Method, device and medium for dynamic monitoring of user operation risks based on data lineage

Abstract

The present application relates to a method, device and medium for dynamic monitoring of user operation risks based on data lineage, the method comprising the following steps: acquiring the operation behaviors of all users in real time, and extracting a continuous operation behavior of each user into a group of semantically related behavior fragments; matching a number of continuous behavior fragments of each user with a preset behavior template to obtain multiple intermediate behavior blocks by dimensionality reduction; traversally extracting a predetermined number of intermediate behavior blocks from the multiple intermediate behavior blocks in chronological order, and combining them to generate a sequence of behavior fragments; inputting the sequence of behavior fragments into a pre-trained neural network model to obtain a risk classification result or a risk probability distribution result corresponding to each sequence of behavior fragments. The present application has the advantages of being able to express each operation behavior in a structured manner, reconstruct the potential behavior chain through a combination strategy, and identify high-risk behavior paths hidden in data noise with the help of a deep model.

Description

Technical Field

[0001] The present application relates to the field of banking data, and in particular to a method, device, and medium for dynamically monitoring user operation risks based on data lineage. Background Art

[0002] With the continued expansion of information systems and the deep integration of multi-source data, enterprises and organizations are placing higher demands on the auditing and risk identification of internal user operations. In traditional security systems, user behavior auditing typically relies on static, rule-based detection methods. This involves using pre-set conditional statements and filtering rules to assess individual operations, such as whether sensitive fields are accessed, whether front-end systems are bypassed, and whether access occurs at night. These methods offer clear logic and rapid response, and are highly effective in addressing anomalous behaviors with a simple structure and clear boundaries. They are widely used in scenarios such as access control, log auditing, and security alerting.

[0003] However, with the increasing incidence of complex risk behaviors such as high-privilege account abuse, coordinated attacks, and permission-drifting exports, traditional single-point rule-based behavior recognition strategies have gradually exposed their significant deficiencies in expressiveness, contextual awareness, and adaptability to dynamic evolution. On the one hand, modern operational behaviors often exist in a sequential form, with complex temporal dependencies and semantic linkage structures between multiple operations, making it difficult for a single rule to capture their overall intent. On the other hand, behavioral patterns such as multi-account collaboration, permission transfer, and role switching typically lack explicit features, making reliance on rule matching prone to misjudgments and omissions. Furthermore, the cost of continuously maintaining and updating the rule system is high, making it difficult to cover the new risk chains that constantly emerge as system behavior evolves.

[0004] In recent years, deep learning methods such as neural networks have demonstrated powerful semantic modeling and feature extraction capabilities in natural language processing, graph structure modeling, and behavior recognition, and have gradually been applied to anomaly detection and behavior recognition tasks in the security field. By uniformly vectorizing operation sequences, permission change trajectories, and data access paths, and building behavioral intent models, it is possible to better identify potential risky behavior chains from a global perspective, especially those high-level behavioral synergy structures that are difficult to capture by rule-based systems. However, most existing technical solutions still focus on single-user modeling or rely on precise user attribution identification, lacking the ability to systematically identify cross-account, multi-path combined behaviors. Summary of the Invention

[0005] In order to be able to express each operation behavior in a structured manner, reconstruct the potential behavior chain through combination strategies, and use deep models to identify high-risk behavior paths hidden in data noise, this application provides a user operation risk dynamic monitoring method, device and medium based on data lineage.

[0006] In the first aspect, the present application provides a method for dynamically monitoring user operation risks based on data lineage, which adopts the following technical solutions:

[0007] A method for dynamically monitoring user operation risks based on data lineage includes the following steps:

[0008] S1. Acquire all user operations in real time and extract a continuous segment of each user's operations into a set of semantically related behavior segments. This semantic relevance is determined based on the path position relationship of each operation in a pre-built data lineage graph, the target node risk level, and the presence of path features that bypass key nodes. Each behavior segment corresponds to a series of operations performed by a user over a continuous period of time to achieve a specific goal.

[0009] S2. Each user's consecutive behavior segments are matched against a preset behavior template to reduce dimensionality and obtain multiple intermediate behavior blocks. The behavior template is an embedded vector representation trained based on historical normal operation behavior and is updated for newly acquired behavior segments through similarity matching or incremental learning.

[0010] S3. In chronological order, a predetermined number of intermediate behavior blocks are extracted from the plurality of intermediate behavior blocks, and are combined to generate a sequence of behavior fragments;

[0011] S4. Input the behavior fragment sequences into the pre-trained neural network model respectively to obtain the risk classification results or risk probability distribution results corresponding to each behavior fragment sequence, wherein the input vector dimension of the pre-trained neural network model is equal to the predetermined number.

[0012] Optionally, the data lineage graph is constructed as a graph structure based on the access nodes, data table relationships, data processing tasks and inter-system dependencies recorded in the operation log, wherein each node of the data lineage graph represents a data object, system module or operation behavior node, and each edge of the data lineage graph represents the flow direction, dependency or permission inheritance path of the data.

[0013] Optionally, the step of generating the behavior template includes:

[0014] S201. Collecting raw operation data including timestamp, user ID, operation type, and operation content from the operation logs of normal operation behaviors of multiple users, and sorting the raw operation data according to user dimension and time sequence to form an operation behavior sequence, wherein the operation content includes SQL statements or permission change instructions;

[0015] S202. Based on a sliding window strategy or event interval conditions, each user's operation behavior sequence is divided into multiple continuous operation behavior segments, wherein the behavior segments correspond to multiple operation records with semantic relevance performed by the user within a period of time;

[0016] S203. Extract semantic features from each operation in the behavior fragment, and combine the operation semantic features, permission change features, and corresponding data access path features in the data lineage map to represent each behavior fragment, converting each behavior fragment into a set of fixed-dimensional behavior fragment vector representations;

[0017] S204. Clustering all behavior segment vectors based on a preset clustering algorithm to divide semantically similar behavior segments into the same cluster;

[0018] S205. Based on the segment vectors in each cluster, calculate the cluster center vector of the cluster, use the cluster center vector as the behavior template vector corresponding to the cluster, and select representative behavior segments from the cluster as typical instances of the behavior template.

[0019] Optionally, S1 includes the following sub-steps:

[0020] S101. Extracting the access path corresponding to the target data node involved in the current operation behavior segment from the pre-built data lineage graph, searching for a graph node identified as an approval node in the access path to determine whether the path passes through the approval node;

[0021] S102. In the access path, determine whether there is a path jump or a key path missing between the data source node and the target data node. If the path does not include any of the data entry node, the front-end access node, or the audit intermediate node, mark the path as a broken link path;

[0022] S103. Parse the permission change instruction in the behavior fragment. If there is a permission granting statement in the behavior fragment, extract the user ID of the authorized object and compare it with the user ID of the user; if the authorized object and the user are the same, mark the behavior as self-authorization;

[0023] S104. Based on the accessed data target node, its risk level information is read from the data lineage map to obtain a floating-point risk characteristic value. The risk level is scored based on the node's sensitive field ratio, outbound link participation, export frequency, and access account level. The scoring result is used as the floating-point risk characteristic value in the behavior segment vector.

[0024] S105. Encode the passing result of the approval node, the determination result of the broken link path, the determination result of the self-authorization, the access path length, and the floating-point risk feature value in a structured manner into a multidimensional path structure feature vector, and splice the multidimensional path structure feature vector with the operation semantic feature and the permission behavior feature to form a behavior fragment vector.

[0025] Optionally, S3 includes the following steps:

[0026] S301. Sort the intermediate action blocks according to the time sequence of the intermediate action blocks matched by the actual operation action;

[0027] S302. Set a predetermined number, extract a predetermined number of intermediate behavior blocks from the sequence of intermediate behavior blocks and combine them into a behavior fragment sequence, wherein the intermediate behavior blocks in the behavior fragment sequence are arranged in chronological order, and the number of behavior fragments is the number of combinations of the intermediate behavior block sequence combined according to the predetermined number.

[0028] Optionally, for a risky operation type of a single user, the step of forming a training sample of the pre-trained neural network model includes:

[0029] S401 extracts the operation behavior sequence generated by multiple users in the actual operation process from the historical operation log, and segments and matches the operation behavior sequence based on the behavior recognition module to obtain multiple behavior fragment sequences belonging to the operation subject;

[0030] S402. Based on known audit records, external security incident reports or rule engine judgment results, the behavior segment sequence is labeled with risk labels, wherein the labels include normal behavior, high-risk behavior and suspicious behavior;

[0031] S403. Convert each labeled behavior segment sequence sample into an input structure acceptable to the neural network.

[0032] Optionally, the step S401 includes the following steps:

[0033] S4011. For a user's continuous operational sequence, identify a complex behavioral chain interspersed with normal and risky behavioral blocks. Normal behavioral blocks are daily operational behaviors, including high-frequency queries, low-sensitivity field access, and login and logout. Risky behavioral blocks are high-risk behaviors, including high-sensitivity data access, export operations, and permission changes.

[0034] S4012. Performing operation frequency perturbation processing on the composite behavior chain, including adjusting operation intervals, inserting daily behavior blocks, and rearranging the order of some non-core blocks, to construct multiple training samples in which the risk target behavior is weakened and disguised, so as to improve the model's ability to identify obfuscated risk behaviors;

[0035] S4013. While generating training samples, label the key behavior blocks and their combination dependencies that constitute the risk intention in the behavior chain to form attention guidance labels or supervision structures to assist the neural network model in identifying the combined force relationship of multi-step behaviors.

[0036] Optionally, for risky operations involving multiple users, the step of forming training samples for the pre-trained neural network model includes:

[0037] S411. Based on known audit records, external security incident reports, or rule engine judgment results, determine a time window containing at least one risk event and determine at least two suspect user accounts associated with the risk event;

[0038] S412. Obtain all intermediate behavior blocks generated by all user operation behaviors within the time window to form a global behavior block set;

[0039] S413. According to the combination method in step S3, multiple candidate behavior segment sequences are generated from the global behavior block set;

[0040] S414. Label the multiple candidate behavior segment sequences, wherein the candidate behavior segment sequences that simultaneously contain the intermediate behavior blocks corresponding to the at least two suspicious user accounts are labeled as high-risk samples, and the remaining candidate behavior segment sequences are labeled as normal samples;

[0041] S415. Convert each labeled behavior segment sequence sample into an input structure acceptable to the neural network.

[0042] In a second aspect, the present application provides a computer device that adopts the following technical solution:

[0043] A computer device comprising:

[0044] one or more processors;

[0045] Memory;

[0046] one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, the one or more applications configured to:

[0047] Execute the above-mentioned method for dynamic monitoring of user operation risks based on data lineage.

[0048] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0049] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute the above method.

[0050] The storage medium stores at least one instruction, at least one program, a code set, or an instruction set, and the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement:

[0051] Such as the above-mentioned method for dynamic monitoring of user operation risks based on data lineage.

[0052] In summary, this application includes at least one of the following beneficial technical effects:

[0053] 1. The operational behavior modeling method provided in this application, based on data lineage graphs and behavioral structure vectorization, can uniformly abstract and semantically normalize a large number of operational behaviors generated by multiple users in an asynchronous environment. By constructing behavioral fragments, extracting operational semantic features, permission behavior features, and path structure features, and further mapping them into intermediate behavioral blocks, it significantly improves the structured processing capabilities of complex operational behaviors, effectively solving the problem that traditional methods have difficulty in expressing cross-behavior and cross-path semantic linkages.

[0054] 2. This application adopts a global combination strategy of intermediate behavior blocks, which does not rely on operation attribution or account identity recognition. It forms a sequence of potentially related behavior fragments by traversing and combining the operation behavior blocks of different users, and cooperates with the pre-trained neural network model for risk identification. This method breaks through the limitation of modeling based on the user main line, and has a strong ability to reconstruct cross-account risk behaviors. It is particularly suitable for identifying hidden coordinated attack scenarios such as permission drift, self-authorization, and role holding. It realizes automatic identification and evaluation of high-level risk behaviors without the need for preset rules, significantly improving the system's perception of complex behavior chains and its ability to control missed reports. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A flowchart of a method for dynamically monitoring user operation risks based on data lineage according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0056] The present application will be further described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0057] In the following description, for the purpose of explanation, many specific details are set forth in order to provide a thorough understanding of the inventive concepts. Some of the figures in the drawings of the present disclosure, which are part of this specification, represent structures and devices in block diagram form to avoid making the disclosed principles complicated and obscure. For the sake of clarity, not all features of an actual implementation are necessarily described. In addition, the language used in this disclosure has been selected primarily for readability and instructional purposes and may not have been selected to delineate or limit the subject matter of the invention, thereby resorting to the necessary claims to determine such inventive subject matter. References in this disclosure to "one embodiment" or "an embodiment" mean that the specific features, structures or characteristics described in conjunction with that embodiment are included in at least one embodiment, and multiple references to "one embodiment" or "an embodiment" should not be understood to necessarily all refer to the same embodiment.

[0058] Unless expressly limited, the terms "a", "an" and "the" are not intended to refer to a singular entity, but rather to include a general class of which a specific example may be used for illustration. Thus, the use of the term "a" or "an" may mean any number of at least one, including "one", "one or more", "at least one", and "one or more than one". The term "or" means any of the alternatives and any combination of the alternatives, including all, unless the alternatives are expressly indicated to be mutually exclusive. The phrase "at least one of" when combined with a list of items refers to a single item in the list or any combination of the items in the list. The phrase does not require all of the listed items unless expressly limited to that.

[0059] In the existing technology, traditional threshold judgment or conditional rule judgment methods are widely used in data risk control and behavioral audit scenarios because of their clear logic and strong explainability. This type of method usually makes judgments based on manually set rule statements. For example: if the path does not contain an approval node, it is a broken link; if the access occurs in the early morning hours and the number of requests exceeds 100,000, it is a high risk. This type of method can achieve rapid online deployment without relying on the model training process. In addition, traditional rule judgment has a good effect in dealing with clear-boundary problems, and can efficiently identify risk scenarios with simple structure and direct logic, such as whether a field exceeds the access frequency threshold.

[0060] However, these traditional rule-based judgment methods present significant limitations in actual business expansion, particularly in handling nonlinear risks arising from complex combinations of behavioral characteristics. For example, if a user frequently logs in at night and uses unusual fields to search multiple business tables, even though individual behaviors may not trigger pre-set rules, their combined behaviors as a whole possess abnormal characteristics. This combined risk exceeds the expressive capabilities of traditional rule systems. Furthermore, rule systems are expensive to maintain during expansion. As system access scenarios and attack methods evolve, new rules must be continuously added, leading to a bloated rule system and increased maintenance difficulties. Rule conflicts can even lead to inconsistent risk assessment results. Furthermore, rule setting relies on a deep understanding of internal business operations and accumulated prior knowledge. Rule-setting strategies can deviate due to differences in designer experience, creating the risk of being "too narrow or too broad."

[0061] In order to overcome the limitations of traditional rule-based methods in expressing nonlinear behavior combinations, responding to behavior evolution trends, and identifying unknown risks, the present invention further introduces an operational behavior evaluation model based on a neural network, and models and judges the behavior sequences of multiple users through a unified vector encoding method. The neural network model does not need to predefine specific rule conditions, but can automatically learn potential high-risk behavior combination patterns in large-scale behavior logs, thereby effectively identifying the complex logical chains and nonlinear causal relationships implicit in operational behaviors. Compared with the traditional method that relies on explicit logical expression, the neural network model adopted by the present invention can automatically capture high-dimensional interaction features such as data access time, operation path, access method, data volume and semantic context, and train a representation space with risk-pointing capabilities based on existing samples, thereby supporting direct evaluation of behavior combinations.

[0062] Furthermore, the neural network model is capable of processing contextual information about behavioral sequences and behavioral evolution trends. Based on a user's historical behavior trajectory, it can capture the evolutionary correlations between previous and subsequent behaviors, thereby identifying sudden changes in behavioral style or unusual shifts in behavioral paths within a short period of time. The model can adaptively learn from behavioral evolutionary processes when behavioral distribution deviates from historical statistical patterns, when operation frequency or access paths change, significantly improving the time sensitivity and continuity modeling capabilities of risky behavior identification.

[0063] Furthermore, the neural network model has the ability to generalize for unknown risk types. When a combination of operational behaviors not yet covered by the rule system emerges, such as a new account accessing a new table field or an old account performing an unconventional data query during an unusual time period, the model can extract features from existing risk behaviors and generalize them spatially, generating reasonable risk assessments for these behaviors even without explicitly matching existing rules. This capability gives the system a strong sense and early warning capability for new attack methods, sudden violations, and multi-account collaboration chains, effectively addressing the problem of delayed response in traditional systems in unpredictable risk situations.

[0064] Therefore, in actual deployment, a hybrid architecture can be adopted, which can be implemented by combining rule-based judgment, neural network models and manual review. The architecture is generally divided into three layers:

[0065] At the first level, the system prioritizes a rule-based rapid judgment mechanism, filtering out common risk events with obvious triggering conditions in real time to achieve low-latency early warning responses. This layer uses logical matching of explicit features such as access paths, time, and frequency to quickly identify typical violations, such as accessing unauthorized fields or extracting data that bypasses approval nodes, ensuring the system's ability to generate immediate alerts.

[0066] At the second layer, a neural network-based operational behavior scoring model is introduced to capture the complex and complex patterns hidden in user behavior. This model is capable of learning nonlinear dependencies within behavioral sequences, cross-account collaboration structures, and behavioral evolution trends. This outputs more accurate risk scoring results, identifying high-dimensional, cross-risk scenarios that are difficult for rule-based systems to cover, significantly improving the system's ability to perceive complex risks.

[0067] At the third layer, the system submits the model's output of high-risk behavior to a manual review module as part of the final decision-making process. This layer supports context restoration and manual tracing of suspected violations, improving the interpretability and audit compliance of high-risk determinations. This manual review process further reduces false positives and enhances the model's operability.

[0068] In this application, we mainly discuss the operation behavior scoring model based on neural network. For details, refer to Figure 1 , an embodiment of the present application discloses a method for dynamically monitoring user operation risks based on data lineage, including the following steps S1-S4.

[0069] S1. Obtain the operation behaviors of all users in real time, and extract a continuous operation behavior of each user into a group of behavior fragments with semantic relevance, wherein the semantic relevance is determined based on the path position relationship of each operation behavior in the pre-constructed data lineage graph, the target node risk level, and whether there are path features that bypass key nodes. Each of the behavior fragments corresponds to a series of operation behaviors performed by the user in a continuous time period to achieve a certain purpose; the data lineage graph is constructed as a graph structure based on the access nodes, data table relationships, data processing tasks, and inter-system dependencies recorded in the operation log, wherein each node of the data lineage graph represents a data object, system module or operation behavior node, and each edge of the data lineage graph represents the flow direction, dependency or permission inheritance path of the data.

[0070] Each node in the data lineage graph represents an atomic data processing component, including a data object (such as a table, field, or file), a system module (such as a front-end system, data export module, or logging system), a processing task (such as a scheduled processing task or an interface call task), a user identity (such as an operator account or role instance), or an operational event itself (such as an export action or a JOIN operation). A node typically contains multiple structural attribute fields, such as data type, system, sensitivity level, and source label.

[0071] Edges are defined to connect any two nodes, indicating a logical relationship of access, transfer, dependency, derivation, or permission inheritance. In practice, edges are directed from upstream nodes to downstream nodes, indicating the direction of data flow or control transmission. For example, if a data table, table_x, is generated by a scheduled task, task_a, the system creates a directed edge in the graph from task_a to table_x, with the edge attribute labeled "processing" or "derivation." For another example, if user U1 exports the field salary, the graph can construct a path sequence: "User U1 → Export Operation → Field Salary."

[0072] In particular, when constructing a data lineage graph, this application supports incorporating access paths from unstructured or non-local databases into a unified mapping system. Even if the target data does not belong to the core database system controlled by the system, such as an external database accessed through a JDBC connection, an unstructured data file read via SFTP, or a cloud platform data object accessed through an API interface, the system can dynamically generate corresponding graph nodes and edge structures based on the access events recorded in the access log. The system uses the IP address, connection protocol, data source type and other metadata captured when the access occurs as node attributes, and maps the access behavior to the edge relationship between "user node → external source node", thereby constructing a complete access path structure. For example, a user accesses the report_view table in an Oracle database through the ODBC protocol. Although the table is not registered in the system metadata, the system can still generate the node Oracle_IP_1 based on the connection information. The node attributes include protocol = ODBC, address, business label, etc., and generate a connection path.

[0073] Similarly, field-level access is also modeled separately in the graph. Field nodes are derived from table structure information, but if certain highly sensitive fields, such as ID number, mobile phone number, salary, etc., are hit during access behavior, the system will separately mount these field nodes to the corresponding access path in the lineage graph and record dynamic attributes such as access frequency, sensitive labels, and the number of times exported. In this way, even if a behavior segment only accesses multiple fields separately, its risk level can be analyzed through path aggregation in the graph. Furthermore, user behavior nodes can also be included in the graph. For example, user U1 accessing table T1 can be expressed as the path of "U1 → SELECT → T1", while user U2 using the export module to access the same field path is "U2 → EXPORT → T1.salary".

[0074] In addition, the graph also models the operational behavior itself. In particular, when there are operational events such as permission changes, data exports, field updates, and log writebacks, the system will model these operations as "intermediate behavior nodes," such as constructing the "U3 → GRANT → export_role" or "task_B → UPDATE → T2.amount" path to capture control points in the operation chain that may constitute a risk logic loop.

[0075] In this embodiment, user operations refer to direct interactions with data resources, system permissions, or functional modules within the information system. Because users may include irrelevant or erroneous input during input, it is necessary to segment and extract these operations to obtain semantically relevant segments. These include, but are not limited to, the following types of system operation log entries:

[0076] For example:

[0077] User U1 executes the SQL statement "SELECT * FROM credit_scores WHERE credit>800" at 10:01:25;

[0078] User U2 requested to export the file "monthly_client_list.xlsx" through the web front-end at 10:03:12;

[0079] User U3 submitted the permission modification instruction "GRANT export_role TO U3" to the database management system at 10:06:47;

[0080] User U1 uploaded the data table "raw_client_2023Q3" through the SFTP interface at 10:07:55.

[0081] Each of the above records represents a user operation, and contains metadata such as the clear user identity, operation timestamp, operation target (field / table / module), operation type (query, authorization, export, etc.), and operation path (such as HTTP, SQL, RPC, etc.).

[0082] Then, in step S1, a continuous operation behavior of each user is extracted into a group of semantically related behavior fragments. In this application, a behavior fragment refers to a series of semantically related original operation behaviors performed by a user in a continuous time period to achieve a potential operation purpose, which usually includes multiple structurally independent but semantically collaborative low-level operations, such as multiple SQL statements, data operation commands or system access requests. It should be noted that it may contain some irrelevant input or erroneous input, or interference input deliberately entered by the user.

[0083] For example, user U5 performed the following sequence of operations between 11:05 and 11:08:

[0084] At 11:05:03, execute the SQL: SELECT user_id, name, phone FROM client_info WHEREregion = 'East China'

[0085] At 11:05:17, execute SQL: SELECT order_id, user_id FROM order_info WHEREorder_date>= '2024-01-01'

[0086] At 11:05:35, execute SQL: JOIN client_info.user_id = order_info.user_id (implicitly uses a subquery or nested JOIN in the query)

[0087] At 11:06:10, execute the file export command: EXPORT TO / tmp / export_202401_clients.xlsx

[0088] This sequence of operations constitutes a complete behavioral segment, whose underlying goal is to construct the relationship between customers and orders through a joint query and export the results. Although each operation statement is syntactically independent and does not include permission modifications or table structure operations, from a semantic perspective:

[0089] The query target field has an obvious intersection (user_id);

[0090] There is a business entity linkage relationship between query tables (customers and orders);

[0091] The query path has a connected path in the data lineage graph;

[0092] The operation behavior is highly continuous in time, and forms a closed loop of query → merge → export in terms of behavior.

[0093] Therefore, the above four operations can be divided into a behavior segment. This segment is used for semantic matching and behavior template classification in the subsequent S2 step, and at the same time enters the neural network sequence input process as the original operation context.

[0094] For another example, user U6 performs the following sequence of operations from 15:00 to 15:02:

[0095] At 15:00:02, execute SQL: SELECT employee_id, salary FROM hr_salary WHERElevel = 'S4'

[0096] At 15:00:45, execute the SQL: SELECT * FROM hr_salary WHERE department = 'Audit Department'

[0097] At 15:01:30, execute the query export command: EXPORT TABLE hr_salary TO xls

[0098] At 15:02:10, execute the system command: zip hr_salary_export.xls&&send_to remote_host

[0099] The intention of the above sequence is to batch export employee salary information of specific sensitive departments. Although the user does not have modification permissions or bypass the control system, his actions are concentrated on highly sensitive fields, resulting in high-risk output behavior.

[0100] Specifically, in order to improve the system's ability to express potential risk behavior chains and the discrimination accuracy of subsequent identification models, S1 includes the following sub-steps S101-S105 to extract structured features of the data access path and permission change behavior involved in each behavior fragment, and embed the path structure features into the behavior fragment vector in the form of a multi-dimensional vector, thereby achieving effective distinction between normal paths and circumvention paths, and between compliant authorization and disguised authorization.

[0101] S101. Extract the access path corresponding to the target data node involved in the current operation behavior segment from the pre-built data lineage graph, and search whether there is a graph node marked as an approval node in the access path to determine whether the path passes through the approval node.

[0102] The system first traces the path in the pre-built data lineage graph based on the target data nodes pointed to by each operation in the behavior fragment, and extracts the complete access path from the data source node (such as the data collection node, the original business database) to the current target node (such as the business table, the sensitive table, the export module). In this path, the system checks whether there is an approval node. The approval node is a specially set control node in the graph, used to represent, for example, manual approval processes, automatic policy review modules, or permission confirmation links. If such a node is missing in the path, it means that the behavior has not gone through the necessary approval links on the path, and there is a risk of process bypassing. For example, if a behavior fragment only contains direct query operations on the data table, and there is no connection node with the approval system, it means that the query may not have triggered prior approval and is a broken review path in the graph structure.

[0103] S102. In the access path, determine whether there is a path jump or a key path missing from the data source node to the target data node. If the path does not contain any of the data entry node, the front-end access node or the audit intermediate node, the path is marked as a broken link path.

[0104] This step further determines whether there is a broken link in the access path, that is, whether the access path skips the data control nodes that should exist, such as the front-end interface node, the data collection entry node, the log recording relay node, etc. In the data lineage map, these nodes are used to reflect the key boundary control and recording mechanisms in the system. Their absence may mean that the operation occurs in an unregulated backdoor channel or bypasses the expected access path. For example, if the path structure shows that the sensitive data table is directly accessed by the analysis module and does not pass through the API gateway node or the log system node, the system will mark the path as a broken link path to prompt the model that this behavior lacks the necessary security encapsulation.

[0105] S103. Parse the permission change instruction in the behavior segment. If there is a permission granting statement in the behavior segment, extract the user ID of the authorized object and compare it with the user ID of the user; if the authorized object and the user are the same, mark the behavior as self-authorization.

[0106] The system semantically analyzes permission-changing operations within the action fragment to identify the presence of authorization statements, particularly those granting roles or access rights. If an authorization statement exists, the system extracts the authorized object from the instruction and compares it with the identity of the user currently executing the action. If the two match, the user authorized themselves, often used to circumvent external approval controls or time window restrictions. Such behavior is considered high-risk in audit scenarios and is specifically marked as "self-authorization."

[0107] S104. Based on the data target node being accessed, its risk level information is read in the data lineage map to obtain a floating-point risk characteristic value, wherein the risk level is scored according to the node's sensitive field ratio, outbound link participation, export frequency, and access account level, and the scoring result is used as a floating-point risk characteristic value in the behavior fragment vector.

[0108] Step S104 further combines the risk scores of each data node in the data lineage graph to quantitatively label the risks of the target nodes involved in the behavior fragment. Each data node in the graph has a preset risk level, which can be calculated and normalized based on multiple dimensions such as the proportion of sensitive fields contained in the node, the number of times it has been exported, the connection with the external system, and the access account permission level. In this way, the structural sensitivity information of the node is passed to the behavior fragment level, providing a stable label input basis for the neural network model. For example, in a certain behavior fragment, the customer_info table is accessed. The system detects that the table contains multiple PII fields, has a high frequency of outbound transmission, and has appeared in audit alerts many times before. Its risk score may be as high as 0.92; another behavior fragment may access the log archive table, which has a lower field sensitivity and a score of 0.15.

[0109] S105. Encode the passing result of the approval node, the determination result of the broken link path, the determination result of the self-authorization, the access path length, and the floating-point risk feature value in a structured manner into a multidimensional path structure feature vector, and splice the multidimensional path structure feature vector with the operation semantic feature and the permission behavior feature to form a behavior fragment vector.

[0110] The system encodes the path structure features of the above multiple dimensions, namely the existence of the approval path, whether the path is broken, the self-authorization flag, the length of the access path, the target node risk score, etc., into a structured vector, and splices it with other fields such as the semantic features of the operation behavior itself and the permission features to form a multi-dimensional vector representation corresponding to the behavior fragment. Operational semantic features refer to the abstract attributes used to express the operation content itself at the semantic level, such as the encoding of the operation type, the complexity of the SQL statement structure, and the sensitivity characteristics of the operation target. The permission behavior feature is used to reflect whether there are sensitive operations related to permissions in the behavior fragment, including the following:

[0111] Whether it contains authorization statements, such as GRANT and REVOKE, and whether the operation type matches the target object;

[0112] Are there any signs of role switching, user switching, or executing sensitive tasks through jumps?

[0113] Whether there is permission drift, for example, account A first uses authorization, and account B subsequently performs the export;

[0114] Whether there are behavioral patterns such as concentrated occurrence or abnormally frequent revocation of permission changes.

[0115] S2. Each user's consecutive behavior segments are matched with a preset behavior template to reduce the dimensionality and obtain multiple intermediate behavior blocks. The behavior template is an embedded vector representation trained based on historical normal operating behaviors and is updated for newly acquired behavior segments through similarity matching or incremental learning.

[0116] Intermediate action blocks are unified representation units formed by clustering and categorizing action segments based on their semantic, permission, and path structure characteristics according to behavioral intent. Each intermediate action block reflects a typical sequence of actions performed by a user to achieve a specific goal or perform a task. It possesses semantic independence, structural integrity, and goal orientation. Essentially, it is an abstract representation of action patterns, used to represent high-frequency behavior types such as data export, account authorization, sensitive queries, role switching, and daily browsing.

[0117] For example, a user continuously performs the following actions within one operation period:

[0118] Query fields name, mobile, email;

[0119] Query table order_base;

[0120] Use JOIN to join the customer table with the order table;

[0121] Export the query results to an Excel file through the web interface.

[0122] At the behavioral segment level, this sequence of operations is considered a clearly goal-oriented data output behavior. However, its operational granularity remains fragmented, making it difficult to directly input into the model for identification. In step S2, the system uses the semantic features (query + export), path structure features (hit sensitive table + path break), permission features (no approval record), and risk score extracted from this behavioral segment as input. By calculating vector similarity with the behavioral template, the system determines that the most similar behavioral intent is "structured export behavior," and thus uniformly classifies it as an intermediate behavioral block "ExportBlock."

[0123] To achieve the above mapping relationship, the system must first establish a set of preset behavior templates. Each behavior template is a vector expression of a typical operation intention in the semantic space. The template generation process is based on a large number of historical normal user operation log samples. The behavior fragments are intercepted through a sliding window strategy, and the structured features are extracted and then clustered for analysis. Using methods such as HDBSCAN, KMeans, or Transformer autoencoder, fragments with similar feature expressions are aggregated into behavior intention clusters. The central vector of each cluster forms the embedded expression of the behavior template, representing the standard features of a certain type of behavior block. The behavior template library can be expanded and updated through a continuous learning mechanism to adapt to business changes and system expansion.

[0124] During the actual matching process, the user's behavior fragment, once structured, is input into the system as a matching vector. Similarity calculations (such as cosine similarity and Euclidean distance) are performed against each template vector in the behavior template set. The closest template is selected as the category and labeled as the corresponding intermediate behavior block. If the matching score falls below a set threshold, the system can employ an incremental learning mechanism to temporarily store the behavior fragment as a candidate template, adding it to the template library as subsequent behaviors accumulate to form new categories.

[0125] For example, the following behavior templates already exist in the system:

[0126] ExportBlock: represents the behavior characterized by high-sensitivity field query and export;

[0127] GrantBlock: represents an action with permission granting as the main semantics;

[0128] BrowseBlock: represents behaviors mainly involving common field queries and low-sensitivity operations;

[0129] AuditBypassBlock: represents the behavior pattern of bypassing the approval node in the path and missing the export log.

[0130] If the current behavior fragment includes deep queries of multiple sensitive tables, permission jumps, and outbound actions, the system may determine that it belongs to a mixed mode of export-type behavior and abnormal chain-jumping behavior, and can choose whether to split the mapping into multiple intermediate behavior blocks or retain it as a composite behavior block based on the model structure.

[0131] By mapping raw behavioral fragments into intermediate behavioral blocks, the system achieves dimensionality reduction and compression of diverse operational behaviors in a high-dimensional semantic space. This not only standardizes the expression format of user intent but also provides unified semantic primitives for subsequent behavioral sequence construction and model input. This process significantly reduces the difficulty of generalizing the neural network model to learn abnormal behaviors, improves the ability and robustness of modeling complex behavioral synergies, and enables the model to ignore individual operational grammatical differences and focus on the macro-risk intent expressed by the behavioral combination.

[0132] Specifically, the steps of generating the behavior template include S201-S205.

[0133] S201. Collecting raw operation data including timestamp, user ID, operation type, and operation content from the operation logs of normal operation behaviors of multiple users, and sorting the raw operation data according to user dimension and time sequence to form an operation behavior sequence, wherein the operation content includes SQL statements or permission change instructions;

[0134] S202. Based on a sliding window strategy or event interval conditions, each user's operation behavior sequence is divided into multiple continuous operation behavior segments, wherein the behavior segments correspond to multiple operation records with semantic relevance performed by the user within a period of time;

[0135] S203. Extract semantic features from each operation in the behavior fragment, and combine the operation semantic features, permission change features, and corresponding data access path features in the data lineage map to represent each behavior fragment, converting each behavior fragment into a set of fixed-dimensional behavior fragment vector representations;

[0136] S204. Clustering all behavior segment vectors based on a preset clustering algorithm to divide semantically similar behavior segments into the same cluster;

[0137] S205. Based on the segment vectors in each cluster, calculate the cluster center vector of the cluster, use the cluster center vector as the behavior template vector corresponding to the cluster, and select representative behavior segments from the cluster as typical instances of the behavior template.

[0138] S3. Extract a predetermined number of intermediate behavior blocks from the plurality of intermediate behavior blocks in chronological order, and combine them to generate a behavior segment sequence.

[0139] Specifically, S3 includes the following steps S301-S302.

[0140] S301. Sort the intermediate behavior blocks according to the time sequence of the intermediate behavior blocks matched by the actual operation behavior.

[0141] In step S301, the system chronologically sorts the aforementioned marked intermediate behavior blocks according to the actual occurrence time of the operation behavior. Specifically, for each user (or the operating subject after attribution identification), the system collects all the intermediate behavior blocks matched by the user within a set time window (such as 15 minutes or 1 hour), and arranges them in ascending order according to the earliest original operation timestamp corresponding to each behavior block to form a behavior block time series. The purpose of this time sorting operation is to maintain the semantic continuity and context consistency of the behavior execution, so that the subsequent model can construct an interpretable sequence feature representation based on the behavior occurrence logic. For example, if a user first executes a role authorization (GrantBlock) within 30 minutes, then executes a highly sensitive data export (ExportBlock), and then revokes the permission (RevokeBlock), the system combines these three types of intermediate behavior blocks into a sequence in the time order of authorization, export, and revocation to restore its actual behavior path and intention process.

[0142] S302. Set a predetermined number, extract a predetermined number of intermediate behavior blocks from the sequence of intermediate behavior blocks and combine them into a behavior fragment sequence, wherein the intermediate behavior blocks in the behavior fragment sequence are arranged in chronological order, and the number of behavior fragments is the number of combinations of the set of intermediate behavior blocks combined according to the predetermined number.

[0143] After sorting the intermediate action blocks matched to all operational actions by timestamp in S301, this embodiment further introduces a global action combination strategy in S302. Through cross-agent permutation and extraction, a set of action fragment sequences covering all possible associations is constructed to serve as input samples for the deep neural network model. The core concept of this step is to not presuppose whether the operational actions belong to the same user agent, but to treat the intermediate action blocks as independent action units with potential semantic value, placing them uniformly under a global timeline, and capturing combinatorial sequences that may have behavioral causal relationships through a finite-length combinatorial traversal method.

[0144] Specifically, the system first extracts a set of intermediate behavior blocks from all user behavior segments collected within a certain time period, assuming the size of this set to be N. Without filtering user accounts or role identities, the system then performs a non-repeating ordered permutation operation using a fixed number K (e.g., 3, 4, or 6) of windows from this set. This means that a sequence of behavior segments is constructed by randomly extracting K intermediate behavior blocks, constrained by chronological order. For each combination of behavior blocks, only their original relative order on the timeline is retained, avoiding the introduction of time inversion or artificial sorting in the combination, thereby ensuring that the combined sequence has the possibility of real-world behavior occurring.

[0145] Taking N=500 and K=3 as an example, the system will perform C(500,3)×1 sequence construction processes on these 500 behavior blocks. Because each group of behavior blocks is arranged in ascending timestamp order, its arrangement is unique and the combination dimension is fixed, so it can be directly input into the neural network model for unified encoding and risk scoring.

[0146] For example, the following three intermediate behavior blocks are from different users:

[0147] Action Block 1: User A executes GRANT export_role TO userC at 10:01, forming a GrantBlock

[0148] Action block 2: User C executes SELECT * FROM salary_info at 10:03, forming ExportBlock

[0149] Action block 3: User A executes REVOKE export_role FROM userC at 10:05, forming RevokeBlock

[0150] During the combination process, this triple sequence may naturally collide with the global set of action blocks, forming a time-ordered action sequence: GrantBlock → ExportBlock → RevokeBlock when input into the model. Although these three blocks originate from different accounts, their operations involve a potential permission transfer and a semantically closed loop of export chains. The model may assign a high risk score to this sequence, identifying it as a typical cross-account permission drift-related data leakage behavior.

[0151] At the same time, this full permutation and combination strategy inevitably generates a large number of unrelated behavior sequences. For example, a sequence might be: ExportBlock → LoginBlock → BrowseBlock, where the operating accounts, target tables, and permission paths have no intersection. Such unrelated combinations are judged as non-risky behaviors during model training. Because the structural feature distribution of these sequences differs significantly from the characteristic patterns of real high-risk behavior chains and lacks continuity, path dependence, and permission linkage, the neural network model can automatically learn their feature sparsity and semantic discontinuity through training, thereby assigning them extremely low risk scores and automatically filtering out noise samples in the combination space.

[0152] Through this approach, the present invention can automatically identify potentially risky behavior chains with correlations and temporal relationships from large-scale, mixed user operations without relying on explicit attribution identification or manual rule compilation, significantly improving the system's ability to identify cross-account, cross-identity, and nonlinear risk patterns. During the training phase, this method enhances recognition accuracy through labeled sample expansion and a hard-case adversarial strategy. During the inference phase, it can combine policy thresholds to select high-risk score sequences for manual review or subsequent closed-loop modeling.

[0153] S4. Input the behavior fragment sequences into the pre-trained neural network model respectively to obtain the risk classification results or risk probability distribution results corresponding to each behavior fragment sequence, wherein the input vector dimension of the pre-trained neural network model is equal to the predetermined number.

[0154] The neural network model is a pre-trained structure, and its input is a fixed-length sequence of behavioral fragments. Each behavioral fragment consists of several intermediate behavioral blocks, and the intermediate behavioral blocks have been encoded as vectors of uniform dimension. Assuming the sequence length is K and the dimension of each behavioral block vector is D, the model input is a K×D-dimensional matrix, representing a time-ordered behavioral path. During the training phase, the system uses a large number of labeled historical behavioral sequence samples to supervise the model. The training goal is to enable the model to output the corresponding risk label for the input sequence, or to output the probability distribution vector of each type of risk under a multi-category classification structure. For example, for a sequence known to constitute a data permission drift chain, the label is a high-risk export. The model needs to be able to accurately mark the risk type and output a higher risk score.

[0155] This neural network model can adopt a structure that supports long-sequence modeling and the ability to capture multi-step behavioral dependencies. In specific implementations, Transformer, BiLSTM, or GNN structures with attention mechanisms can be selected. Taking the Transformer as an example, the system encodes the sequence of behavioral fragments and inputs them into a multi-head self-attention module. The system calculates the attention weights between different behavioral blocks, thereby identifying the semantic strength and causal relationship between each operation in the sequence. If a sequence contains authorization operations and sensitive query operations that are continuous in time but belong to different accounts, the model identifies this type of "distributed risk behavior" combination as a high-risk behavior with cross-account collaboration characteristics through the path risk characteristics and semantic alignment relationship between the behavioral blocks.

[0156] For example, the input sequence is: GrantBlock → ExportBlock → RevokeBlock, each executed by a different account. The model's structural analysis reveals that the authorization relationships are consistent, the interval between actions is less than 3 minutes, the access path risk scores are high, and the export actions involve sensitive fields. The model ultimately outputs this sequence as a high-risk action chain and assigns a risk score of 0.92. For another example, the sequence is: BrowseBlock → LoginBlock → ViewBlock, all of which are low-sensitivity queries with a complete path and no unusual chain jumps. The model outputs a low-risk label or a risk score of less than 0.1.

[0157] The model's output can be binary (e.g., normal / abnormal) or multi-category (e.g., derived risk, authorized risk, disguised risk), or continuous risk probability distributions, supporting flexible early warning strategies and response mechanisms. The system can trigger different processing flows based on the output, such as submitting high-risk sequence results for manual review or issuing real-time alerts to the audit system.

[0158] It should be pointed out that although the input behavioral fragment sequence may contain combined behaviors composed of unrelated accounts, due to the incoherent structural semantics and broken behavioral intentions of such combinations, the model can naturally learn their characteristic differences after sufficient training, and automatically assign low-risk scores to such invalid combinations during the reasoning process, thereby achieving the ability to efficiently screen out redundant paths brought by permutation combinations.

[0159] To support the effective training of the aforementioned pre-trained neural network model, this embodiment constructs a high-quality training sample set, enabling the model to fully learn the semantic structural differences and risk characteristics between different types of behavior combinations. The construction of training samples includes two strategies: constructing a continuous chain of behaviors within the same user's main line, and constructing a combination of potentially related behavior chains between different users. For a single user's risky operation type, the steps for generating training samples for the pre-trained neural network model include S401-S403.

[0160] S401. Extract operation behavior sequences generated by multiple users during actual operations from historical operation logs, and segment and match the operation behavior sequences based on a behavior recognition module to obtain multiple behavior segment sequences with attributed operation subjects.

[0161] Specifically, S401 includes the following steps S4011-S4013.

[0162] S4011. For the continuous operation behavior sequence of the same user, identify a composite behavior chain interspersed with normal behavior blocks and risky behavior blocks. The normal behavior blocks are daily operation behaviors, including high-frequency queries, low-sensitivity field access, login and logout, and the risky behavior blocks are high-risk behaviors, including high-sensitivity data access, export operations, and permission changes.

[0163] S4012. Perform operation frequency perturbation processing on the composite behavior chain, including adjusting the operation interval, inserting daily behavior blocks, and rearranging the order of some non-core blocks, to construct multiple training samples in which the risk target behaviors are weakened and disguised, so as to improve the model's ability to identify confusing risk behaviors.

[0164] S4013. While generating training samples, label the key behavior blocks and their combination dependencies that constitute the risk intention in the behavior chain to form attention guidance labels or supervision structures to assist the neural network model in identifying the combined force relationship of multi-step behaviors.

[0165] The first construction method is based on real user behavior threads. It selects multiple consecutive action segments performed by a single operator over a period of time and labels them with risk categories based on historical audit tags. This type of sample typically exhibits strong semantic consistency and temporal coherence, making it suitable for training models to identify typical, targeted, single-account risk behavior patterns, such as confusing query and export operations and rapid permission change chains. Its advantages lie in its clear structure and explicit intent, making it useful for training models' foundational semantic recognition capabilities.

[0166] S402. Based on known audit records, external security incident reports or rule engine judgment results, the behavior segment sequence is labeled with risk labels, wherein the labels include normal behavior, high-risk behavior and suspicious behavior.

[0167] S403. Convert each labeled behavior segment sequence sample into an input structure acceptable to the neural network.

[0168] For risky operation types of multiple users, the steps of forming training samples of the pre-trained neural network model include S411-S415.

[0169] S411. Based on known audit records, external security incident reports, or rule engine judgment results, determine a time window containing at least one risk event and determine at least two suspect user accounts associated with the risk event;

[0170] S412. Obtain all intermediate behavior blocks generated by all user operation behaviors within the time window to form a global behavior block set;

[0171] S413. According to the combination method in step S3, multiple candidate behavior segment sequences are generated from the global behavior block set;

[0172] S414. Label the multiple candidate behavior segment sequences, wherein the candidate behavior segment sequences that simultaneously contain the intermediate behavior blocks corresponding to the at least two suspected user accounts are labeled as high-risk samples, and the remaining candidate behavior segment sequences are labeled as normal samples.

[0173] S415. Convert each labeled behavior segment sequence sample into an input structure acceptable to the neural network.

[0174] Specifically, for the risk behavior chain of a single user, the system uses labeled historical audit logs to construct training samples with clear risk intentions, and can perform data enhancement processing such as operation frequency perturbations on the samples to improve the model's recognition of disguised or obfuscated risks. In addition, for multi-user collaborative risks that are more concealed, the system uses a weakly supervised learning method to determine suspected accounts and time windows based on known historical security incident reports, generate a large number of candidate sequences in the global behavior block set of the corresponding time window, and automatically label high-risk samples and normal samples based on whether the sequence contains the behavior of the suspected account at the same time. The final mixed data set is divided into training set, validation set and test set for subsequent model training, tuning and final evaluation.

[0175] Next, the model training and tuning phase begins. This phase begins by selecting a deep learning architecture suitable for the task, such as the Transformer or BiLSTM with attention, which excels at capturing long-range dependencies in sequential data. Training is performed iteratively in small batches. In each iteration, the model computes a loss function (such as cross-entropy loss) based on samples from the training set and calculates the gradient via backpropagation. The optimizer then updates the model's network weights based on the gradient while simultaneously tuning hyperparameters. The system uses a validation set to guide the tuning process and monitor key performance indicators. Hyperparameters, including the learning rate, batch size, number of network layers, and number of attention heads, are systematically explored and selected using methods such as grid search, random search, or the more efficient Bayesian optimization. A learning rate decay strategy is often introduced during training to dynamically adjust the learning rate to help the model converge to the optimal solution.

[0176] Finally, after determining the optimal hyperparameter combination, the system uses this combination to train the model on the complete training set. After training, the model's final performance is evaluated on a completely independent test set. The validated model's weight parameters are saved and ultimately deployed in the actual risk monitoring process to identify risks in real-time behavioral sequence sequences.

[0177] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0178] In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable by the processor. When the processor executes the computer program, the method for dynamically monitoring user operation risks based on data lineage described in the above embodiment is implemented. To avoid repetition, further details are omitted here.

[0179] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for dynamically monitoring user operation risks based on data lineage according to the above embodiment is implemented. To avoid repetition, it will not be described here.

[0180] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media used in the various embodiments of this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM).

[0181] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0182] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A method for dynamically monitoring user operation risks based on data lineage, characterized in that: The following steps are involved: S1. Acquire all user operations in real time and extract a continuous segment of each user's operations into a set of semantically related behavior segments. This semantic relevance is determined based on the path position relationship of each operation in a pre-built data lineage graph, the target node risk level, and the presence of path features that bypass key nodes. Each behavior segment corresponds to a series of operations performed by a user over a continuous period of time to achieve a specific goal. S2. Each user's consecutive behavior segments are matched against a preset behavior template to reduce dimensionality and obtain multiple intermediate behavior blocks. The behavior template is an embedded vector representation trained based on historical normal operation behavior and is updated for newly acquired behavior segments through similarity matching or incremental learning. S3. In chronological order, traversally extracting a predetermined number of intermediate behavior blocks from the plurality of intermediate behavior blocks, and combining them to generate a sequence of behavior fragments; S4. Inputting the behavior segment sequences into a pre-trained neural network model to obtain a risk classification result or a risk probability distribution result corresponding to each behavior segment sequence, wherein the input vector dimension of the pre-trained neural network model is equal to the predetermined number; The data lineage graph is constructed as a graph structure based on the access nodes, data table relationships, data processing tasks, and inter-system dependencies recorded in the operation log, wherein each node of the data lineage graph represents a data object, system module, or operation behavior node, and each edge of the data lineage graph represents the flow direction, dependency, or permission inheritance path of the data; The steps of generating the behavior template include: S201. Collecting raw operation data including timestamp, user ID, operation type, and operation content from the operation logs of normal operation behaviors of multiple users, and sorting the raw operation data according to user dimension and time sequence to form an operation behavior sequence, wherein the operation content includes SQL statements or permission change instructions; S202. Based on a sliding window strategy or event interval conditions, each user's operation behavior sequence is divided into multiple continuous operation behavior segments, wherein the behavior segments correspond to multiple operation records with semantic relevance performed by the user within a period of time; S203. Extract semantic features from each operation in the behavior fragment, and combine the operation semantic features, permission change features, and corresponding data access path features in the data lineage map to represent each behavior fragment, converting each behavior fragment into a set of fixed-dimensional behavior fragment vector representations; S204. Clustering all behavior segment vectors based on a preset clustering algorithm to divide semantically similar behavior segments into the same cluster; S205. Based on the segment vectors in each cluster, calculate the cluster center vector of the cluster, use the cluster center vector as the behavior template vector corresponding to the cluster, and select representative behavior segments from the cluster as typical instances of the behavior template.

2. The method for dynamically monitoring user operation risks based on data lineage according to claim 1 is characterized in that: The S1 comprises the following sub-steps: S101. Extracting the access path corresponding to the target data node involved in the current operation behavior segment from the pre-built data lineage graph, searching for a graph node identified as an approval node in the access path to determine whether the path passes through the approval node; S102. In the access path, determine whether there is a path jump or a key path missing between the data source node and the target data node. If the path does not include any of the data entry node, the front-end access node, or the audit intermediate node, mark the path as a broken link path; S103. Parsing the permission change instruction in the behavior fragment. If there is a permission granting statement in the behavior fragment, the user ID of the authorized object is extracted and compared with the user ID of the user; If the authorization object is the same as the user, the behavior is marked as self-authorization; S104. Based on the accessed data target node, its risk level information is read from the data lineage map to obtain a floating-point risk characteristic value. The risk level is scored based on the node's sensitive field ratio, outbound link participation, export frequency, and access account level. The scoring result is used as the floating-point risk characteristic value in the behavior segment vector. S105. Encode the passing result of the approval node, the determination result of the broken link path, the determination result of the self-authorization, the access path length, and the floating-point risk feature value in a structured manner into a multidimensional path structure feature vector, and splice the multidimensional path structure feature vector with the operation semantic feature and the permission behavior feature to form a behavior fragment vector.

3. The method for dynamically monitoring user operation risks based on data lineage according to claim 2 is characterized in that: The S3 includes the following steps: S301. Sort the intermediate action blocks according to the time sequence of the intermediate action blocks matched by the actual operation action; S302. Set a predetermined number, extract a predetermined number of intermediate behavior blocks from the sequence of intermediate behavior blocks and combine them into a behavior fragment sequence, wherein the intermediate behavior blocks in the behavior fragment sequence are arranged in chronological order, and the number of behavior fragments is the number of combinations of the intermediate behavior block sequence combined according to the predetermined number.

4. The method for dynamically monitoring user operation risks based on data lineage according to claim 3 is characterized in that: For a single user's risky operation type, the steps for forming the training sample of the pre-trained neural network model include: S401 extracts the operation behavior sequence generated by multiple users in the actual operation process from the historical operation log, and segments and matches the operation behavior sequence based on the behavior recognition module to obtain multiple behavior fragment sequences belonging to the operation subject; S402. Based on known audit records, external security incident reports or rule engine judgment results, the behavior segment sequence is labeled with risk labels, wherein the labels include normal behavior, high-risk behavior and suspicious behavior; S403. Convert each labeled behavior segment sequence sample into an input structure acceptable to the neural network.

5. The method for dynamically monitoring user operation risks based on data lineage according to claim 4 is characterized in that: The S401 includes the following steps: S4011. For a user's continuous operational sequence, identify a complex behavioral chain interspersed with normal and risky behavioral blocks. Normal behavioral blocks are daily operational behaviors, including high-frequency queries, low-sensitivity field access, and login and logout. Risky behavioral blocks are high-risk behaviors, including high-sensitivity data access, export operations, and permission changes. S4012. Performing operation frequency perturbation processing on the composite behavior chain, including adjusting operation intervals, inserting daily behavior blocks, and rearranging the order of some non-core blocks, to construct multiple training samples in which the risk target behavior is weakened and disguised, so as to improve the model's ability to identify obfuscated risk behaviors; S4013. While generating training samples, label the key behavior blocks and their combination dependencies that constitute the risk intention in the behavior chain to form attention guidance labels or supervision structures to assist the neural network model in identifying the combined force relationship of multi-step behaviors.

6. The method for dynamically monitoring user operation risks based on data lineage according to claim 3 is characterized in that: For risky operations involving multiple users, the steps for forming training samples for the pre-trained neural network model include: S411. Based on known audit records, external security incident reports, or rule engine judgment results, determine a time window containing at least one risk event and determine at least two suspect user accounts associated with the risk event; S412. Obtain all intermediate behavior blocks generated by all user operation behaviors within the time window to form a global behavior block set; S413. According to the combination method in step S3, multiple candidate behavior segment sequences are generated from the global behavior block set; S414. Label the multiple candidate behavior segment sequences, wherein the candidate behavior segment sequences that simultaneously contain the intermediate behavior blocks corresponding to the at least two suspicious user accounts are labeled as high-risk samples, and the remaining candidate behavior segment sequences are labeled as normal samples; S415. Convert each labeled behavior segment sequence sample into an input structure acceptable to the neural network.

7. A computer device, characterized in that: It includes: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to: execute the method for dynamic monitoring of user operation risks based on data lineage according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that The storage medium stores at least one instruction, at least one application program, a code set or an instruction set, and the at least one instruction, the at least one application program, the code set or the instruction set are loaded and executed by the processor to implement: the method for dynamic monitoring of user operation risks based on data lineage as described in any one of claims 1 to 6.

Images