Abnormal user detection method and system based on quantum machine learning

Abstract

The invention belongs to the field of anomaly detection, machine learning and quantum computing, and relates to an abnormal user detection method and system based on quantum machine learning. The method comprises the following steps: mapping a user portrait into a user mode vector; calculating a normal-abnormal boundary hyperplane, and projecting a user state vector to a normal hyperplane direction of the hyperplane; clustering the user state vectors to obtain N clustering centers; orthogonally normalizing the N clustering centers into N eigenstates, and calculating a representation matrix of the eigenstates; calculating the inner product and the distance between the user state vector and each eigenstate to represent the similarity between the user state vector and each eigenstate; and classifying by using a neural network to obtain an abnormal user detection result. According to the method, step-by-step gradient detection is realized step by step by using the eigenstate, abnormal users can be detected, and different abnormal degrees can be identified, so that a step-by-step management and control strategy aiming at users with different harm degrees in a service scene can be adapted.

Description

Technical Field

[0001] The present invention belongs to the fields of anomaly detection, machine learning, and quantum computing; it relates to a method and system for detecting abnormal users based on quantum machine learning. Specifically, in scenarios such as online lotteries and shopping on the Internet, by introducing quantum state simulation into the machine learning model, mapping user portraits into state vectors, and constructing a representation matrix based on the effective Hamiltonian theory, the model is expanded in the direction of breadth; using the machine learning model as the carrier of quantum state simulation, the detection accuracy is improved while taking into account the expansion in the depth direction. This allows the quantum state simulation and machine learning to be organically combined. At the same time, the characteristic of the gradual change of the eigenstate is utilized to achieve step-by-step detection to adapt to the gradient control strategy for users with different degrees of harm in business scenarios. Background Art

[0002] With the rise of the internet, a wide variety of online applications have permeated our lives, facilitating shopping, entertainment, and consumption, making our lives more convenient. However, internet technology has also spawned a variety of abnormal users, including zombie users, bots, and fake users. These users can cause economic losses, infringe on legitimate rights and interests, and disrupt market order.

[0003] In summary, detecting anomalous users is crucial. In the early days of the internet, rules were the dominant technology for anomaly detection. These rules, centered around "if-then" logical reasoning, provided simple and fast CRUD (create, delete, modify, and query) operations. However, rules struggled with nonlinear scenarios, were inflexible, and prone to misjudgment. Manual rule configuration was also time-consuming and labor-intensive. As data volumes increased, lists were increasingly used for detection, such as zombie IP lists for detecting DDoS attacks, phishing email lists for detecting phishing emails, and lists of spoofed phone numbers for detecting "phone farms." However, these lists had limited coverage and were prone to missed detections.

[0004] With the increase in computing power, machine learning is being applied in a growing number of applications, such as anomaly detection. Unsupervised learning is primarily used for automatic labeling and the discovery of anomalous groups. Supervised learning can be further divided into traditional supervised learning and deep learning. Deep learning is better at learning nonlinear patterns and processing time series data, such as user logs, and is therefore widely used in anomaly detection.

[0005] Machine learning can be combined with quantum computing to form quantum machine learning. For example, PSO, CNN, and clustering algorithms can all be quantized into Q-PSO, Q-CNN, and quantum clustering algorithms. These algorithms offer advantages in randomness, parallelism, and superposition properties, and are being applied in anomaly detection. However, they are still in the noisy medium-scale quantum stage, requiring some compromises, and the accuracy of anomaly detection needs to be improved. Summary of the Invention

[0006] In order to improve detection accuracy and achieve step-by-step detection, the present invention proposes an abnormal user detection method and system based on quantum machine learning, which can be applied to the detection and identification of abnormal user behavior and characteristic traffic behavior, such as in online lottery activities of telecom operators.

[0007] The technical solution adopted in the present invention is as follows:

[0008] A method for detecting abnormal users based on quantum machine learning, comprising the following steps:

[0009] Map user profiles to user state vectors;

[0010] Calculate the normal-abnormal boundary hyperplane and project the user state vector toward the normal hyperplane of the hyperplane;

[0011] Cluster the user state vectors to obtain N cluster centers;

[0012] Orthogonally normalize the N cluster centers into N eigenstates and calculate the representation matrix of the eigenstates;

[0013] Calculate the inner product and distance between the user state vector and each eigenstate to represent the similarity between the user state vector and each eigenstate;

[0014] Based on the similarity between the user state vector and each eigenstate, a neural network is used for classification to obtain abnormal user detection results.

[0015] Furthermore, mapping the user portrait to the user state vector includes: equating each feature in the user portrait to a basis vector, and linearly superimposing each basis vector to obtain the user state vector.

[0016] Furthermore, the normal-abnormal boundary hyperplane is calculated using an SVM algorithm.

[0017] Furthermore, clustering the user state vectors includes:

[0018] Use the K-Means algorithm to cluster user state vectors to form N cluster centers, where each cluster center represents the common characteristics of a group of users;

[0019] The coordinates of the cluster center are recorded as Determine the degree of abnormality based on business practice experience and reduce it step by step.

[0020] Furthermore, the orthogonal normalization of the N cluster centers into N eigenstates and calculation of the representation matrix of the eigenstates includes:

[0021] Use the Gram-Schmidt orthogonalization algorithm to orthogonally normalize the N cluster centers into eigenstates:

[0022]

[0023]

[0024] in, is the i-th cluster center before orthogonal normalization, cnt k is the kth eigenstate after orthogonal normalization, represents the inner product between different cluster centers, represents the inner product of the same cluster center and itself, ‖·‖ represents the modulo length operation;

[0025] remember The eigenvalue diagonal matrix Λ is preset in advance, according to the effective Hamiltonian theory A ptr =Q T ΛQ constructs N-order representation matrix A ptr .

[0026] Furthermore, the inner product of the user state vector and each eigenstate is calculated using a quantum circuit, and the quantum circuit is a swap-test circuit.

[0027] Furthermore, the classification using a neural network is to classify users based on a one-dimensional distance array or a one-dimensional inner product array using a neural network, and the classification includes binary classification and hierarchical classification.

[0028] An abnormal user detection system based on quantum machine learning, comprising:

[0029] The projection module is used to map the user profile into a user state vector, calculate the normal-abnormal boundary hyperplane, and project the user state vector toward the normal hyperplane of the hyperplane;

[0030] The quantization module is used to cluster the user state vectors to obtain N cluster centers;

[0031] The orthogonalization module is used to orthogonally normalize N cluster centers into N eigenstates and calculate the representation matrix of the eigenstates;

[0032] The similarity module is used to calculate the inner product and distance between the user state vector and each eigenstate, indicating the similarity between the user state vector and each eigenstate;

[0033] The fully connected module is used to perform classification based on the similarity between the user state vector and each eigenstate using a neural network to obtain abnormal user detection results.

[0034] The advantages of the present invention are as follows:

[0035] 1. The present invention utilizes the step-by-step nature of the eigenstate to implement step-by-step gradient detection, which can not only detect abnormal users, but also identify different degrees of abnormality to adapt to the step-by-step management strategy for users with different degrees of harm in business scenarios.

[0036] 2. By constructing a representation matrix, the present invention can develop the model not only in depth but also in breadth compared to traditional machine learning.

[0037] 3. The present invention provides a quantized detection solution for anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a flow chart of the abnormal user detection method based on quantum machine learning of the present invention.

[0039] Figure 2 The projection effect diagram in the projection layer of the present invention is shown in FIG. [A] is the direct clustering of the unprojected original data; [B] is the clustering after projection.

[0040] Figure 3 This is a comparison chart of the hyperplane decomposition effects calculated by LDA and SVM in the projection layer of the present invention.

[0041] Figure 4 This is the swap-test quantum circuit diagram.

[0042] Figure 5 is the detection accuracy of the present invention (using a classical computer). [A] is a binary detection of "normal-abnormal"; [B] is a three-stage step-by-step detection of "normal-fuzzy-abnormal"; and [C] is a four-stage step-by-step detection of "most normal-relatively normal-relatively abnormal-most abnormal".

[0043] Figure 6 is the detection accuracy of the present invention (using quantum circuits). [A] is a binary detection of "normal-abnormal"; [B] is a three-stage step-by-step detection of "normal-fuzzy-abnormal"; and [C] is a four-stage step-by-step detection of "most normal-relatively normal-relatively abnormal-most abnormal". DETAILED DESCRIPTION

[0044] The present invention will be described in further detail below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0045] In quantum mechanics, a physical state can be represented by a state vector, which is a linear superposition of multiple basis vectors. Drawing on this theory, a user profile can be viewed as a linear superposition of multiple features, mapping the user profile to a state vector. Therefore, according to the effective Hamiltonian theory, an N-order representation matrix is ​​constructed based on N-dimensional eigenstates, and its N eigenstates can serve as a reference for detection. Furthermore, eigenstates inherently exhibit a step-by-step nature, enabling step-by-step detection. Finally, embedding quantum state anatomy into a machine learning model can effectively improve detection accuracy. This framework can be implemented using either classical computers or quantum circuits, the former offering the advantage of high accuracy, while the latter offers the advantage of quantization.

[0046] The quantum machine learning-based abnormal user detection framework of the present invention is named qcADF (quantum classical abnormal detection framework) digital detection box, and its technical solution is as follows:

[0047] 1) Map the user profile into a user state vector;

[0048] 2) Calculate the "normal-abnormal boundary hyperplane" and then project the user state vector toward the normal hyperplane of the hyperplane;

[0049] 3) Use clustering algorithm to cluster user state vectors into N clusters;

[0050] 4) Orthogonally normalize the N cluster centers (i.e., N cluster centers) into N eigenstates, and calculate the representation matrix of the eigenstates;

[0051] 5) Normalize the user state vector;

[0052] 6) Calculate the inner product and distance between each user state vector and each eigenstate;

[0053] 7) Based on the inner product and distance between each user state vector and each eigenstate, a neural network is used for classification to obtain abnormal user detection results.

[0054] This detection framework (qcADF) has a five-layer structure (or five modules), namely the projection layer, quantization layer, and orthogonalization layer as pre-processing, the similarity layer as the detection core, and the fully connected layer as post-processing. The overall process architecture is as follows: Figure 1 The description of each layer is as follows:

[0055] (1) Projection layer

[0056] First, map the user portrait to a user state vector. User portrait refers to user behavior attributes, such as consumption amount, behavioral preferences, etc. For example, in the online lottery activities of telecom operators, the user portrait is behavioral attributes such as the number of lottery draws, monthly consumption amount, and the amount of winning tickets; for shopping scenarios, the user portrait is behavioral attributes such as consumption amount, purchased items or services. The method of mapping the user portrait to the user state vector is to equate each independent feature in the user portrait (such as consumption behavior, traffic usage, lottery behavior, etc.) to a basis vector, then the user state vector is the linear superposition of each feature (basis vector), that is:

[0057]

[0058] in, represents the user state vector, are the basis vectors obtained based on the user portrait, c0, c1, ..., c N are the coefficients of each basis vector.

[0059] Then, the SVM (Support Vector Machine) algorithm is used to calculate the "normal-abnormal boundary hyperplane", and then the user state vector is projected toward the normal hyperplane of the hyperplane to ensure that different eigenstates can reflect the gradual change of the abnormality degree. When clustering the projected raw data directly, all cluster centers are located near the "normal-abnormal boundary hyperplane", such as Figure 2 As shown. Therefore, the three cluster centers (in Figure 2 In the example, the vectors are represented by "+" (indicated by "+" in the image) and represent "fuzzy" categories, which cannot reflect the gradual change of the degree of abnormality of the eigenstate, affecting the accuracy. In order to ensure the "gradual decrease of the degree of abnormality of the eigenstate", the present invention comprehensively tests the LDA (Linear Discriminant Analysis) and SVM algorithms to calculate the "normal-abnormal boundary hyperplane" and project the vector to the normal hyperplane direction of the hyperplane. The results are as follows: Figure 2 As shown. Figure 2 It can be seen that the abnormality of each level of eigenstate decreases from top to bottom.

[0060] The effect comparison of using LDA and SVM algorithms to calculate the "normal-abnormal boundary hyperplane" is as follows: Figure 3 As shown in the figure, the SVM algorithm is more stable and its calculation results are not affected by the distribution of sample points. Therefore, the present invention uses the SVM algorithm to calculate the "normal-abnormal boundary hyperplane".

[0061] (2) Quantized layer

[0062] The K-Means algorithm is used to discretize and quantize the continuously changing vector to form N cluster centers, where each cluster center represents the common characteristics of a group of users. The coordinates of the cluster center are recorded as Determine the abnormality level (or suspiciousness level) based on business practice experience, and reduce the abnormality level step by step. remember

[0063] (3) Orthogonalization layer

[0064] Use the Gram-Schmidt orthogonalization algorithm to orthogonally normalize the N cluster centers into eigenstates:

[0065]

[0066] in, is the i-th cluster center before orthogonal normalization, cnt k is the kth eigenstate after orthogonal normalization, ← is the assignment symbol, represents the inner product between different cluster centers, represents the inner product of the same cluster center and itself, and ‖·‖ represents the modulo length operation.

[0067] remember The eigenvalue diagonal matrix Λ is preset in advance. According to the effective Hamiltonian theory A ptr =Q T ΛQ constructs N-order representation matrix A ptr .

[0068] Normalize the user state vector to be detected, and denote the user state vector to be detected as u.

[0069] (4) Similarity layer

[0070] Calculate the distance and inner product between the user state vector to be detected and the eigenstate to express the similarity between the user state vector and each eigenstate: distance = ‖u-cnt i ‖, inner product = <u|cnt i >.

[0071] In order to explore a fully quantized solution, the present invention uses quantum circuits to calculate the inner product of two vectors.

[0072] The present invention uses a swap-test circuit to calculate the inner product. The circuit is composed of an H gate and a c-swap gate. Figure 4 As shown in the figure. In the initial state, assuming that the control bit is initially in the |0> state, the two target bits are in the |φ> and state, the overall quantum state is After the initial state vector evolves through the H gate, we get When the Hadamard transform is applied to the first qubit, we obtain

[0073] The probability of measuring the auxiliary |0> is The probability of measuring the auxiliary |1> is Therefore, the inner product is or Where P represents the probability of a specific state.

[0074] (5) Fully connected layer

[0075] Based on the similarity between the user state vector and each eigenstate, a neural network is used to classify users according to the one-dimensional distance array or one-dimensional inner product array transmitted from the similarity layer. It can not only perform binary classification, but also perform step-by-step classification to identify different degrees of abnormality.

[0076] "Binary classification" refers to a classification granularity of only two categories: "normal" and "illegal." For this experiment, the dataset used only had two user labels: "normal" and "illegal." The model also outputs only two detection results: "normal" and "illegal."

[0077] "Gradual classification" means that the classification granularity is not just binary, but more refined. Users are not only divided into "normal" and "black and gray industry" categories, but also further subdivided into multiple categories such as "most normal" and "relatively normal."

[0078] In one embodiment, the quantum machine learning-based abnormal user detection framework described in this invention is implemented in the Python computer programming language, supplemented by NumPy for linear algebra operations such as orthogonal normalization and projection; Pandas for reading and outputting data; Sklearn for building machine learning models such as SVM, K-Means, and neural networks; and Qskit for building quantum circuits. These technologies are all mainstream programming languages ​​and frameworks and are widely applicable to various types of computers.

[0079] This solution is used in the online lottery activities of telecom operators to detect abnormal users such as scalpers and abnormal robot users. The detection results are as follows: Figure 5 As shown in the figure, as the vector dimension increases, when the vector dimension reaches 16 dimensions, the parameter space is closer to the complete space, and the accuracy of both "black or white binary" and "step-by-step gradient" labels can be significantly improved. In addition, as the classification granularity becomes finer, from the initial "black or white binary" to the "step-by-step gradient", the overall accuracy decreases. After using quantum circuits instead of classical computers to calculate the inner product, the detection accuracy is as follows Figure 6 shown.

[0080] The present invention can also be used for detection and identification of online shopping, e-commerce, abnormal traffic, etc., and can detect abnormal users or abnormal behaviors such as zombie users, network attacks, abnormal traffic, etc.

[0081] Another embodiment of the present invention provides an abnormal user detection system based on quantum machine learning, comprising:

[0082] The projection module is used to map the user profile into a user state vector, calculate the normal-abnormal boundary hyperplane, and project the user state vector toward the normal hyperplane of the hyperplane;

[0083] The quantization module is used to cluster the user state vectors to obtain N cluster centers;

[0084] The orthogonalization module is used to orthogonally normalize N cluster centers into N eigenstates and calculate the representation matrix of the eigenstates;

[0085] The similarity module is used to calculate the inner product and distance between the user state vector and each eigenstate, indicating the similarity between the user state vector and each eigenstate;

[0086] The fully connected module is used to perform classification based on the similarity between the user state vector and each eigenstate using a neural network to obtain abnormal user detection results.

[0087] The division of the above modules is only for illustration purposes. In actual applications, the above functions can be assigned to different functional modules as needed to complete all or part of the functions described in the above method. The specific working process of each module can refer to the corresponding process in the above method embodiment and will not be repeated here.

[0088] Another embodiment of the present invention provides a computer device (computer, server, smart phone, etc.), which includes a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the method of the present invention.

[0089] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, magnetic disk, optical disk), wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the steps of the method of the present invention are implemented.

[0090] While specific embodiments of the present invention have been disclosed for illustrative purposes, intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the disclosure of the preferred embodiments, and the scope of protection claimed in the present invention shall be determined by the scope of the claims.

Claims

1. A method for detecting abnormal users based on quantum machine learning, characterized in that: The following steps are involved: Map user profiles to user state vectors; Calculate the normal-abnormal boundary hyperplane and project the user state vector toward the normal hyperplane of the hyperplane; Cluster the user state vectors to obtain N cluster centers; Orthogonally normalize the N cluster centers into N eigenstates and calculate the representation matrix of the eigenstates; Calculate the inner product and distance between the user state vector and each eigenstate to represent the similarity between the user state vector and each eigenstate; Based on the similarity between the user state vector and each eigenstate, a neural network is used for classification to obtain abnormal user detection results.

2. The method according to claim 1, characterized in that Mapping the user portrait to the user state vector includes: equating each feature in the user portrait to a basis vector, and linearly superimposing each basis vector to obtain the user state vector.

3. The method according to claim 1, characterized in that The normal-abnormal boundary hyperplane is calculated using the SVM algorithm.

4. The method according to claim 1, wherein Clustering the user state vectors includes: Use the K-Means algorithm to cluster user state vectors to form N cluster centers, where each cluster center represents the common characteristics of a group of users; The coordinates of the cluster center are recorded as Determine the degree of abnormality based on business practice experience and reduce it step by step.

5. The method according to claim 1, wherein The orthogonal normalization of the N cluster centers into N eigenstates and calculation of the representation matrix of the eigenstates includes: Use the Gram-Schmidt orthogonalization algorithm to orthogonally normalize the N cluster centers into eigenstates: in, is the i-th cluster center before orthogonal normalization, cnt k is the kth eigenstate after orthogonal normalization, represents the inner product between different cluster centers, represents the inner product of the same cluster center and itself, ‖·‖ represents the modulo length operation; remember The eigenvalue diagonal matrix Λ is preset in advance, according to the effective Hamiltonian theory A ptr =Q T ΛQ constructs N-order representation matrix A ptr .

6. The method according to claim 1, characterized in that The inner product of the user state vector and each eigenstate is calculated using a quantum circuit, which is a swap-test circuit.

7. The method according to claim 1, characterized in that The classification using a neural network is to classify users based on a one-dimensional distance array or a one-dimensional inner product array using a neural network, and the classification includes binary classification and hierarchical classification.

8. An abnormal user detection system based on quantum machine learning, characterized in that: include: The projection module is used to map the user profile into a user state vector, calculate the normal-abnormal boundary hyperplane, and project the user state vector toward the normal hyperplane of the hyperplane; The quantization module is used to cluster the user state vectors to obtain N cluster centers; The orthogonalization module is used to orthogonally normalize N cluster centers into N eigenstates and calculate the representation matrix of the eigenstates; The similarity module is used to calculate the inner product and distance between the user state vector and each eigenstate, indicating the similarity between the user state vector and each eigenstate; The fully connected module is used to perform classification based on the similarity between the user state vector and each eigenstate using a neural network to obtain abnormal user detection results.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1 to 7 is implemented.

Images