 10% of random individuals , expressed as: ; and are two random individual positions; the position with higher fitness value is retained;

[0028] Step S834: Parameter bit flip mutation; for the individual after fine-grained perturbation search, bit by bit with probability implement ;in, and g are the dimensional values ​​of the individual's position before and after mutation, respectively; High is the upper limit of the search space dimension; if the individual's fitness value improves after mutation, it is retained;

[0029] Step S835: Update 、 and ; Set the individual fitness threshold. If there is an individual fitness value higher than the fitness threshold, the iterative update is completed, and the user behavior evaluation model obtained based on the individual position is used as the final established user behavior evaluation model; otherwise, if the maximum number of iterations is reached, return to step S81; otherwise, continue to iterate.

[0030] Furthermore, in step S9, the user abnormal data monitoring is to collect user behavior data in real time, input it into the established user behavior evaluation model, and perform user abnormal data monitoring based on the user behavior type output by the model.

[0031] The artificial intelligence-based user abnormal data monitoring system provided by the present invention includes a data acquisition module, a user behavior evaluation model design module, a normal behavior training design module, a marked abnormality calibration design module, a balanced weighting design module, a training connection module, an abnormality evaluation module, a parameter adjustment module and a user abnormal data monitoring module;

[0032] The data collection module collects historical user behavior data and constructs a user behavior data set;

[0033] The user behavior evaluation model is designed based on a lightweight MLP network to map each user behavior data into a behavior potential vector;

[0034] The normal behavior training design module only uses normal samples to implement normal behavior distribution modeling;

[0035] The labeled anomaly calibration design module performs model calibration by defining normal probability and integrating labeled anomaly samples;

[0036] The balanced weighted design module constructs a balanced weighted loss by dynamically adjusting weights based on the category balance coefficient and the difficulty adaptive index;

[0037] The training bridging module designs a two-stage training strategy;

[0038] The anomaly assessment module performs anomaly score assessment by updating the center of momentum and the behavior latent vector;

[0039] The parameter adjustment module uses the optimized gray wolf search algorithm to adjust the model hyperparameters to establish a user behavior evaluation model;

[0040] The user abnormal data monitoring module performs abnormal monitoring on real-time user behavior data based on the established user behavior evaluation model.

[0041] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0042] (1) The general user abnormal data monitoring method is too sensitive to abnormal behavior and cannot accurately characterize normal behavior patterns. The cross-user deviation is large and cannot accurately reflect the normal distribution of each user, which leads to poor monitoring accuracy. This scheme only uses normal user data to learn the normal behavior distribution, and based on the abnormal score transformation, it approximates a quadratic curve for small deviations, is sensitive to tiny anomalies, and detects potential abnormal signals in the early stage of the problem; by introducing the sample balance coefficient and the adaptive weighting of the abnormal difficulty, the false alarm gradient of the normal sample is controlled to avoid the normal sparse signal being submerged, reduce the misjudgment rate of abnormal samples, and improve the detection ability of abnormal samples; based on the personalized anomaly evaluation method, the cross-user deviation is reduced, the accuracy of anomaly detection is improved, and the misjudgment rate is reduced.

[0043] (2) In view of the problems that the general user abnormal data monitoring methods have low efficiency in parameter adjustment for user abnormal data monitoring, lack of adaptive ability, and inability to cope with complex user behavior data, which leads to poor monitoring effect, this scheme adopts a fine-grained perturbation search and parameter bit flip mutation strategy to perturb and mutate some parameter adjustment individuals, and inject random perturbations to continuously explore new parameter spaces and jump out of the local optimal area, thereby improving the reliability of end-user abnormal data monitoring; by smoothly updating the step size through the convergence coefficient, overshoot is suppressed, and unnecessary resource waste is avoided, thereby improving the efficiency of user abnormal data monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flow chart of the method for monitoring abnormal user data based on artificial intelligence provided by the present invention;

[0045] Figure 2 Schematic diagram of the user abnormal data monitoring system based on artificial intelligence provided by the present invention.

[0046] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0048] In the description of the present invention, it should be understood that terms such as "up", "down", "front", "back", "left", "right", "top", "bottom", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0049] Example 1, see Figure 1 The present invention provides an artificial intelligence-based user abnormal data monitoring method, which includes the following steps:

[0050] Step S1: Data collection: Collect historical user behavior data and build a user behavior dataset;

[0051] Step S2: Design a user behavior evaluation model; the model is based on a lightweight MLP network to map each user behavior data into a behavior latent vector;

[0052] Step S3: Normal behavior training design: only using normal samples to achieve normal behavior distribution modeling;

[0053] Step S4: Design of labeled anomaly calibration: by defining normal probability, integrating labeled anomaly samples to perform model calibration;

[0054] Step S5: Balanced weighted design: Based on the category balance coefficient and the difficulty adaptive index, a balanced weighted loss is constructed through dynamic weighting adjustment;

[0055] Step S6: training connection strategy; designing a two-stage training strategy;

[0056] Step S7: Anomaly evaluation: Anomaly score evaluation is performed by updating the center with momentum and the behavior latent vector;

[0057] Step S8: Parameter adjustment: using the optimized gray wolf search algorithm to adjust the model hyperparameters to establish the user behavior evaluation model;

[0058] Step S9: User abnormal data monitoring: Based on the established user behavior evaluation model, perform abnormal monitoring on real-time user behavior data.

[0059] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, data collection is to collect historical user behavior data; the historical user behavior data includes page browsing duration, click frequency, average session duration, daily active duration, search result click-through rate, function interface delay and data upload / download volume; user behavior types are marked as data labels; the user behavior types include normal and abnormal; feature engineering processing is performed, including time unification, missing value processing, sliding window segmentation, feature construction and standardization processing, to construct a user behavior data set.

[0060] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S2, the user behavior evaluation model is designed to construct an MLP-based feature extractor for the user behavior dataset and use a lightweight feedforward network to map each user behavior data into a behavior potential vector z i , the network structure is expressed as: ;in, It is a mapping function, which represents the combination of multi-layer full connection + BatchNorm + ReLU; are all the trainable parameters of the MLP network, including the weight matrix and bias terms of each layer; is user behavior data; i is the sample index; the specific implementation is: the input is processed through multiple layers of full connection + BatchNorm + ReLU; the last layer outputs the u-dimensional behavior potential vector z i , used for anomaly scoring, no activation, bias term is the center parameter.

[0061] Example 4, see Figure 1 This embodiment is based on the above embodiment. In step S3, the normal behavior training design is to use only normal user data to learn the normal behavior distribution. i Gathered near the center of the hypersphere; the loss formula is expressed as: ; Anomaly score transformation Expressed as: , after normalization, the magnitude of the deviation from the center is measured; It is a loss of normal behavioral training; is the total number of normal user behavior samples; u is the dimension of the behavior potential vector; it converges quickly to the normal spherical center baseline; it approximates a quadratic curve for small deviations, is sensitive to minor anomalies, and approximates a linear curve for large deviations, suppressing the excessive pull of abnormal points on the center.

[0062] Example 5, see Figure 1 This embodiment is based on the above embodiment. In step S4, the anomaly calibration design is to explicitly use the known abnormal behavior data during training, and define the normal probability as: , which is perfectly aligned with BCE; minimized by normal steps , the abnormal step maximizes the log probability of 1-p; avoids the negative infinite gradient instability of the original formula when there is no abnormal label; the loss formula is expressed as: ;in, is the probability that the j-th dimension of the i-th sample is judged to be normal; yes jth dimension; Is a known label. If the i-th sample label is abnormal, then , otherwise it is 0; j is the dimension index; directly integrate the labeled abnormal event information, keep the value stable, and mix the positive and negative sample gradients; the moment-level label finely controls which time periods need to be separated.

[0063] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S5, the balanced weighted design is based on the fact that there are very few truly abnormal moments in user behavior. Therefore, the category prior weighting is adjusted and the sample balance coefficient is defined, which is expressed as: ; ; ; Where N is the total sample; is the total number of abnormal user behavior samples; is the estimated prior probability of anomaly; and are the class balance coefficients of abnormal and normal samples, respectively; is a very small constant; however, anomalies often deviate slightly from the center and are easily misjudged, and normal noise may also fall on the boundary. Therefore, an adaptive weighting of anomaly difficulty is introduced, which is expressed as: ; Using asymmetric values, ; ;in, is the difficulty index of the jth dimension of the i-th sample; and are the maximum and minimum values ​​of the difficulty index respectively; is the sigmoid function; and are the location parameter and the scale parameter respectively; and Corresponding to normal samples and abnormal samples respectively For user behavior samples with low difficulty, we prevent over-amplification of easy-to-classify samples, and increase the gradient of truly difficult samples when the difficulty is high. The loss formula is expressed as: ; ; ;in, is the balanced weighted loss; and are the dynamic weights of normal samples and abnormal samples respectively; they control the false positive gradient of normal samples to avoid the normal sparse signals being submerged.

[0064] Example 7, see Figure 1 This embodiment is based on the above embodiment. In step S6, the training connection strategy is to use two-stage training for the user behavior evaluation model. Stage A first uses train epochs, and then use train epochs; the loss used in stage B is train epochs; is the balance coefficient; and the user behavior evaluation model is obtained.

[0065] In step S7, after obtaining the behavior potential vector output by the user behavior evaluation model based on the user behavior data, the anomaly assessment measures the distance to the user's own center and performs an anomaly score assessment, which is expressed as: ; ;in, and are the normal centers of the t+1th training and the tth training respectively; is the momentum coefficient; W is the sample set used for center update; is the anomaly score; set the anomaly threshold ,like , the user behavior is judged as abnormal and an alarm is triggered; each person's normal behavior pattern is different, and the personalization center can more accurately reflect the user's own normal distribution, thereby reducing cross-user deviation.

[0066] By performing the above operations, the general user abnormal data monitoring method is overly sensitive to abnormal behavior, unable to accurately characterize normal behavior patterns, has large cross-user deviations, and cannot accurately reflect the normal distribution of each user, which in turn leads to poor monitoring accuracy. This solution only uses normal user data to learn the normal behavior distribution, and based on the abnormal score transformation, it approximates a quadratic curve for small deviations, is sensitive to tiny anomalies, and discovers potential abnormal signals in the early stages of the problem; by introducing the sample balance coefficient and the adaptive weighting of the abnormal difficulty, the false alarm gradient of normal samples is controlled to avoid the normal sparse signals being submerged, reduce the misjudgment rate of abnormal samples, and improve the detection ability of abnormal samples; based on the personalized anomaly assessment method, it reduces cross-user deviations, improves the accuracy of anomaly detection, and reduces the misjudgment rate.

[0067] Example 8, see Figure 1 This embodiment is based on the above embodiment. In step S8, parameter adjustment is to introduce the gray wolf search algorithm to adjust the parameters of the user behavior evaluation model; specifically, it includes the following contents:

[0068] Step S81: Initialize the wolf pack; define the hyperparameter vector based on the parameters to be adjusted in the user behavior evaluation model, the dimensions include: time window length, MLP hidden feature dimension, , learning rate, batch size, mixed loss weight in stage B , imbalance expansion index , abnormality judgment threshold and the number of training rounds in three stages; initializing the individual positions of the wolf pack;

[0069] Step S82: Fitness evaluation: Divide the user behavior data set into a test set and a training set, perform a training connection strategy based on the training set for each wolf pack individual, and use the F1-score of the user behavior evaluation model on the test set as the individual fitness; and mark the individual positions with the top three fitness values ​​as 、 and ;

[0070] Step S83: iterative update; including:

[0071] Step S831: Calculate the convergence coefficient, update the step size based on the convergence coefficient, suppress overshoot, improve the convergence stability of parameter adjustment, and the convergence coefficient Expressed as: ; ;in, is an auxiliary parameter, and are random numbers uniformly distributed from 0 to 1 and are independent of each other;

[0072] Step S832: Individual position update; for each wolf : ; ; ; ; ; ; Where A and C are control vectors; 、 and is the candidate position vector; a is the convergence factor; and are the positions of the individual before and after the update, respectively;

[0073] Step S833: Fine-grained perturbation search; first define the mapping as ;in, and are the n+1th and nth mapping parameters respectively; P is the threshold parameter; the perturbation solution is generated for 10% of random individuals , expressed as: ; and are two random individual positions; the position with higher fitness value is retained;

[0074] Step S834: Parameter bit flip mutation; for the individual after fine-grained perturbation search, bit by bit with probability implement ;in, and g are the dimensional values ​​of the individual's position before and after mutation, respectively; High is the upper limit of the search space dimension; if the individual's fitness value improves after mutation, it will be retained; random perturbations are injected regularly to enhance population diversity;

[0075] Step S835: Update 、 and ; Set the individual fitness threshold. If there is an individual fitness value higher than the fitness threshold, the iterative update is completed, and the user behavior evaluation model obtained based on the individual position is used as the final established user behavior evaluation model; otherwise, if the maximum number of iterations is reached, return to step S81; otherwise, continue to iterate.

[0076] By performing the above operations, the general user abnormal data monitoring method has the problem of low efficiency in parameter adjustment for user abnormal data monitoring, lack of adaptive ability, and inability to cope with complex user behavior data, which leads to poor monitoring effect. This solution adopts fine-grained perturbation search and parameter bit flipping mutation strategy to perturb and mutate some parameter adjustment individuals, and inject random perturbations to continuously explore new parameter spaces and jump out of local optimal areas, thereby improving the reliability of end-user abnormal data monitoring; by smoothly updating the step size through the convergence coefficient, overshoot is suppressed, and unnecessary resource waste is avoided, thereby improving the efficiency of user abnormal data monitoring.

[0077] Example 9, see Figure 1 This embodiment is based on the above embodiment. In step S9, user abnormal data monitoring is to collect user behavior data in real time, input it into the established user behavior evaluation model, and perform user abnormal data monitoring based on the user behavior type output by the model; if the user behavior type is abnormal, an early warning is issued to the management personnel.

[0078] Example 10, see Figure 2 This embodiment is based on the above embodiment. The user abnormal data monitoring system based on artificial intelligence provided by the present invention includes a data acquisition module, a user behavior evaluation model design module, a normal behavior training design module, a marked abnormality calibration design module, a balanced weighting design module, a training connection module, an abnormality evaluation module, a parameter adjustment module and a user abnormal data monitoring module;

[0079] The data collection module collects historical user behavior data and constructs a user behavior data set;

[0080] The user behavior evaluation model is designed based on a lightweight MLP network to map each user behavior data into a behavior potential vector;

[0081] The normal behavior training design module only uses normal samples to implement normal behavior distribution modeling;

[0082] The labeled anomaly calibration design module performs model calibration by defining normal probability and integrating labeled anomaly samples;

[0083] The balanced weighted design module constructs a balanced weighted loss by dynamically adjusting weights based on the category balance coefficient and the difficulty adaptive index;

[0084] The training bridging module designs a two-stage training strategy;

[0085] The anomaly assessment module performs anomaly score assessment by updating the center of momentum and the behavior latent vector;

[0086] The parameter adjustment module uses the optimized gray wolf search algorithm to adjust the model hyperparameters to establish a user behavior evaluation model;

[0087] The user abnormal data monitoring module performs abnormal monitoring on real-time user behavior data based on the established user behavior evaluation model.

[0088] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0089] While the embodiments of the present invention have been shown and described, it will be apparent to those skilled in the art that various changes, modifications, substitutions, and alterations can be made to the embodiments without departing from the principles and spirit of the invention.

[0090] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. The method for monitoring abnormal user data based on artificial intelligence is characterized by: The method comprises the following steps: Step S1: Data collection: Collect historical user behavior data and build a user behavior dataset; Step S2: Design a user behavior evaluation model; the model is based on a lightweight MLP network to map each user behavior data into a behavior latent vector; Step S3: Normal behavior training design: only using normal samples to achieve normal behavior distribution modeling; Step S4: Design of labeled anomaly calibration: by defining normal probability, integrating labeled anomaly samples to perform model calibration; Step S5: Balanced weighted design: Based on the category balance coefficient and the difficulty adaptive index, a balanced weighted loss is constructed through dynamic weighting adjustment; Step S6: training connection strategy; designing a two-stage training strategy; Step S7: Anomaly evaluation: Anomaly score evaluation is performed by updating the center with momentum and the behavior latent vector; Step S8: Parameter adjustment: using the optimized gray wolf search algorithm to adjust the model hyperparameters to establish the user behavior evaluation model; Step S9: User abnormal data monitoring: Based on the established user behavior evaluation model, perform abnormal monitoring on real-time user behavior data; In step S2, the user behavior evaluation model is designed to construct an MLP-based feature extractor for the user behavior dataset, and use a lightweight feedforward network to map each user behavior data into a behavior potential vector z i , the network structure is expressed as: ;in, It is a mapping function, which represents the combination of multi-layer full connection + BatchNorm + ReLU; are all the trainable parameters of the MLP network; is user behavior data; i is the sample index; In step S3, the normal behavior training design is to use only normal user data to learn the normal behavior distribution. i Gathered near the center of the hypersphere; the loss formula is expressed as: ; Anomaly score transformation Expressed as: ;in, It is a loss of normal behavioral training; is the total number of normal user behavior samples; u is the dimension of the behavior potential vector; In step S5, the balanced weighted design is to perform a priori weight adjustment on the categories and define the sample balance coefficient, which is expressed as: ; ; ; Where N is the total sample; is the total number of abnormal user behavior samples; is the prior probability of anomaly; and are the class balance coefficients of abnormal and normal samples, respectively; is a very small constant; the abnormal difficulty adaptive weighting is introduced, which is expressed as: ;in, is the difficulty index of the jth dimension of the i-th sample; and are the maximum and minimum values ​​of the difficulty index respectively; is the sigmoid function; and are the location parameter and the scale parameter respectively; and Corresponding to normal samples and abnormal samples respectively ; The loss formula is expressed as: ; ; ;in, is the balanced weighted loss; and are the dynamic weights of normal samples and abnormal samples respectively; is the probability that the j-th dimension of the i-th sample is judged to be normal; yes jth dimension; Is a known label. If the i-th sample label is abnormal, then , otherwise 0; j is the dimension index.

2. The method for monitoring abnormal user data based on artificial intelligence according to claim 1, characterized in that: In step S4, the anomaly calibration design is to explicitly utilize the known abnormal behavior data during training, and define the normal probability as: ; The loss formula is expressed as: .

3. The method for monitoring abnormal user data based on artificial intelligence according to claim 2, characterized in that: In step S6, the training connection strategy is to use a two-stage training for the user behavior evaluation model. Stage A first uses train epochs, and then use train epochs; the loss used in stage B is train epochs; is the balance coefficient; and the user behavior evaluation model is obtained.

4. The method for monitoring abnormal user data based on artificial intelligence according to claim 3, characterized in that: In step S7, the anomaly assessment is to obtain the behavior potential vector output by the user behavior assessment model based on the user behavior data, measure the distance to the user's own center, and perform an anomaly score assessment, which is expressed as: ; ;in, and are the normal centers of the t+1th training and the tth training respectively; is the momentum coefficient; W is the sample set used for center update; is the anomaly score; set the anomaly threshold ,like , the user behavior is judged as abnormal and an alarm is triggered.

5. The method for monitoring abnormal user data based on artificial intelligence according to claim 4, characterized in that: In step S8, the parameter adjustment is to introduce the gray wolf search algorithm to adjust the parameters of the user behavior evaluation model; specifically, it includes the following contents: Step S81: Initialize the wolf pack; define a hyperparameter vector based on the parameters to be adjusted of the user behavior evaluation model; initialize the individual positions of the wolf pack; Step S82: Fitness evaluation: Divide the user behavior data set into a test set and a training set, perform a training connection strategy based on the training set for each wolf pack individual, and use the F1-score of the user behavior evaluation model on the test set as the individual fitness; and mark the individual positions with the top three fitness values ​​as 、 and ; Step S83: Iterative update.

6. The method for monitoring abnormal user data based on artificial intelligence according to claim 5, characterized in that: In step S8, the iterative update includes: Step S831: Calculate the convergence coefficient, and update the step size based on the convergence coefficient. Expressed as: ; ;in, is an auxiliary parameter, and are random numbers uniformly distributed from 0 to 1 and are independent of each other; Step S832: Individual position update; for each wolf : ; ; ; ; ; ; Where A and C are control vectors; 、 and is the candidate position vector; a is the convergence factor; and are the positions of the individual before and after the update, respectively; Step S833: Fine-grained perturbation search; first define the mapping as ;in, and are the n+1th and nth mapping parameters respectively; P is the threshold parameter; the perturbation solution is generated for 10% of random individuals , expressed as: ; and are two random individual positions; the position with higher fitness value is retained; Step S834: Parameter bit flip mutation; for the individual after fine-grained perturbation search, bit by bit with probability implement ;in, and g are the dimensional values ​​of the individual's position before and after mutation, respectively; High is the upper limit of the search space dimension; if the individual's fitness value is improved after mutation, it is retained; Step S835: Update 、 and ; Set the individual fitness threshold. If there is an individual fitness value higher than the fitness threshold, the iterative update is completed, and the user behavior evaluation model obtained based on the individual position is used as the final established user behavior evaluation model; otherwise, if the maximum number of iterations is reached, return to step S81; otherwise, continue to iterate.

7. The method for monitoring abnormal user data based on artificial intelligence according to claim 6, characterized in that: In step S1, the data collection is to collect historical user behavior data; mark the user behavior type as a data label; the user behavior type includes normal and abnormal; Perform feature engineering to build a user behavior dataset; In step S9, the user abnormal data monitoring is to collect user behavior data in real time, input it into the established user behavior evaluation model, and perform user abnormal data monitoring based on the user behavior type output by the model.

8. An artificial intelligence-based user abnormal data monitoring system, configured to implement the artificial intelligence-based user abnormal data monitoring method according to any one of claims 1 to 7, characterized in that: It includes data acquisition module, user behavior evaluation model design module, normal behavior training design module, anomaly calibration design module, balanced weighting design module, training connection module, anomaly evaluation module, parameter adjustment module and user abnormal data monitoring module; The data collection module collects historical user behavior data and constructs a user behavior data set; The user behavior evaluation model is designed based on a lightweight MLP network to map each user behavior data into a behavior potential vector; The normal behavior training design module only uses normal samples to achieve normal behavior distribution modeling; The labeled anomaly calibration design module performs model calibration by defining normal probability and integrating labeled anomaly samples; The balanced weighted design module constructs a balanced weighted loss by dynamically adjusting weights based on the category balance coefficient and the difficulty adaptive index; The training bridging module designs a two-stage training strategy; The anomaly assessment module performs anomaly score assessment by updating the center of momentum and the behavior latent vector; The parameter adjustment module uses the optimized gray wolf search algorithm to adjust the model hyperparameters to establish a user behavior evaluation model; The user abnormal data monitoring module performs abnormal monitoring on real-time user behavior data based on the established user behavior evaluation model.

Images