A method and system for parsing multi-dimensional behavioral information based on the Transformer model

Abstract

The application relates to the field of text understanding and semantic analysis of natural language processing, in particular to a multi-dimensional behavior information analysis method and system based on a Transformer model, the method comprising four steps of data preparation, data preprocessing, feature extraction and analysis prediction, text information extraction is performed on images generated by behavior data through an OCR technology, and operation behaviors on terminal equipment are monitored in real time in combination with terminal sensing technology; the collected data is preprocessed to remove irrelevant information such as noise and special symbols, so that data quality and effectiveness are ensured; the processed data is input into a feature extraction model, a MiniRBT model is combined with a graph neural network to perform deep feature extraction and fusion processing; fusion features are analyzed and predicted through an improved Transformer model, and intelligent analysis of multi-dimensional behavior information is realized.

Description

Technical Field

[0001] This invention relates to the field of text understanding and semantic analysis in natural language processing, specifically to a method and system for parsing multi-dimensional behavioral information based on the Transformer model. Background Technology

[0002] With the continuous development of information technology, especially the advancements in artificial intelligence and data analytics, enterprises and organizations face unprecedented volumes of data and complex security threats. Traditional security measures often struggle to analyze data from different sources in real time and comprehensively, and have limitations in addressing complex behavioral patterns, anomalous events, and security threats.

[0003] Traditional security analysis methods largely rely on rule-based monitoring and machine learning models. While these methods can perform information analysis to some extent, they have many shortcomings when dealing with complex and diverse behavioral data. Specific pain points include:

[0004] 1. Traditional methods often struggle to process and integrate data from multiple sources (such as text, operational behavior, network traffic, etc.), resulting in insufficient accuracy and comprehensiveness in information analysis.

[0005] 2. Traditional models have limitations in capturing contextual relationships in behavioral data and often fail to effectively understand the correlation and long-term dependency between operational events.

[0006] 3. Behavioral data often exhibits complex patterns and anomalies, and traditional methods are weak in their ability to identify these, especially when faced with new attacks or uncommon anomalous behaviors, making it difficult to respond in a timely and effective manner.

[0007] Therefore, there is an urgent need for a solution that can efficiently and intelligently process behavioral data from multiple dimensions to improve the accuracy and real-time performance of security analysis. Summary of the Invention

[0008] To overcome the defects and shortcomings of existing technologies, this invention provides a multi-dimensional behavioral information parsing method and system based on the Transformer model. By integrating OCR technology, MiniRBT model, graph neural network and Transformer model, it can achieve in-depth analysis and prediction of behavioral data from multiple data sources, fundamentally solving many defects exposed by previous security analysis methods.

[0009] This invention proposes a method for parsing multi-dimensional behavioral information based on the Transformer model, including:

[0010] Data preparation involves accurately extracting behavioral data using OCR technology and combining it with terminal sensing technology to monitor operational behavior on terminal devices in real time and generate behavioral logs.

[0011] Data preprocessing involves integrating the collected image recognition data and terminal operation data, followed by data cleaning, data standardization, and missing value handling to ensure data quality and validity.

[0012] Feature extraction involves inputting the preprocessed data into a feature extraction model, which employs an architecture combining the MiniRBT model and a graph neural network. The MiniRBT model captures the dynamic changes in time series data, while the graph neural network processes the relationships and dependencies between data to generate multi-dimensional feature representations.

[0013] Analysis and prediction involve inputting fused features into the improved Transformer model for in-depth analysis and prediction, identifying complex behavioral patterns, detecting potential abnormal behaviors, and continuously optimizing the model through dynamic updates to achieve intelligent parsing of multi-dimensional behavioral information.

[0014] Preferably, the data preparation includes the following steps:

[0015] OCR Extraction: Collect behavior-related image data from target terminal devices, and use OCR technology to accurately extract text information from the collected images, converting characters, words and sentences in the images into structured text data;

[0016] Terminal monitoring: Combining terminal sensing technology, it monitors and records various operational behaviors on terminal devices in real time, including file access, information transmission, application startup and shutdown, and system setting changes. It also monitors the network traffic of terminal devices in real time, captures suspicious network activities, and integrates various event logs generated by terminal devices as an important data source for behavioral analysis.

[0017] Preferably, the data preprocessing includes the following steps:

[0018] Data cleaning: Denoising the text data extracted by OCR and the operation logs collected by terminal monitoring, removing irrelevant noise information, identifying and removing special symbols, garbled characters and format errors in the data, to ensure the data quality for subsequent analysis;

[0019] Data standardization: Converting data from different sources into a unified format facilitates subsequent feature extraction and model processing, and performs time synchronization processing on multi-source data to ensure that data collected at different times can be accurately matched, thereby improving the timeliness and accuracy of analysis.

[0020] Missing value handling: For missing values ​​in the dataset, use appropriate imputation methods, such as mean imputation, median imputation, or interpolation based on neighboring data, to ensure data integrity. For data records with too many missing values ​​that cannot be properly imputed, consider deleting them to avoid affecting the training effect of the model.

[0021] As a preferred method, features are extracted using the MiniRBT model and the graph neural network model. The specific steps include:

[0022] Feature selection: The MiniRBT model is used to perform in-depth analysis on the text information extracted by OCR, extracting valuable information such as semantic features and keyword frequency. Then, key behavioral features such as file access frequency, information transmission volume and number of abnormal network connections are extracted from the preprocessed data.

[0023] Input through the MiniRBT model: The processed embedding vectors are input into the MiniRBT model, which processes these embedding vectors layer by layer through a multi-layer neural network. Each layer contains multiple neural network units, which can capture deep semantic relationships and contextual dependencies in the text. As the data is passed layer by layer within the model, the model continuously integrates and updates the feature representations, gradually extracting higher-level semantic information.

[0024] Input via graph neural network: For the operation behavior data collected by terminal monitoring, construct a behavior graph, where nodes represent different operation events and edges represent the correlation between operations. Use graph neural network to perform convolution operation on the behavior graph to extract the structured features of nodes and edges, and capture complex behavior patterns and correlations.

[0025] Feature fusion: Feature fusion aims to effectively integrate features extracted from different sources and types to form a unified and informative feature representation.

[0026] Preferably, the input is obtained through a MiniRBT model, and the specific steps include:

[0027] Word segmentation: dividing the input raw text data into basic word or sub-word units;

[0028] Vocabulary mapping: Mapping each word or subword to a unique identifier in a predefined vocabulary, forming a sequence of vocabulary indexes;

[0029] Word embedding and position embedding: The vocabulary index sequence is converted into a high-dimensional dense vector representation, and position information is added to each word embedding vector, enabling the model to recognize the relative or absolute position of words in the sequence;

[0030] Multi-head self-attention mechanism: Input embedding vector to obtain self-attention output;

[0031] Multi-layer encoder stacking: The MiniRBT model extracts high-level semantic features of text layer by layer by stacking multiple encoder layers. Each encoder layer deepens the understanding of text and relationship modeling through self-attention mechanism and relation bottleneck mechanism. Through multi-layer self-attention, MiniRBT can capture long-distance dependencies and understand the implicit semantic connections and logical relationships in the text.

[0032] Preferably, the input is processed through a graph neural network, and the specific steps include:

[0033] Constructing a behavior graph: Based on the operation behavior data collected by terminal monitoring, a behavior graph is constructed. Each node in the behavior graph represents an operation event, and the edges represent the relationships or dependencies between these operation events.

[0034] Vocabulary mapping: Mapping each word or subword to a unique identifier in a predefined vocabulary to form a sequence of vocabulary indexes;

[0035] Initialize node features: Initialize feature representation for each node. Typically, basic information extracted from operation events, such as operation type, timestamp, and frequency, can be used as the node's initial feature vector.

[0036] Constructing an adjacency matrix: Based on the relationships between operation events in the behavioral graph, construct an adjacency matrix or the graph's topology.

[0037] Graph convolution operation: Using the convolution operation of graph neural networks, node features are updated. Through the information in the adjacency matrix, the graph convolution layer aggregates the feature information of neighboring nodes to the target node to update the node representation.

[0038] Preferably, the analysis and prediction specifically include the following steps:

[0039] Feature fusion: Features extracted from MiniRBT and graph neural network models are fused to form a unified feature vector. These features include semantic information, keyword frequency, file access frequency, information transmission volume, and number of abnormal network connections.

[0040] Format conversion: Convert the fused feature vectors into an input format acceptable to the Transformer model. Specific methods include standardizing numerical features to a uniform numerical range and converting text features into embedding vectors to ensure that the dimensions and types of all input data match the input requirements of the Transformer model.

[0041] Input embedding and encoding: The feature vector is transformed into a high-dimensional embedding representation through the embedding layer to capture the complex relationships between features. In addition, positional encoding is added to capture positional information in sequence data, which helps the model understand the order and relative position of features.

[0042] Deep feature extraction: Through layer-by-layer feedforward neural networks, features are further extracted and transformed to generate higher-level representations. In addition, the output of each layer is processed through residual connections and layer normalization to ensure effective gradient propagation and training stability.

[0043] Baseline model establishment: Based on historical data, establish a baseline of normal user behavior as a reference standard for anomaly detection, analyze the distribution pattern of normal behavior characteristics, and determine the identification threshold and standard for abnormal behavior;

[0044] Anomaly detection mechanism: By comparing the deviation of current behavioral characteristics with the normal baseline, significant deviations in behavior are identified, and anomaly detection is performed at different time scales and behavioral levels to capture potential security threats.

[0045] Preferably, the real-time prediction and dynamic update specifically include the following steps:

[0046] Behavioral trend prediction: Utilizing historical behavioral data, time series analysis is conducted to predict possible future behavioral patterns and trends, establish behavioral trend models, identify trends in behavioral pattern changes, and predict possible future abnormal behaviors.

[0047] Real-time data processing: Employing a streaming processing architecture, new behavioral data is received and processed in real time to ensure the timeliness of predictions. Through incremental learning methods, model parameters are dynamically updated to adapt to new behavioral patterns and data changes.

[0048] Model adaptive adjustment: Driven by real-time data, online learning is performed to continuously optimize model performance and prediction accuracy. Based on real-time data and prediction results, the threshold for anomaly detection is dynamically adjusted to improve the sensitivity and accuracy of the system.

[0049] A multi-dimensional behavioral information parsing system based on the Transformer model executes the method described herein, which includes: a data preparation module, a data preprocessing module, a feature extraction module, and an analysis and prediction module.

[0050] The data preparation module is used to accurately extract and monitor behavioral data from multiple sources in real time through OCR technology and terminal perception technology, thereby providing high-quality and comprehensive data support for subsequent behavioral analysis.

[0051] The data preprocessing module is used to clean, integrate, and standardize the collected image recognition data and terminal operation data to ensure the accuracy and efficiency of subsequent analysis.

[0052] The feature extraction module is used to deeply mine and extract multi-dimensional and deep-level behavioral features from the preprocessed data by combining the MiniRBT model and graph neural network, so as to provide high-quality input for subsequent analysis and prediction.

[0053] The analysis and prediction module is used to perform in-depth analysis and prediction of fused features using the improved Transformer model, thereby identifying complex behavioral patterns and potential security threats.

[0054] The present invention has the following beneficial effects:

[0055] 1. By integrating OCR technology, MiniRBT model, graph neural network and Transformer model, the limitations of traditional methods in processing and integrating multi-source data are solved, and the accuracy and comprehensiveness of information parsing are improved.

[0056] 2. By combining the temporal feature extraction capability of the MiniRBT model with the correlation analysis capability of graph neural networks, the system can effectively understand and capture the relationships and dependencies between operational events, thereby improving its ability to identify complex behavioral patterns.

[0057] 3. By using the improved Transformer model to perform in-depth analysis and prediction of multi-dimensional fusion features, it is possible to identify potential abnormal behaviors or security threats, and achieve more efficient and accurate security prediction. Attached Figure Description

[0058] Figure 1 This is a schematic diagram of the overall framework of the multi-dimensional behavioral information parsing method based on the Transformer model of the present invention;

[0059] Figure 2 This is a schematic diagram of the data preprocessing process of the present invention;

[0060] Figure 3 This is a schematic diagram of the feature extraction network structure based on the MiniRBT model of the present invention;

[0061] Figure 4 This is a schematic diagram of the feature extraction network structure based on the graph neural network model of the present invention;

[0062] Figure 5 This is a schematic diagram of the analysis and prediction network structure based on the Transformer model of this invention. Detailed Implementation

[0063] Please refer to the attached document. Figure 1-5 The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0064] Example 1: Overall Method Flow

[0065] like Figure 1 As shown, this invention provides a method for parsing multi-dimensional behavioral information based on the Transformer model, which includes the following steps:

[0066] S1: Data preparation involves accurately extracting and monitoring behavioral data from multiple sources using OCR and terminal sensing technologies, thereby providing high-quality and comprehensive data support for subsequent behavioral analysis.

[0067] OCR technology is primarily used to extract text information from image data (such as document editing, screenshots, etc.) to ensure the integrity and accuracy of the text content. Terminal sensing technology, on the other hand, is used to monitor various operational behaviors on terminal devices in real time, including file access, information transmission, network traffic, etc., generating detailed behavior logs.

[0068] S2: Data preprocessing involves the initial integration of collected image recognition data and terminal operation data to ensure seamless connection and collaborative processing of data from different sources in subsequent steps. Then, the collected raw data is cleaned, standardized, and missing value is handled.

[0069] Data cleaning includes removing noise, special symbols, and other irrelevant information; data standardization includes unifying data formats, timestamp formats, and file path representations; and missing value handling employs appropriate imputation methods to ensure data integrity. These preprocessing steps guarantee high-quality and high-availability data, laying a solid foundation for the accurate analysis of multi-dimensional behavioral information.

[0070] S3: Feature Extraction. The preprocessed data is input into the feature extraction model, which employs an architecture combining MiniRBT and graph neural networks. The MiniRBT model, through a multi-layer residual block structure, effectively captures dynamic features in time-series data, improving the ability to identify behavioral patterns. Graph neural networks are used to handle relationships and dependencies between data, especially in complex terminal operations where implicit correlations often exist between different operations. Graph neural networks can effectively model these relationships and extract richer feature representations.

[0071] By deeply integrating MiniRBT with graph neural networks, the system can extract key features of behavioral data from multiple dimensions and levels, providing high-quality input for subsequent analysis and prediction.

[0072] S4: Analysis and Prediction. The analysis and prediction stage is the core of the entire method. It uses the Transformer model to perform in-depth analysis and prediction of the extracted fused features. Specifically, the features are first fused to form a unified feature vector, and then format conversion is performed to make it conform to the input requirements of the Transformer model. Next, input embedding and encoding are used to capture the complex relationships between features, and then high-level representations are generated through deep feature extraction.

[0073] Simultaneously, the system establishes a baseline model of normal user behavior as a reference standard for anomaly detection, and identifies potential abnormal behaviors by comparing the current behavior with the baseline. Furthermore, the model can perform real-time predictions and dynamic updates, continuously optimizing its analytical and predictive capabilities based on new behavioral data.

[0074] Through the coordinated work of these four steps, the system can achieve comprehensive analysis of multi-dimensional behavioral information, providing strong support for security monitoring and abnormal behavior detection.

[0075] Example 2: Detailed Implementation of Data Preparation

[0076] This embodiment details the data preparation steps, specifically including two key steps: OCR extraction and terminal monitoring.

[0077] The OCR extraction process first collects behavior-related image data from the target terminal device. These images may originate from screenshots of document editing software interfaces, images generated by screen capture tools, etc. Then, advanced OCR technology is used to accurately extract text information from the collected images. Preferably, a deep learning-enhanced OCR model is employed. This model integrates three main components: text detection, character recognition, and post-processing optimization, effectively handling complex backgrounds, multiple fonts, and various text formats.

[0078] In practical applications, OCR technology can recognize characters, words, and sentences in images and convert them into structured text data. This extracted text data serves as important input for behavioral analysis, helping to understand the behavioral characteristics of users during document manipulation and information processing.

[0079] The terminal monitoring stage first combines terminal sensing technology to monitor and record various operational behaviors on the terminal device in real time. These behaviors include, but are not limited to, file access (such as file creation, modification, and deletion), information transmission (such as data upload and download, message sending and receiving), application startup and shutdown, and system setting changes. Preferably, the terminal sensing technology adopts a combination of kernel-level monitoring and application-level monitoring to ensure that comprehensive operational behavior data can be captured.

[0080] Meanwhile, the system monitors network traffic of terminal devices in real time, capturing suspicious network activities such as abnormal upload and download behaviors and unknown network connection requests. In addition, the system integrates various event logs generated by terminal devices, including system logs, security logs, and application logs, as an important data source for behavioral analysis.

[0081] By combining OCR extraction and terminal monitoring, this method can comprehensively collect user behavior data, providing a rich and accurate data foundation for subsequent behavior analysis.

[0082] Example 3: Detailed Implementation of Data Preprocessing

[0083] This embodiment details the data preprocessing steps, including three main stages: data cleaning, data standardization, and missing value handling.

[0084] The data cleaning process primarily involves denoising the text data extracted by OCR and the operation logs collected by terminal monitoring, removing irrelevant noise. For OCR-extracted text data, common noise includes background interference in images and text recognition errors; for terminal operation logs, noise may originate from automatically generated irrelevant records and duplicate data. By designing targeted filtering rules, the system can identify and remove this noise.

[0085] Preferably, data cleaning employs a combination of rule-based and machine learning methods. Rule-based methods use predefined patterns and regular expressions to identify common noise types; machine learning methods train models to learn features that distinguish valid information from noise, making them particularly suitable for handling complex data with varied noise types. Furthermore, the system identifies and removes special symbols, garbled characters, and formatting errors from the data to ensure data quality for subsequent analysis.

[0086] The data standardization process converts data from different sources into a unified format, facilitating subsequent feature extraction and model processing. This includes standardizing timestamp formats (e.g., converting all time representations to the standard UTC format), standardizing file path representations (e.g., handling differences in path representations across different operating systems), and standardizing event type encoding (e.g., mapping similar operations from different sources to the same category).

[0087] Preferably, the system employs automated mapping rules and conversion tools to achieve rapid data format unification. Simultaneously, for multi-source data, the system performs time synchronization processing to ensure accurate correspondence between data collected at different times, improving the timeliness and accuracy of the analysis.

[0088] The missing value handling stage addresses missing values ​​in the dataset by employing appropriate imputation methods to ensure data integrity. Common imputation methods include mean imputation (filling missing values ​​with the average of the field), median imputation (filling missing values ​​with the median of the field), or interpolation methods based on neighboring data (such as linear interpolation, spline interpolation, etc.).

[0089] Preferably, the system automatically selects the most suitable imputation method based on the type and distribution characteristics of the missing values. For example, for missing values ​​in time series data, time series interpolation methods are preferred; for missing values ​​of categorical features, mode imputation is preferred. In addition, the system sets a missing value rate threshold. For data records with too many missing values ​​(e.g., exceeding 30%) that cannot be reasonably imputed, the system will consider deleting them to avoid affecting the training effect of the model.

[0090] By organically combining data cleaning, data standardization, and missing value handling, this method can effectively improve data quality and provide a reliable data foundation for subsequent feature extraction and model analysis.

[0091] Example 4: Feature Extraction Based on MiniRBT and Graph Neural Networks

[0092] This embodiment details the feature extraction steps, which employ an architecture combining the MiniRBT model and a graph neural network to extract multi-dimensional, deep-level behavioral features from the preprocessed data.

[0093] First, the system performs feature selection, using the MiniRBT model to conduct in-depth analysis of the text information extracted by OCR, extracting valuable information such as semantic features and keyword frequencies. Simultaneously, it extracts key behavioral features from the preprocessed data, such as file access frequency, data transmission volume, and the number of abnormal network connections. These initially extracted features will serve as the foundation for subsequent deep feature extraction.

[0094] Then, the preprocessed text data is converted into embedding vectors and input into the MiniRBT model. For example... Figure 3 As shown, the MiniRBT model processes these embedded vectors layer by layer through a multi-layer neural network. Each layer contains multiple neural network units that can capture deep semantic relationships and contextual dependencies in the text. As data is passed layer by layer within the model, the model continuously integrates and updates feature representations, gradually extracting higher-level semantic information.

[0095] Preferably, the MiniRBT model employs an improved residual connection structure, effectively mitigating the gradient vanishing problem in deep networks and enhancing the model's representational power. Simultaneously, by introducing an attention mechanism, the model can adaptively focus on important parts of the text while ignoring irrelevant information, further improving the efficiency and quality of feature extraction.

[0096] Simultaneously, for the operational behavior data collected by terminal monitoring, the system constructs a behavior graph, where nodes represent different operational events and edges represent the correlation between operations. For example... Figure 4 As shown, through the convolution operation of graph neural networks, the system can extract the structured features of nodes and edges, and capture complex behavioral patterns and relationships.

[0097] Preferably, the graph neural network employs a multi-layer graph convolutional structure, where the output of each layer serves as the input to the next. Through multi-layer transmission and information integration, the feature representation of nodes is further enriched. Furthermore, the system introduces an attention mechanism, enabling the model to automatically learn the importance weights of different neighboring nodes, thereby improving the effectiveness of feature extraction.

[0098] Finally, the system fuses the features extracted from the MiniRBT model and the graph neural network to form a unified and informative feature representation. Preferably, the feature fusion adopts an attention-weighted approach, automatically learning the importance of features from different sources and dynamically adjusting the weights according to task requirements to ensure that the fused features retain the information of the original features to the greatest extent.

[0099] By deeply integrating the MiniRBT model with graph neural networks, the system can comprehensively capture the temporal and structural features of behavioral data, providing rich feature representations for subsequent analysis and prediction.

[0100] Example 5: Detailed Implementation of Feature Extraction Based on MiniRBT Model

[0101] This embodiment details the feature extraction steps based on the MiniRBT model, which perform deep processing on text data to extract high-level semantic features.

[0102] First, word segmentation is performed to divide the input raw text data (such as text in document editing or screenshots) into basic words or sub-word units. Preferably, word segmentation uses a combination of dictionary-based and statistical model-based methods, which can effectively handle specialized terminology and complex language structures. Simultaneously, the system supports multilingual word segmentation, adapting to the text analysis needs of different language environments.

[0103] Then, a vocabulary mapping is performed, mapping each word or subword to a unique identifier (ID) in a predefined vocabulary list, forming a vocabulary index sequence. Preferably, the vocabulary list adopts a hierarchical structure, containing two parts: general vocabulary and domain-specific vocabulary. It is constructed through a combination of pre-training and fine-tuning to ensure the vocabulary list's coverage and representational capabilities.

[0104] Next, word embedding and position embedding are performed to convert the vocabulary index sequence into a high-dimensional dense vector representation, and positional information is added to each word embedding vector, enabling the model to identify the relative or absolute position of words in the sequence. Preferably, word embedding uses a pre-trained embedding matrix, which is obtained through training on a large-scale corpus and can capture the semantic relationships of words; position embedding is generated using sine and cosine functions, which can represent the absolute and relative positional information in the sequence.

[0105] Then, the input embedding vector is processed using a multi-head self-attention mechanism. For example... Figure 3 As shown, the self-attention mechanism can calculate the degree of association between each position in the sequence and all other positions, thereby capturing long-distance dependencies. Preferably, an 8-head attention mechanism is used, where each attention head focuses on different aspects of the input sequence, enhancing the model's representational power.

[0106] Next, features are further extracted through multi-layer encoder stacking. The MiniRBT model extracts high-level semantic features of the text layer by layer by stacking multiple encoder layers (typically 6-12 layers). Each encoder layer continuously deepens its understanding of the text and relationship modeling through self-attention and relation bottleneck mechanisms. Preferably, each encoder layer includes a self-attention layer, a feedforward neural network layer, residual connections, and layer normalization. This structural design effectively alleviates the gradient vanishing problem and improves the training stability and representational power of the model.

[0107] Through multi-layer self-attention, MiniRBT can capture long-distance dependencies and understand the implicit semantic connections and logical relationships in text. Finally, the system obtains the output of the last encoder layer as the feature representation of the text. This feature representation contains deep semantic information of the text, providing rich semantic features for subsequent behavior analysis.

[0108] Example 6: Detailed Implementation of Feature Extraction Based on Graph Neural Networks

[0109] This embodiment details the feature extraction steps based on graph neural networks, which perform structured processing on terminal operation behavior data to extract behavior patterns and relationships.

[0110] First, a behavior graph is constructed based on the operational behavior data collected from terminal monitoring. For example... Figure 4As shown, each node in the behavioral graph represents an operation event (such as file access, network connection, etc.), and the edges represent the relationships or dependencies between these operation events (such as operation order, co-occurrence, etc.). Preferably, for the connection relationships between nodes, the system considers multiple association types, including temporal relationships (such as sequential order), functional relationships (such as calling relationships), semantic relationships (such as similar operations), etc., thereby constructing a heterogeneous graph network with multiple relationship types.

[0111] Then, a vocabulary mapping is performed, mapping the attribute information of each node (such as operation type, target object, etc.) to a predefined vocabulary to form a vocabulary index sequence. Preferably, the node attributes adopt multimodal representation, including text description, category encoding, numerical features, etc., to comprehensively capture the feature information of the node.

[0112] Next, node feature initialization is performed, and an initial feature representation is created for each node. Preferably, the initial features include multi-dimensional information: basic attributes (such as operation type and timestamp), statistical features (such as operation frequency and duration), and contextual features (such as the sequence of preceding and following operations). Through this multi-dimensional feature representation, the system can describe the characteristics of operation events from multiple perspectives.

[0113] Then, an adjacency matrix is ​​constructed based on the relationships between operational events in the behavioral graph, forming either an adjacency matrix or the graph's topology. Preferably, for heterogeneous graphs with multiple relationship types, the system constructs multiple adjacency matrices, each corresponding to one relationship type, thereby preserving rich structural information in the graph.

[0114] Next, graph convolution operations are performed, utilizing the convolution mechanism of graph neural networks to update node features. For example... Figure 4 As shown, the graph convolutional layer aggregates the feature information of neighboring nodes to the target node using the information in the adjacency matrix to update the node's representation. Preferably, the graph convolution employs an attention-weighted message passing mechanism, dynamically adjusting the weights of feature aggregation based on the strength of the association between nodes to improve the accuracy of feature updates.

[0115] To capture more complex inter-node dependencies, the system employs a multi-layer graph convolutional structure, where the output of each layer serves as the input to the next. Through layer-by-layer propagation and feature transformation, the feature representation of nodes is further enriched. Preferably, the system uses a 3-5 layer graph convolutional network, with each layer containing residual connections and layer normalization, effectively mitigating the problems of over-smoothing and gradient vanishing.

[0116] Finally, the system aggregates the node features after multi-layer convolution to form the final graph feature representation. Preferably, the node feature aggregation adopts an attention pooling mechanism, which automatically learns the importance weights of different nodes to generate a global representation of the graph. This global feature representation not only includes the local features of each node, but also integrates the structural relationship information between nodes, providing a rich feature foundation for the recognition of behavioral patterns.

[0117] Through deep processing of graph neural networks, the system can effectively capture structured features and patterns in operational behavior data, providing strong support for subsequent behavior analysis.

[0118] Example 7: Detailed Implementation of Analysis and Prediction

[0119] This embodiment details the analysis and prediction steps, which utilize the Transformer model to perform in-depth analysis and prediction of fused features, identifying complex behavioral patterns and potential security threats.

[0120] First, feature fusion is performed, combining features extracted from MiniRBT and the graph neural network model to form a unified feature vector. Preferably, feature fusion employs a combination of multilayer perceptron and attention mechanisms, which can automatically learn the importance weights of different features and dynamically adjust the fusion strategy according to task requirements. The fused feature vector contains rich multi-dimensional information, such as semantic information, keyword frequency, file access frequency, information transmission volume, and the number of abnormal network connections.

[0121] Then, a format conversion is performed to transform the fused feature vectors into an input format acceptable to the Transformer model. This includes standardizing numerical features to a uniform range (e.g., [0,1] or [-1,1]), converting textual features into embedding vectors, and ensuring that the dimensions and types of all input data match the requirements of the Transformer model. Preferably, the system employs an adaptive normalization strategy, selecting an appropriate normalization method based on the distribution characteristics of the features to improve the effectiveness of data transformation.

[0122] Next, input embedding and encoding are performed, transforming the feature vectors into high-dimensional embedding representations through an embedding layer to capture the complex relationships between features. Simultaneously, the system adds positional encoding information to help the model understand the order and relative position of features. Preferably, a learnable positional encoding method is employed, automatically optimizing the positional representations through training to improve the model's ability to understand sequence information.

[0123] Then, deep feature extraction is performed. Through a layer-by-layer feedforward neural network, features are further extracted and transformed to generate higher-level representations. For example... Figure 5As shown, the output of each layer undergoes residual connections and layer normalization to ensure effective gradient propagation and training stability. Preferably, the system employs a 12-layer Transformer encoder, with each layer containing a multi-head self-attention mechanism and a feedforward neural network, generating expressive feature representations through deep feature transformation and information integration.

[0124] Next, a baseline model is established. Based on historical data, the system establishes a baseline of normal user behavior as a reference standard for anomaly detection. Preferably, the baseline model employs an adaptive update mechanism, which can automatically adjust the baseline according to dynamic changes in user behavior, ensuring that the model can adapt to environmental changes and adjustments in user habits. The baseline model includes a multi-dimensional distribution of behavioral features, and the feature range and patterns of normal behavior are determined through statistical analysis and machine learning methods.

[0125] Finally, anomaly detection is performed, comparing the deviation of current behavioral characteristics with the normal baseline to identify significantly deviating behaviors. Preferably, the system employs a multi-layered anomaly detection strategy, ranging from single-feature deviations to multi-feature combination deviations, and from short-term behavioral anomalies to long-term behavioral trend anomalies, comprehensively capturing potential security threats. Simultaneously, the system has adjustable thresholds and confidence scores, allowing for flexible adjustment of detection sensitivity based on security needs and risk levels.

[0126] Through the above steps, the system can comprehensively analyze user behavior characteristics and detect potential abnormal behaviors in real time, providing strong support for security monitoring and threat early warning.

[0127] Example 8: Detailed Implementation of Real-time Prediction and Dynamic Update

[0128] This embodiment details the real-time prediction and dynamic update steps, which enable the system to predict future behavior based on historical data and continuously optimize model performance through continuous learning.

[0129] First, behavioral trend prediction is performed. Using historical behavioral data, the system conducts time series analysis to predict potential future behavioral patterns and trends. Preferably, the system employs a combination of multiple time series models, including the ARIMA model (suitable for linear trends), LSTM networks (suitable for nonlinear complex patterns), and the Prophet model (suitable for periodic and seasonal patterns), automatically selecting the most suitable prediction model based on data characteristics. Through this integrated prediction approach, the system can accurately capture different types of behavioral change trends.

[0130] Simultaneously, the system establishes a behavioral trend model to identify changing characteristics of behavioral patterns and predict potential future abnormal behaviors. Preferably, the trend model not only focuses on absolute changes in behavior but also analyzes the relative rate of change and change patterns, thereby enabling early identification of potential abnormal trends. For example, the system can detect abnormal increases in file access frequency, sudden changes in network connection patterns, or abnormal combinations of operation sequences, thus providing early warnings of potential security risks.

[0131] Then, real-time data processing is performed using a streaming architecture. The system can receive and process new behavioral data in real time, ensuring the timeliness of predictions. Preferably, the system employs a distributed streaming processing framework, combined with efficient data caching and indexing mechanisms, enabling data reception, parsing, and preliminary analysis to be completed within milliseconds, meeting the needs of real-time monitoring.

[0132] Meanwhile, the system dynamically updates model parameters through incremental learning to adapt to new behavioral patterns and data changes. Preferably, incremental learning employs online gradient descent and an elastic window mechanism, enabling the rapid absorption of information from new data while retaining historical knowledge, thus achieving smooth model updates. This incremental learning approach avoids the drawback of traditional batch learning, which requires periodic retraining, significantly improving the efficiency and timeliness of model updates.

[0133] Finally, the model undergoes adaptive adjustment. Driven by real-time data, the system learns online and continuously optimizes model performance and prediction accuracy. Preferably, the system employs a multi-objective optimization strategy, simultaneously considering model accuracy, recall, and timeliness, and dynamically adjusting the weights of the optimization objectives according to the needs of the actual application scenario.

[0134] Meanwhile, the system dynamically adjusts the anomaly detection threshold based on real-time data and prediction results, improving the system's sensitivity and accuracy. Preferably, the threshold adjustment employs adaptive control theory, automatically optimizing the detection threshold based on the accuracy and false alarm rate of historical detection results, effectively reducing the false alarm rate while ensuring detection sensitivity.

[0135] Through real-time prediction and dynamic update mechanisms, the system can continuously learn and adapt to environmental changes, constantly improving the accuracy and timeliness of behavioral analysis and prediction, and providing strong support for security monitoring and threat defense.

[0136] Example 9: System Overall Architecture

[0137] This embodiment details the multi-dimensional behavioral information parsing system based on the Transformer model, which includes four main functional modules: data preparation module, data preprocessing module, feature extraction module, and analysis and prediction module.

[0138] The data preparation module is used to accurately extract and monitor behavioral data from various sources in real time using OCR and terminal awareness technologies. This module comprises two sub-modules: an OCR extraction sub-module and a terminal monitoring sub-module. The OCR extraction sub-module is responsible for extracting text information from image data, employing a deep learning-enhanced OCR algorithm to accurately recognize text content in complex backgrounds. The terminal monitoring sub-module is responsible for real-time monitoring of various operational behaviors on terminal devices, using a combination of kernel-level and application-layer monitoring to comprehensively capture user actions.

[0139] The data preprocessing module is used to clean, integrate, and standardize the collected image recognition data and terminal operation data. This module comprises three sub-modules: a data cleaning sub-module, a data standardization sub-module, and a missing value handling sub-module. The data cleaning sub-module removes noise and irrelevant information from the data, employing a combination of rule-based and machine learning methods to effectively identify and filter various types of noise. The data standardization sub-module unifies the format and representation of data from different sources, ensuring data consistency and comparability. The missing value handling sub-module addresses missing values ​​in the data, using intelligent imputation algorithms to guarantee data integrity and quality.

[0140] The feature extraction module is used to deeply mine and extract multi-dimensional, in-depth behavioral features from preprocessed data. This module consists of two main sub-modules: the MiniRBT processing sub-module and the graph neural network processing sub-module. The MiniRBT processing sub-module is responsible for analyzing text data, extracting deep semantic features, and employing a multi-layer self-attention mechanism to effectively capture contextual relationships within the text. The graph neural network processing sub-module is responsible for analyzing the relationships between operational behaviors, constructing behavioral graphs and extracting structured features, and employing multi-layer graph convolution operations to deeply mine behavioral patterns and correlations.

[0141] The Analysis and Prediction module utilizes an improved Transformer model to perform in-depth analysis and prediction of fused features. This module comprises four sub-modules: Feature Fusion, Transformer Analysis, Anomaly Detection, and Prediction Update. The Feature Fusion sub-module integrates features from different feature extraction paths to form a unified feature representation. The Transformer Analysis sub-module performs deep analysis of the fused features, employing a multi-layer Transformer encoder to fully understand the complex relationships between features. The Anomaly Detection sub-module compares the current behavior with a normal baseline to identify potential anomalous behavior. The Prediction Update sub-module predicts future behavior trends based on historical data and continuously optimizes model performance through incremental learning.

[0142] These four modules work closely together to form a complete processing pipeline, from data collection to feature extraction, and then to behavior analysis and prediction, enabling comprehensive analysis of multi-dimensional behavioral information and providing strong technical support for security monitoring, anomaly detection, and threat defense.

[0143] The following is a specific application case demonstrating the practical effectiveness of this invention. A financial institution needed to monitor the operational behavior of its internal employees to prevent the leakage of sensitive information and internal threats. The institution deployed the multi-dimensional behavioral information analysis system of this invention to comprehensively monitor and analyze employees' document operations, network activities, and system access.

[0144] In practical applications, the system first extracts the document content processed by employees using OCR technology, while simultaneously monitoring employee actions such as file access and data transfer using terminal sensing technology. Next, the system preprocesses the collected data, removing noise and standardizing the format. Then, it analyzes the semantic features of the document content using a MiniRBT model and analyzes patterns and relationships in employee actions using a graph neural network. Finally, the system uses a Transformer model to comprehensively analyze these features, establishing a baseline for normal employee behavior and monitoring abnormal behavior in real time.

[0145] During a monitoring session, the system detected unusual behavior from an employee: this employee accessed a large number of files containing customer information within a short period and attempted to send these files to an external email address. The system immediately recognized this unusual pattern and issued an alert, enabling the security team to intervene quickly and effectively prevent a potential data breach.

[0146] This case demonstrates that the present invention can effectively integrate multi-dimensional behavioral information, accurately identify complex behavioral patterns, and promptly detect potential security threats, providing strong technical support for enterprise security.

[0147] While the present invention has been disclosed above with reference to preferred embodiments, these embodiments are not intended to limit the invention. Any person skilled in the art can make modifications and refinements without departing from the spirit and scope of the invention; therefore, the scope of protection of the present invention shall be defined by the claims.

Claims

1. A multi-dimensional behavior information analysis method based on a Transformer model, characterized in that, The method comprises the following steps: Data preparation: accurate extraction of behavior data through OCR technology, real-time monitoring of operation behavior on terminal equipment through terminal perception technology, and generation of behavior log; Data preprocessing: integrating the collected image recognition data and terminal operation data, and then performing data cleaning, data standardization and missing value processing to ensure data quality and effectiveness; Feature extraction: inputting the preprocessed data into a feature extraction model, which adopts a MiniRBT model combined with a graph neural network architecture, the MiniRBT model captures dynamic change features in time series data, and the graph neural network processes the relationship and dependency between data to generate multi-dimensional feature representation; Analysis and prediction: inputting the fused features into an improved Transformer model through the addition of a multi-head self-attention mechanism layer, a residual connection layer and layer normalization processing for in-depth analysis and prediction, identifying complex behavior patterns, detecting potential abnormal behaviors, and continuously optimizing the model through dynamic updating to realize intelligent analysis of multi-dimensional behavior information. 2.The method of claim 1, wherein, The data preparation comprises the following steps: OCR extraction: collecting image data related to behavior from the target terminal device, and using OCR technology to accurately extract text information from the collected images, converting characters, words and sentences in the images into structured text data; Terminal monitoring: combining terminal perception technology to monitor and record various operation behaviors on the terminal device in real time, including file access, information transmission, application startup and shutdown, and system setting changes, and monitoring the network traffic of the terminal device in real time to capture suspicious network activities, and integrating various event logs generated by the terminal device as an important data source for behavior analysis. 3.The method of claim 1, wherein, The data preprocessing comprises the following steps: Data cleaning: denoising the text data extracted by OCR and the operation logs collected by terminal monitoring, removing irrelevant noise information, identifying and removing special symbols, garbled codes and format errors in the data to ensure the quality of the data for subsequent analysis; Data standardization: converting data from different sources into a unified format to facilitate subsequent feature extraction and model processing, and performing time synchronization processing on multi-source data to ensure that data collected at different times can be accurately corresponded, improving the timeliness and accuracy of analysis; Missing value processing: at least one of the mean filling, median filling and linear interpolation method based on adjacent data is used to fill the missing values in the data to ensure data integrity, and data records with too many missing values and cannot be reasonably filled are considered to be deleted to avoid affecting the training effect of the model. 4.The method of claim 1, wherein, Feature extraction using MiniRBT model and graph neural network model, comprising the following steps: Feature selection: using MiniRBT model to analyze the text information extracted by OCR to extract semantic features and keyword frequency, and then extracting key behavior features from preprocessed data, including file access frequency, information transmission volume and abnormal network connection times; The input passes through the MiniRBT model: the processed embedding vectors are input into the MiniRBT model, which processes these embedding vectors layer by layer through a multi-layer neural network, each layer containing multiple neural network units that can capture deep semantic relationships and contextual dependencies in the text. As data passes through the model layer by layer, the model continuously integrates and updates feature representations, gradually extracting higher-level semantic information. The input passes through the graph neural network: for the terminal monitoring and collection of operation behavior data, a behavior graph is constructed, where nodes represent different operation events and edges represent the relevance between operations. The graph neural network is used to perform convolution operations on the behavior graph to extract structured features of nodes and edges, capturing complex behavior patterns and association relationships. Feature fusion: feature fusion aims to effectively integrate features extracted from different sources and types to form a unified and information-rich feature representation. 5.The method of claim 4, wherein, The input passes through the MiniRBT model, the specific steps include: Tokenization: the input raw text data is segmented into basic words or sub-word units; Vocabulary mapping: each word or sub-word is mapped to a unique identifier in the predefined vocabulary table to form a vocabulary index sequence; Word embedding and position embedding: the vocabulary index sequence is converted into a high-dimensional dense vector representation, and position information is added to each word embedding vector to enable the model to identify the relative or absolute position of the word in the sequence; Multi-head self-attention mechanism: input embedding vectors get self-attention output; Multi-layer encoder stacking: the MiniRBT model extracts high-level semantic features of the text layer by layer by stacking multiple encoder layers. Each encoder layer deepens the understanding and relationship modeling of the text through self-attention mechanisms and relationship bottleneck mechanisms. Through multi-layer self-attention, MiniRBT can capture long-distance dependency relationships and understand the implicit semantic connections and logical relationships in the text. 6.The method of claim 4, wherein, The input passes through the graph neural network, the specific steps include: Constructing a behavior graph: according to the terminal monitoring and collection of operation behavior data, a behavior graph is constructed, where each node in the behavior graph represents an operation event, and the edges represent the relationship or dependency between these operation events; Vocabulary mapping: each word or sub-word is mapped to a unique identifier in the predefined vocabulary table to form a vocabulary index sequence; Initialize node features: initialize the feature representation of each node using the basic information extracted from the operation event, including operation type, timestamp, and operation frequency, as the initial feature vector of the node; Construct an adjacency matrix: construct an adjacency matrix or the topological structure of the graph according to the relationship between operation events in the behavior graph; Graph convolution operation: use the convolution operation of the graph neural network to update the node features, and through the information in the adjacency matrix, the graph convolution layer aggregates the feature information of adjacent nodes to the target node to update the representation of the node. 7.The method of claim 1, wherein, The analysis and prediction, the specific steps include: Feature fusion: fuse the features extracted from MiniRBT and graph neural network model to form a unified feature vector, which includes semantic information, keyword frequency, file access frequency, information transmission volume and abnormal network connection frequency; Format conversion: convert the fused feature vector into the input format accepted by the Transformer model, including standardizing numerical features to a unified numerical range, converting text features into embedding vectors, and ensuring that the dimensions and types of all input data match the input requirements of the Transformer model; Input embedding and encoding: convert the feature vector into a high-dimensional embedding representation through the embedding layer to capture the complex relationships between features, and add position encoding to capture the position information in the sequence data to help the model understand the order and relative position of the features; Deep feature extraction: further extract and transform features through layer-by-layer feedforward neural networks to generate higher-level representations, and the output of each layer is connected through residual connection and layer normalization to ensure effective gradient propagation and training stability; Baseline model establishment: based on historical data, establish the user's normal behavior baseline as the reference standard for anomaly detection, analyze the distribution of normal behavior characteristics, and determine the identification threshold and standard of abnormal behavior; Abnormal detection mechanism: compare the deviation of the current behavior characteristics from the normal baseline to identify significantly deviated behaviors and detect potential security threats at different time scales and behavior levels. 8.The method of claim 1, wherein, The analysis and prediction steps further include real-time prediction and dynamic updating, which specifically include: Behavior trend prediction: use historical behavior data for time series analysis to predict future possible behavior patterns and trends, establish a behavior trend model, identify the trend of behavior patterns, and predict future possible abnormal behaviors; Real-time data processing: use a streaming processing architecture to receive and process new behavior data in real time to ensure the timeliness of the prediction, and use incremental learning methods to dynamically update model parameters to adapt to new behavior patterns and data changes; Model adaptive adjustment: driven by real-time data, perform online learning to continuously optimize model performance and prediction accuracy, dynamically adjust the threshold of anomaly detection based on real-time data and prediction results, and improve the sensitivity and accuracy of the system.

9. A multi-dimensional behavior information analysis system based on a Transformer model, performing the method of any one of claims 1-8, characterized in that, Including: Data preparation module, data preprocessing module, feature extraction module and analysis and prediction module; The data preparation module is used to accurately extract and monitor behavior data from multiple sources through OCR technology and terminal perception technology, thereby providing high-quality and comprehensive data support for subsequent behavior analysis; The data preprocessing module is used to clean, integrate and standardize the collected image recognition data and terminal operation data to ensure the accuracy and efficiency of subsequent analysis; The feature extraction module is used to deeply mine and extract multi-dimensional and deep-level behavior features from preprocessed data by combining MiniRBT model and graph neural network to provide high-quality input for subsequent analysis and prediction; The analysis and prediction module is used for in-depth analysis and prediction of the fusion features by using the improved Transformer model through adding a multi-head self-attention mechanism layer, a residual connection layer and layer normalization processing, so as to identify complex behavior patterns and potential security threats.

Images