User entity behavior anomaly analysis and processing method and device, equipment and medium

Abstract

The invention discloses a user entity behavior anomaly analysis and processing method and device, equipment and a medium, the method comprises the steps that a user access link is constructed based on user behavior data acquired from multiple sources, and the user behavior data comprises data acquired from a service log, a security log and network traffic; obtaining a sensitive information feature library and a sensitive information identification rule library which are obtained by performing traceability analysis on leakage events in the report case library; using the sensitive information identification rule base to convert the user access link into a multi-dimensional behavior portrait; calculating a corresponding behavior deviation degree based on the user access link and the multi-dimensional behavior portrait through an attention mechanism network model; and according to the behavior deviation degree and the sensitive information feature library, context-aware real-time filtering is carried out on data in transmission based on a multi-level sensitive factor dynamic filtering strategy. By monitoring the user behavior access link, the capability of responding to the abnormal behavior is improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence and behavioral data processing technology, and in particular to a method, device, equipment and medium for analyzing and processing abnormal behavior of user entities. Background Art

[0002] In recent years, management systems in various industries have been subject to certain data leakage risks, especially those caused by illegal operations by internal staff. Currently, financial institutions, for example, mainly use preset static rules and fixed thresholds to identify and filter abnormal user behavior. Although these methods can handle some common security issues, they have obvious limitations. They are difficult to adapt to new attacks and complex behavior patterns, cannot detect unknown threats in a timely manner, and cannot flexibly respond to behavioral differences and dynamic changes among different users. They are prone to misjudgments or missed judgments, making it difficult for management systems to effectively protect data security and user privacy in the face of increasingly complex network security threats. Summary of the Invention

[0003] The purpose of this application is to provide a method, device, equipment and medium for analyzing and processing abnormal user entity behavior, so as to at least solve the problem that the current monitoring system cannot accurately monitor and quickly respond to abnormal behavior.

[0004] To solve the above technical problems, this application provides a method for analyzing and processing abnormal user entity behavior, including: Building a user access link based on user behavior data collected from multiple sources, wherein the user behavior data includes data collected from business logs, security logs, and network traffic; Obtain a sensitive information feature database and a sensitive information identification rule database obtained through tracing and analyzing the leakage incidents in the reporting case database; Utilizing the sensitive information identification rule library, the user access link is converted into a multi-dimensional behavior profile; By using the attention mechanism network model, the corresponding behavior deviation is calculated based on the user access link and multi-dimensional behavior profile; According to the behavior deviation and the sensitive information feature library, context-aware real-time filtering is implemented on the data in transmission based on a multi-level sensitive factor dynamic filtering strategy.

[0005] Optionally, the step of constructing a user access link based on user behavior data collected from multiple sources includes: Extracting user static attributes and dynamic operation events from at least one of a business log, a security log, and network traffic; Constructing a heterogeneous graph including user nodes and resource nodes based on the user static attributes and dynamic operation events; wherein the static attributes serve as node features of the heterogeneous graph, and the dynamic operation events serve as edges with timestamps in the heterogeneous graph; The edges of the heterogeneous graph are traversed in time series to generate access paths with context information to build user access links.

[0006] Optionally, the calculation of the corresponding behavior deviation based on the user access link and multi-dimensional behavior profile using the attention mechanism network model includes: Divide the user access link into behavior segments according to the time window, and obtain the behavior profile corresponding to each behavior segment; Calculating the similarity between the behavior portrait corresponding to each behavior segment and the normal portrait through the attention mechanism network; generating a dynamic deviation curve based on the standard deviation of the similarity and the number of mutations; The behavior deviation is determined according to the dynamic deviation curve.

[0007] Optionally, the real-time filtering includes: When the behavior deviation exceeds a first threshold, desensitizing low-risk sensitive fields of the data being transmitted based on the sensitive information feature library; When the behavior deviation exceeds a second threshold, activating operation blocking for the matching sensitive data field; The level of the filtering strategy is dynamically increased or decreased according to the real-time rate of change of the behavior deviation.

[0008] Optionally, the real-time filtering further includes: Calculate a comprehensive risk value by weighting the behavior deviation score and the confidentiality level of the sensitive data field; When the comprehensive risk value reaches a third threshold, the user's current access link is blocked.

[0009] Optionally, after the real-time filtering, the method further includes: Statistically generate a heat map of the distribution of sensitive data fields whose operations are blocked; When the distribution heat map indicates that the same feature operation is repeatedly triggered, the level of the filtering strategy is automatically upgraded; Generates a correlation analysis report containing behavioral deviations and filtered records.

[0010] Optionally, the method further includes: Collecting interception records triggered in the real-time filtering and their corresponding behavioral deviations; Generate rule optimization parameters based on the distribution of sensitive fields and the mutation points of behavior deviation in the interception records; Synchronizing the optimization parameters to the sensitive information identification rule base through federated learning; The threshold value of the multi-level sensitive factor dynamic filtering strategy is dynamically adjusted based on the updated rule base.

[0011] To solve the above technical problems, the present application also provides a user entity behavior abnormality analysis and processing device, comprising: An access link module, configured to construct a user access link based on user behavior data collected from multiple sources, wherein the user behavior data includes data collected from business logs, security logs, and network traffic; The sensitive information module is used to obtain the sensitive information feature library and sensitive information identification rule library obtained by tracing the source of the leakage incidents in the reporting case library; A behavior profiling module, configured to convert the user access link into a multi-dimensional behavior profile using the sensitive information identification rule library; A deviation calculation module is used to calculate the corresponding behavior deviation based on the user access link and multi-dimensional behavior profile through an attention mechanism network model; The information filtering module is used to implement context-aware real-time filtering of the data in transmission based on the behavior deviation and the sensitive information feature library and a multi-level sensitive factor dynamic filtering strategy.

[0012] In order to solve the above technical problems, the present application also provides a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the above-mentioned user entity behavior abnormality analysis and processing method.

[0013] In order to solve the above technical problems, the present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the above-mentioned user entity behavior abnormality analysis and processing method.

[0014] The beneficial effects of the embodiments created by this application are: by constructing user access links, generating multi-dimensional behavioral portraits, calculating behavioral deviations, and implementing dynamic filtering, a complete set of user entity behavior anomaly analysis and processing methods are formed. This method can accurately capture the dynamic changes in user behavior and identify potential abnormal operations in real time. By calculating behavioral deviations through the attention mechanism network model and combining it with a multi-level sensitive factor dynamic filtering strategy, the system can flexibly adjust filtering measures according to the risk level and effectively block high-risk behaviors. In addition, the method also has self-evolutionary learning capabilities, can automatically update the rule base, adapt to the ever-changing threat environment, and improve the security and adaptability of the system. Overall, this proposal significantly enhances the ability of financial institutions to prevent internal illegal operations, ensures customer information security, reduces the risk of data leakage, and improves operational efficiency and compliance. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which: Figure 1 This is a basic flow chart of a method for analyzing and processing abnormal behavior of a user entity according to a specific embodiment of the present application; Figure 2 This is a schematic diagram of the basic structure of a device for analyzing and processing abnormal behavior of a user entity according to a specific embodiment of the present application; Figure 3 This is a basic structural block diagram of a computer device according to a specific embodiment of the present application. DETAILED DESCRIPTION

[0016] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and are not to be construed as limiting the present application.

[0017] Those skilled in the art will understand that, unless otherwise stated, the singular forms "a," "an," "said," and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of this application refers to the presence of the stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0018] Those skilled in the art will understand that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and, unless specifically defined as such, will not be interpreted in an idealized or overly formal sense.

[0019] Those skilled in the art will appreciate that the term "terminal" as used herein includes both devices that are wireless signal receivers, i.e., devices that only have wireless signal receivers without transmission capabilities, and devices that have receiving and transmitting hardware capable of performing two-way communication over a two-way communication link. Such devices may include: cellular or other communication devices with single-line displays, multi-line displays, or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service) devices that may combine voice, data processing, fax, and / or data communication capabilities; PDAs (Personal Digital Assistants) that may include a radio frequency receiver, a pager, Internet / Intranet access, a web browser, a notepad, a calendar, and / or a GPS (Global Positioning System) receiver; and conventional laptop and / or palmtop computers or other devices that have and / or include a radio frequency receiver. As used herein, a "terminal" can be portable, transportable, installed in a vehicle (air, sea, and / or land), or adapted and / or configured to operate locally and / or in a distributed manner at any other location on Earth and / or in space. A "terminal" as used herein can also refer to a communication terminal, an Internet access terminal, or a music / video playback terminal, such as a PDA, a mobile internet device (MID), and / or a mobile phone with music / video playback capabilities, as well as devices such as smart televisions and set-top boxes.

[0020] The hardware referred to by names such as "server", "client", and "service node" in this application is essentially an electronic device with capabilities equivalent to those of a personal computer. It is a hardware device that has the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. Computer programs are stored in its memory, and the central processing unit loads the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0021] It should be noted that the concept of "server" referred to in this application can also be extended to server clusters. Based on the network deployment principles understood by those skilled in the art, the servers described should be logically divided. In physical space, these servers can be independent of each other but callable through interfaces, or integrated into a single physical computer or a computer cluster. Those skilled in the art should understand this flexibility and should not use it to constrain the implementation of the network deployment method of this application.

[0022] Unless expressly specified, one or more technical features of the present application can be deployed on a server for implementation and accessed by a client through a remote call to obtain an online service interface provided by the server, or can be directly deployed and run on a client for implementation.

[0023] Unless explicitly specified, the AI ​​models referenced or may be referenced in this application can be deployed on a remote server and remotely called on the client, or can be deployed and directly called on a client with sufficient device capabilities. In some embodiments, when it runs on the client, its corresponding intelligence can be obtained through transfer learning to reduce the requirements for the client's hardware operating resources and avoid excessive occupation of the client's hardware operating resources.

[0024] Unless explicitly specified, the various data involved in this application can be stored remotely on a server or on a local terminal device, as long as they are suitable for being called by the technical solution of this application.

[0025] Those skilled in the art should be aware that although the various methods of this application are described based on the same concept and thus exhibit commonality, unless otherwise specified, these methods can be independently executed. Similarly, the various embodiments disclosed in this application are all based on the same inventive concept. Therefore, concepts with the same expression, as well as concepts that are appropriately transformed for convenience despite different expression, should be understood as equivalent.

[0026] Unless expressly stated to be mutually exclusive, the various embodiments disclosed in this application may be cross-combined with the relevant technical features of the various embodiments to flexibly construct new embodiments, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or resolve certain deficiencies in the prior art. Those skilled in the art should be aware of such flexibility.

[0027] See also Figure 1 , Figure 1 Schematic diagram of the basic flow of the method for analyzing and processing abnormal user entity behavior in this embodiment.

[0028] like Figure 1 Shown, including: S1100: Constructing a user access link based on user behavior data collected from multiple sources, wherein the user behavior data includes data collected from business logs, security logs, and network traffic; This embodiment is applicable to monitoring abnormal system behavior in various fields, including finance, e-commerce, insurance, education, healthcare, and law. In this embodiment, a monitoring system equipped with a basic model (such as a large language model) is configured to dynamically detect the behavior of various systems. First, a user access chain is constructed based on user behavior data collected from multiple sources. This user behavior data includes data collected from business logs, security logs, and network traffic. The monitoring system can deploy multiple data collection probes, each connected to different data sources, including business system logs, security audit logs, and network traffic monitoring devices, to achieve multi-source data collection. Specifically, business logs contain user operation records in various business systems, such as the time, object, and results of operations such as querying and modifying customer account information. Security logs primarily record key events such as user logins and permission changes, including login IP addresses, times, and success / failure status. Network traffic data is acquired through a mirrored port, and transport and application layer data packets are parsed to extract user-requested URLs and transmitted data content fragments. Furthermore, this embodiment also pre-processes the collected user behavior data. The pre-processing includes unified data format conversion, noise filtering, and preliminary timestamp alignment to ensure that data from different sources are consistent in the time dimension. At the same time, a distributed computing framework is used to integrate and process the data, and scattered data fragments from different sources are connected in series based on user identity to build a complete user access link. For example, using the operation and maintenance personnel's employee number as an identifier, their account query operations, security login records, and corresponding network request response data in the business system are spliced ​​in sequence to form an access link containing time series and operation details, providing an accurate data foundation for subsequent behavior analysis. The entire process is completed within a few minutes after data collection, ensuring real-time and accuracy.

[0029] S1200: Obtain a sensitive information feature database and a sensitive information identification rule database obtained by tracing and analyzing the leakage incidents in the reporting case database; After constructing a user access chain based on multi-source user behavior data, a sensitive information feature library and a sensitive information identification rule library are obtained through source analysis of leak incidents in the reported case library. Specifically, to build a precise sensitive information feature library and identification rule library, this embodiment collects and organizes past customer complaints, internal audit reports, and industry-shared customer information leak cases. These cases are then traced back in detail. Each case is traced back in detail, analyzing business logs, security logs, and network traffic data to extract operational behavior features related to information leaks, such as operation time, query fields, and IP addresses. Based on the traceability results, sensitive information features are extracted, including the involved customer data fields, operational behavior patterns, temporal features, and network features. Sensitive information identification rules are then formulated in conjunction with regulatory requirements and industry best practices. For example, a certain number of queries on sensitive fields during non-business hours could trigger an alert. The extracted features and rules are stored in a database in a structured data format, forming a sensitive information feature library and identification rule library, which are then updated regularly.

[0030] It should be noted that, to further optimize the sensitive information feature library and identification rule library, this embodiment annotates the data in the reporting case library to distinguish between normal and abnormal behavior. This annotated data is then trained using supervised learning algorithms (such as random forests) to automatically discover new sensitive information features. For example, the model may discover that certain query field combinations are highly correlated with information leakage risk. Based on these new features, the identification rule library is optimized and new warning rules are added. For example, if a user queries the combination of their ID number and bank card number more than three times during their lunch break, an alert is triggered. Through machine learning, the rule library can more intelligently adapt to new risk patterns.

[0031] It should be pointed out that this embodiment also combines industry standards and regulations to dynamically update the rule base to ensure the legitimacy and effectiveness of the rule base. In an actual scenario, the relevant laws and regulations of the financial industry are interpreted regularly to extract key clauses and requirements related to customer information protection. For example, the "Personal Information Protection Law" stipulates that customer sensitive information shall not be queried without the customer's explicit authorization. Then, these regulatory requirements are mapped to the sensitive information identification rules, and corresponding early warning rules are formulated. For example, if sensitive information is queried without the customer's authorization, an early warning will be triggered. At the same time, a dynamic update mechanism is established to adjust the rule base in a timely manner as laws and industry standards are revised. By closely integrating with laws and regulations, the rule base can always meet regulatory requirements and reduce compliance risks.

[0032] S1300: Utilize the sensitive information identification rule library to convert the user access link into a multi-dimensional behavior profile; After obtaining the sensitive information feature library and sensitive information identification rule library obtained by tracing the leakage events in the reporting case library, the sensitive information identification rule library is used to convert the user access link into a multi-dimensional behavior profile. Specifically, the monitoring system extracts key behavior data from the user access link, including user identity information, operation time, operation type, access frequency, query field, etc., matches the extracted behavior data with the features in the sensitive information identification rule library, identifies the operation behavior related to sensitive information, and constructs a multi-dimensional behavior profile based on the matching results. The constructed behavior profile is then stored in the database in a structured data format for subsequent analysis and comparison. Among them, the multi-dimensional behavior profile includes but is not limited to: Time dimension: the time period, frequency, duration, etc. of the operation; Behavioral dimension: operation type (such as query, modification, download), sensitive fields involved, etc. Network dimension: operation IP address, device information, network connection status, etc.; Association dimension: the relationship between users and customer accounts, the sequence of operations, etc.

[0033] It should be noted that this embodiment further incorporates a deep learning model to optimize the accuracy of behavioral profiling. Specifically, behavioral data from user access links is first annotated to distinguish normal from abnormal behavior. This annotated data is then used to train a deep learning model (such as a recurrent neural network (RNN) or a long short-term memory (LSTM) network). This model learns the time series characteristics and patterns of user behavior, predicting subsequent user behavior and enhancing the predictive power of behavioral profiling. For example, the model can predict whether a user is likely to download sensitive information after querying it. The model processes new data in real time and dynamically updates the behavioral profile, ensuring its timeliness and accuracy.

[0034] It should be noted that this embodiment can further refine the behavioral profile in combination with business scenarios to make it more targeted. Specifically, for banking scenarios, different business scenarios of the bank (such as customer account opening, loan approval, account inquiry, etc.) are analyzed to clarify the normal behavior patterns in each scenario. Based on the business scenario, the user behavior profile is further refined. For example, in the loan approval scenario, the focus is on the user's query and modification operations on the loan customer's account; in the account inquiry scenario, the focus is on the query frequency and query fields, and sensitive information identification rules are customized for different business scenarios. For example, in the loan approval scenario, if the user inquires about the loan customer's sensitive information during non-working hours, an early warning is triggered, and the refined behavior profile is stored in the database. In subsequent analysis, it is compared with the real-time behavior data to detect abnormal behavior in a timely manner.

[0035] S1400: Calculate the corresponding behavior deviation based on the user access link and multi-dimensional behavior profile through an attention mechanism network model; After using the sensitive information identification rule library to convert the user access link into a multi-dimensional behavioral profile, the attention network model calculates the corresponding behavioral deviation based on the user access link and multi-dimensional behavioral profile. Specifically, the monitoring system uses the user access link and multi-dimensional behavioral profile as input data, extracts key features such as operation time, query frequency, and number of sensitive field accesses, and constructs an attention network model that focuses on features related to sensitive information operations. For example, features such as the number of sensitive field accesses and operations during non-business hours are assigned higher weights. The model is trained using historical data, including samples of normal behavior and known abnormal behavior. Through supervised learning, the model learns normal behavior patterns and identifies behaviors that deviate from them. The model calculates behavioral deviation based on the input data. A higher deviation indicates a greater deviation from the normal pattern and a higher risk. A deviation threshold is set based on business needs and risk appetite. When the behavioral deviation exceeds the threshold, subsequent dynamic filtering strategies are triggered.

[0036] It should be noted that the introduction of reinforcement learning in this embodiment allows for dynamic adjustment of the attention mechanism network model to adapt to changing behavior patterns. This is specifically implemented as follows: First, the user behavior analysis system is defined as a reinforcement learning environment, with user behavior as the state and the model output (deviation calculation) as the action. A reward mechanism is then designed to provide positive rewards when the model correctly identifies abnormal behavior and negative rewards when it misidentifies it. The model is then trained using a reinforcement learning algorithm (such as Q-learning or deep reinforcement learning), enabling it to dynamically adjust attention weights and deviation calculation logic based on reward signals. During operation, the model receives real-time feedback and dynamically adjusts its parameters to improve its ability to identify emerging abnormal behaviors. By introducing reinforcement learning, the model can dynamically adjust based on real-time feedback, better adapting to complex and changing user behavior patterns and enhancing the overall performance and robustness of the system.

[0037] S1500 , implementing context-aware real-time filtering on the data in transmission based on the behavior deviation and the sensitive information feature library and a multi-level sensitive factor dynamic filtering strategy.

[0038] After calculating the corresponding behavioral deviation based on the user's access links and multi-dimensional behavioral profile using an attention network model, the system then applies context-aware real-time filtering to the data in transit using a multi-level dynamic filtering strategy based on the behavioral deviation and the sensitive information signature database. Specifically, the monitoring system categorizes sensitive information into multiple levels (e.g., high, medium, and low sensitivity) based on its importance and risk level. For example, ID card numbers and bank card numbers are highly sensitive, account balances are medium sensitive, and transaction records are low sensitive. A multi-level dynamic filtering strategy is designed for each level of sensitive information. Highly sensitive information triggers strict filtering (e.g., immediate query blocking), medium sensitive information triggers moderate filtering (e.g., query frequency restriction), and low sensitive information triggers light filtering (e.g., query behavior logging). The filtering strategy is dynamically adjusted based on contextual information in the user behavior profile (e.g., operation time, user role, operation frequency, etc.). For example, accessing highly sensitive information during off-hours triggers stricter filtering. During data transmission, user behavior is monitored in real time, and filtering strategies are dynamically applied based on the behavioral deviation and the sensitive information signature database. When the behavioral deviation exceeds a set threshold, the corresponding filtering action is immediately executed.

[0039] It should be noted that this embodiment introduces an adaptive learning mechanism to further optimize dynamic filtering strategies. This includes utilizing machine learning algorithms (such as reinforcement learning or online learning algorithms) to construct an adaptive learning model, enabling the model to dynamically adjust filtering strategies based on real-time feedback. The model adjusts sensitivity factor classification and filtering strategies in real time based on feedback. For example, it dynamically adjusts the filtering threshold for highly sensitive information based on the frequency of violations. Regular evaluation and optimization of the adaptive learning model ensures that filtering strategies can adapt to new threat patterns and changes in user behavior. By introducing an adaptive learning mechanism, filtering strategies can be dynamically adjusted based on real-time data, enhancing the system's flexibility and responsiveness, and enabling it to better address complex and changing security threats.

[0040] In the above implementation, by constructing user access links and combining multi-dimensional behavioral portraits, user behavior characteristics can be accurately captured, and efficient identification of abnormal behaviors can be achieved. The use of the attention mechanism network model to calculate behavioral deviations further improves the accuracy and real-time performance of abnormal behavior detection. At the same time, based on the multi-level sensitive factor dynamic filtering strategy, filtering measures can be flexibly adjusted according to different risk levels, and context-aware real-time intervention can be achieved to effectively block potential risk behaviors. In addition, the method also has self-evolutionary learning capabilities, can automatically update the rule base, adapt to the ever-changing threat environment, and continuously optimize system performance. Overall, the present invention can effectively prevent internal illegal operations, protect customer information security, reduce the risk of data leakage in financial institutions, and improve operational security and compliance.

[0041] In some embodiments, step S1100 includes: S1111. Extracting user static attributes and dynamic operation events from at least one of a business log, a security log, and network traffic; In this embodiment, when constructing a user access link based on user behavior data collected from multiple sources, user static attributes and dynamic operation events are first extracted from at least one of the following: business logs, security logs, and network traffic. Specifically, data is extracted from business logs, security logs, and network traffic. For example, business logs record user operations within the banking system, such as account balance inquiries and transfers; security logs record user logins, permission changes, and other behaviors; and network traffic data is captured by network monitoring devices, recording detailed information about user requests and responses. User static attributes and dynamic operation events are extracted from these data sources. User static attributes include user identity information (such as employee ID and role) and device information (such as terminal type and IP address). Dynamic operation events include specific user operations, such as the time of the query operation, the operation type (query, modify, delete), and the operation object (such as a customer account). Through the above steps, rich user behavior data can be extracted from multiple data sources, providing a solid data foundation for the subsequent construction of the user access link.

[0042] It should be noted that in this embodiment, the system can also clean and format the extracted data to remove invalid or duplicate data records to ensure data accuracy and consistency. For example, timestamps in different formats can be unified into a standard format and identifiers of operation objects can be standardized.

[0043] S1112. Construct a heterogeneous graph including user nodes and resource nodes based on the user static attributes and dynamic operation events; wherein the static attributes serve as node features of the heterogeneous graph, and the dynamic operation events serve as edges with timestamps in the heterogeneous graph; Furthermore, after extracting user static attributes and dynamic operation events from at least one of business logs, security logs, and network traffic, the system constructs a heterogeneous graph consisting of user nodes and resource nodes based on these user static attributes and dynamic operation events. Specifically, the system extracts user static attributes (such as employee ID, role, and IP address) and dynamic operation events (such as query operations, login time, and operation objects) from business logs, security logs, and network traffic. User nodes are then created based on the user static attributes, with one node corresponding to each user. Node features include user identity information and device information. Timestamped edges are created based on dynamic operation events to represent interactions between users and resources. All user nodes, resource nodes, and timestamped edges are combined into a heterogeneous graph. In this graph, user nodes and resource nodes are connected by edges, and the timestamps of the edges record the time when the interaction occurred. Through these steps, a heterogeneous graph consisting of user nodes and resource nodes is successfully constructed, laying the foundation for subsequently traversing edges in time series and generating access paths with contextual information.

[0044] It should be pointed out that this embodiment, combined with the knowledge graph, can enhance the semantic information of the heterogeneous graph and improve the ability to understand and analyze user behavior. Specifically, a knowledge graph containing knowledge in the financial field is constructed, including user roles, operation types, resource types and the semantic relationships between them. Semantic annotations are added to the nodes and edges of the heterogeneous graph to associate user behavior with the semantic information in the knowledge graph. The semantic reasoning ability of the knowledge graph is used to conduct a more in-depth analysis of user behavior. By combining with the knowledge graph, the heterogeneous graph not only contains structured information on user behavior, but also incorporates rich semantic information, which can more accurately identify and understand the intention and context of user behavior, and provide more powerful support for risk detection and behavior analysis.

[0045] S1113 , traversing the edges of the heterogeneous graph in time sequence, generating access paths with context information, and constructing user access links.

[0046] Furthermore, after constructing a heterogeneous graph containing user nodes and resource nodes based on the user's static attributes and dynamic operation events, the system traverses the edges of the heterogeneous graph in time sequence to generate access paths with contextual information to construct a user access chain. Specifically, all timestamped edges are extracted from the heterogeneous graph and sorted chronologically. Based on the sorted edges, starting from the user's starting operation node, each edge is traversed in sequence to generate the user's access path. The path not only contains the chronological order of the operations but also contains contextual information about the operations, such as the operation object and operation type. During the path generation process, contextual information for each operation is extracted. For example, for query operations, the query fields are recorded; for modification operations, the values ​​before and after the modification are recorded. This contextual information enables a more comprehensive understanding of user behavior, and the generated access paths with contextual information are integrated into a complete user access chain. Through these steps, the user access chain is successfully constructed, providing a detailed behavioral trajectory for subsequent behavior analysis and anomaly detection.

[0047] It should be pointed out that the introduction of the time window mechanism in this embodiment can optimize the access path generation process and improve the accuracy and practicality of the path. Specifically, according to business needs and user behavior patterns, the time series of user operations is divided into multiple time windows, and an access path is generated independently in each time window. This can avoid the overly complex paths of long time spans, and at the same time can more clearly show the user's behavior patterns in different time periods. After generating the path in each time window, the paths of adjacent time windows are reasonably connected according to the user's operation logic and business process, and then the generated path is optimized and adjusted according to the path characteristics and business rules in the time window. By introducing the time window mechanism, the access path generation process is more flexible and efficient, and can better adapt to the diversity and complexity of user behavior, while providing more targeted path information for subsequent behavior analysis.

[0048] This embodiment extracts user behavior data from business logs, security logs, and network traffic, constructs a heterogeneous graph containing user nodes and resource nodes, and generates access paths with contextual information in a time series, achieving accurate construction of user access links. This method can comprehensively capture the dynamic characteristics and contextual information of user behavior, providing a detailed and structured data foundation for subsequent behavior analysis and anomaly detection. At the same time, through the construction of a heterogeneous graph, the semantic understanding and association analysis capabilities of user behavior are enhanced, improving the accuracy and efficiency of behavior analysis, and effectively helping financial institutions prevent internal risks and ensure data security.

[0049] In some embodiments, the S1200 calculates the corresponding behavior deviation based on the user access link and the multi-dimensional behavior profile through an attention mechanism network model, including: S1411: Divide the user access link into behavior segments according to the time window, and obtain a behavior profile corresponding to each behavior segment; In this embodiment, when calculating the corresponding behavioral deviation based on the user access link and multi-dimensional behavioral profile, in order to more accurately and dynamically calculate the behavioral deviation, the user access link is segmented into behavioral segments by time window, and the corresponding behavioral profile for each behavioral segment is obtained. The user access link is segmented by time window based on business needs and user behavior patterns. For example, a day can be divided into multiple time windows, such as nighttime (0:00 - 6:00), morning (6:00 - 12:00), afternoon (12:00 - 18:00), and evening (18:00 - 24:00). User behavior within each time window is considered a behavioral segment. The behavioral segments within each time window are then extracted from the user access link. A corresponding behavioral profile is generated for each behavioral segment. The behavioral profile includes multi-dimensional information, such as operation time, operation type, operation object, and operation frequency. Through the above steps, the user access link can be segmented into behavioral segments by time window, and a detailed behavioral profile can be generated for each segment, providing basic data for subsequent behavioral deviation calculation.

[0050] It should be noted that the adaptive time window mechanism introduced in this embodiment can automatically adjust the size of the time window according to the dynamic nature of user behavior, thereby improving the flexibility and accuracy of the behavior segmentation. Specifically, the system performs behavioral pattern analysis on the user access link and identifies the active and inactive periods of user behavior. For example, by analyzing the operation frequency and operation time interval, it is determined that the user's behavior is more concentrated in certain time periods and less in other time periods. Then, based on the results of the behavioral pattern analysis, the size of the time window is dynamically adjusted. During the active period of user behavior, the time window is narrowed to capture behavioral changes more finely; during the inactive period, the time window is appropriately expanded to reduce computational complexity. Behavior segments are extracted within each adaptive time window and a behavior profile is generated. Since the size of the time window is dynamically adjusted according to user behavior, the generated behavior segments can more accurately reflect the actual pattern of user behavior. By introducing the adaptive time window mechanism, the division of behavior segments is more flexible and accurate, and can better adapt to the dynamic changes of user behavior, providing higher quality data support for subsequent behavioral deviation calculations.

[0051] S1412. Calculate the similarity between the behavior profile corresponding to each behavior segment and the normal profile through the attention mechanism network; This embodiment divides the user access link into behavior segments based on time windows and obtains a corresponding behavior profile for each behavior segment. To calculate the behavioral deviation using the attention network model, it is necessary to calculate the similarity between the behavior profile corresponding to each behavior segment and the normal profile. Specifically, the system first constructs a normal behavior profile based on historical normal behavior data. This data is derived from the bank's internal normal operation records, including users' regular operations over different time periods. The system then extracts a behavior profile from each acquired behavior segment. The attention network model then calculates the similarity between each behavior segment profile and the normal profile using the attention network model. The attention network model automatically assigns weights to key features in the user behavior data, focusing on features associated with abnormal behavior. For example, the model might assign higher weights to "non-business hours operations" and "highly sensitive information operations." By calculating the differences between the behavior segment profile and the normal profile along various dimensions, the model outputs a similarity value, typically ranging from 0 to 1, with values ​​closer to 1 indicating a closer approximation to the normal pattern.

[0052] S1413. Generate a dynamic deviation curve based on the standard deviation of the similarity and the number of mutations; After calculating the similarity between the behavioral profile corresponding to each behavior segment and the normal profile using the attention network, a dynamic deviation curve is generated based on the standard deviation and number of mutations of the similarity. Specifically, the similarity values ​​obtained for each behavior segment and the normal profile are used. The standard deviation of the similarity values ​​within each time window is calculated to measure the degree of similarity fluctuation. A larger standard deviation indicates a more dramatic change in similarity within that time period. The number of mutations in the similarity values ​​is detected, that is, significant changes in the similarity values ​​between adjacent time points. For example, if the similarity value suddenly drops from 0.4 to 0.3, or suddenly rises from 0.5 to 0.6, this is considered a mutation. Two mutations were detected within the nighttime time window. The dynamic deviation curve is generated by combining the standard deviation and number of mutations of the similarity. The dynamic deviation curve reflects the trend of behavioral deviation over time.

[0053] S1414: Determine the behavior deviation according to the dynamic deviation curve.

[0054] After generating a dynamic deviation curve based on the standard deviation and number of mutations of the similarity, the behavioral deviation is determined based on the dynamic deviation curve. Specifically, the system obtains the dynamic deviation curve, which reflects the changing trend of user behavioral deviation over time. It then analyzes the curve to identify key time points with high deviations. Based on the characteristics of the dynamic deviation curve, the overall behavioral deviation is calculated. Deviations at key time points can be given higher weights to reflect the impact of behavior during these time periods on the overall deviation. For example, the deviation between 2:00 AM and 3:00 AM can be multiplied by a higher weight coefficient (e.g., 1.5), while deviations during other time periods can be multiplied by a lower weight coefficient (e.g., 1.0). The weighted deviation values ​​are then aggregated to calculate the final behavioral deviation. Through these steps, the bank's data center can accurately determine user behavioral deviation based on the dynamic deviation curve, promptly identify potential abnormal behavior, and provide a scientific basis for subsequent risk management.

[0055] This implementation divides user access links into behavioral segments and calculates their similarity to the norm, generating a dynamic deviation curve to determine the degree of behavioral deviation. This approach accurately captures the dynamic changes and abnormal characteristics of user behavior, reflecting the degree of behavioral deviation in real time. Combined with the attention mechanism network model, this further improves the accuracy and efficiency of behavioral analysis, providing strong support for financial institutions to promptly detect and address abnormal behavior, and effectively enhancing data security protection capabilities.

[0056] In some embodiments, the real-time filtering comprises: S1511. When the behavior deviation exceeds a first threshold, desensitizing low-risk sensitive fields of the data being transmitted based on the sensitive information feature library; In this embodiment, when filtering data in transit in real time, if the behavioral deviation exceeds a first threshold, low-risk sensitive fields in the data being transmitted are desensitized based on the sensitive information signature database. Specifically, user behavior deviation is monitored in real time. When the deviation exceeds a preset first threshold (e.g., 60 points), the desensitization mechanism is triggered. Based on the sensitive information signature database, low-risk sensitive fields in the data being transmitted are identified. Low-risk sensitive fields are those that, while containing sensitive information, present a relatively low risk of leakage, such as the last four digits of a customer account balance. Desensitization is then applied to the identified low-risk sensitive fields. Desensitization can be performed by partially hiding (e.g., replacing some characters with asterisks "****") or by blurring. For example, a customer account balance of "123456.78" would be displayed as "******.78," obscuring the first few digits of the balance. If the user behavior deviation continues to increase, the system will further adjust the filtering strategy. For example, if the deviation exceeds a second threshold (e.g., 80 points), the operation blocking mechanism is activated.

[0057] It should be noted that this embodiment also stores the logs of the desensitization operation in the database to facilitate subsequent auditing and analysis. These logs record information such as the desensitization field, desensitization time, and user identity, providing an important basis for security audits.

[0058] It should be noted that this embodiment partially hides or obfuscates sensitive information so that it cannot be directly disclosed in full when displayed, but some information is still retained for user reference. For example, the first few digits of the account balance are hidden, and only the last few digits are displayed. Although fields contain sensitive information, the risk of leakage is relatively low. For example, the last four digits of the account balance, the initials of the customer's name, etc. These fields may need to be displayed in normal business scenarios, but they need to be desensitized to protect privacy.

[0059] S1512: When the behavior deviation exceeds a second threshold, activate operation blocking for the matching sensitive data field; Furthermore, in this embodiment, when filtering the data in transmission in real time, when the behavior deviation exceeds the second threshold, operation blocking is activated for the matching sensitive data field. Specifically, the user behavior deviation is monitored in real time. When the deviation exceeds the preset second threshold, the operation blocking mechanism is triggered, and the high-risk sensitive fields in transmission are identified based on the sensitive information feature library. High-risk sensitive fields are those fields that involve core sensitive information and have a very high risk of leakage, such as the customer's ID number, bank card number, etc. Operation blocking is implemented on the identified high-risk sensitive fields. The blocking method can be to directly prohibit access, interrupt data transmission, or restrict operation permissions. For example, when the operation and maintenance personnel try to query the customer's ID number, the system immediately interrupts the query operation and records the operation blocking event.

[0060] S1513. Dynamically increase or decrease the level of the filtering strategy according to the real-time change rate of the behavior deviation.

[0061] Furthermore, this embodiment dynamically upgrades or downgrades the filtering policy based on the real-time rate of change of the behavior deviation. Specifically, the rate of change of the user behavior deviation is monitored in real time. For example, if the behavior deviation of an operation and maintenance personnel rapidly increases from 60 to 80 points within a short period of time, with a rate of change of 10 points per minute, the system evaluates whether the deviation change rate exceeds the threshold based on a preset rate of change threshold (e.g., an increase of 5 points per minute). If the threshold is exceeded, it indicates that the user behavior may pose a sudden risk. The filtering policy is dynamically upgraded or downgraded based on the deviation change rate. For example, if the change rate exceeds the threshold, the system automatically upgrades the filtering policy from "desensitizing low-risk sensitive fields" to "blocking operations on high-risk sensitive fields." If the deviation change rate gradually decreases, the system downgrades the filtering policy from "blocking operations" to "desensitizing display." The adjusted filtering policy is applied to the user's behavior in real time, and the adjustment results are provided to the user. For example, if the filtering policy is upgraded from "desensitizing display" to "blocking operations," the system displays a prompt message to the operation and maintenance personnel stating that the operation has been blocked due to security risks. Through the above steps, the level of the filtering strategy can be dynamically adjusted according to the real-time change rate of the user behavior deviation, ensuring that the filtering strategy can flexibly respond to sudden changes in user behavior, effectively prevent potential security risks, and reduce interference with normal business operations.

[0062] This implementation achieves precise control over user behavior by monitoring behavioral deviations in real time and implementing graded filtering measures. When the deviation exceeds a first threshold, low-risk sensitive fields are desensitized to protect data privacy. When it exceeds a second threshold, operation blocking is activated to prevent the leakage of sensitive information. Furthermore, the filtering policy level is dynamically adjusted based on the rate of change of the deviation, ensuring the flexibility and adaptability of the filtering measures. This approach effectively balances user experience with data security and enhances the risk prevention and control capabilities of financial institutions.

[0063] In some embodiments, the real-time filtering further comprises: S1521: Calculate a comprehensive risk value by weighting the behavior deviation score and the confidentiality level of the sensitive data field; In this embodiment, when filtering data in transit in real time, to further improve the accuracy and effectiveness of real-time filtering, the system weights the behavioral deviation score and the confidentiality level of the sensitive data field to calculate a comprehensive risk value. Specifically, the user's current behavioral deviation score is obtained from the behavioral analysis system, and the sensitive data fields involved in the current operation and their confidentiality levels are determined based on the sensitive information feature library. For example, an operations and maintenance personnel is querying a customer's ID number (high confidentiality level, weighted 0.8) and account balance (medium confidentiality level, weighted 0.5). The behavioral deviation score and the confidentiality level of the sensitive data field are weighted to obtain a comprehensive risk value. The calculation formula is as follows: Comprehensive risk value = (behavior deviation score × weight coefficient) + ∑ (sensitive field confidentiality level × field weight).

[0064] S1522: When the comprehensive risk value reaches a third threshold, blocking the user's current access link.

[0065] In this embodiment, after calculating a comprehensive risk value by weighting the behavioral deviation score and the confidentiality level of the sensitive data field, the user's current access link is blocked when the comprehensive risk value reaches a third threshold. Specifically, to further ensure data security, when the comprehensive risk value reaches the third threshold, the user's current access link is blocked. Changes in the comprehensive risk value are monitored in real time to ensure that the system can respond promptly to changes in risk. A third threshold for the comprehensive risk value is preset (e.g., 50 points). When the comprehensive risk value reaches or exceeds the third threshold, the access link blocking mechanism is triggered. For example, if an operations and maintenance personnel's behavioral deviation score is 85 points, and after weighted calculation, the comprehensive risk value reaches 51.89 points, the system immediately blocks the operator's current access link to prevent them from continuing high-risk operations. Blocking measures include disconnecting the network connection, disabling access to specific resources, or restricting user permissions. For example, the system interrupted the operator's query of sensitive customer information and recorded the blocking event. Access link blocking is a security mechanism that prevents potential security risks by interrupting the user's current network connection or disabling access to specific resources. For example, interrupting query operations on high-risk sensitive fields or restricting user access to specific systems.

[0066] In this embodiment, through the above-mentioned method, the system can promptly block the user's current access link when the comprehensive risk value reaches the third threshold, effectively preventing the leakage of sensitive information and ensuring data security.

[0067] In some embodiments, after the real-time filtering, the method further comprises: S1611: Calculate a heat map of the distribution of sensitive data fields whose operations are blocked; In this embodiment, after real-time filtering of the data in transit, in order to further optimize the security policy and enhance data protection capabilities, after real-time filtering, it is necessary to generate a heat map of the distribution of sensitive data fields that are blocked. Specifically, detailed information of all blocked operations is collected from the real-time filtering system, including the blocked sensitive data field type (such as ID number, bank card number, account balance, etc.), blocking time, user identity, operation type (such as query, modification, deletion), etc. Classify and count the collected sensitive data fields, and calculate the number of times each field type is blocked. Analyze the blocking frequency of each sensitive data field in different time periods to generate time series data. Based on the results of classification statistics and time series analysis, generate a heat map of the distribution of sensitive data fields. The heat map uses the field type as the horizontal axis and the time interval as the vertical axis, and the depth of color indicates the high and low blocking frequency. Through the above steps, the bank data center can intuitively display the distribution of sensitive data fields of blocked operations, providing data support for subsequent security policy adjustments and optimizations. S1612: When the distribution heat map indicates that the same feature operation is repeatedly triggered, automatically upgrading the level of the filtering strategy; In this embodiment, after calculating the distribution heat map of sensitive data fields that are blocked, in order to further optimize the filtering strategy and improve the security of the system, when the distribution heat map indicates that the same characteristic operation is repeatedly triggered, the level of the filtering strategy will be automatically upgraded. Specifically, the system monitors the distribution heat map in real time, analyzes the blocking frequency and time distribution of sensitive data fields, sets the threshold for repeated triggering, and automatically upgrades the level of the filtering strategy when repeated triggering is detected. For example, for the ID card number field, the filtering strategy is upgraded from "desensitizing low-risk sensitive fields" to "blocking operations on high-risk sensitive fields", and the operation and maintenance personnel are restricted from querying the ID card number field at night.

[0068] S1613: Generate a correlation analysis report including the behavior deviation and the filtering records.

[0069] In this embodiment, to further improve security management and audit efficiency, after real-time filtering, a correlation analysis report containing behavioral deviation and filtering records is generated. Specifically, the user's behavioral deviation score, filtering operation records (such as desensitized display, operation blocking), blocked sensitive data field type, blocking time, user identity, and other information are collected from the behavior analysis system and the real-time filtering system. The behavioral deviation and filtering operation records are correlated and analyzed to identify the relationship between the behavioral deviation and the specific filtering operation. Based on the correlation analysis results, a detailed correlation analysis report is generated. The report content includes user identity, behavioral deviation score, filtering operation records, blocked sensitive field type, blocking time, operation frequency, etc. Furthermore, the correlation analysis report is displayed to the security administrator in a visual manner to facilitate a quick understanding of the risk characteristics of user behavior.

[0070] This implementation generates a heat map of the sensitive data fields that were blocked, visually displaying high-risk fields and time periods, helping to quickly identify potential security threats. When repeated triggers are detected, the filtering policy level is automatically upgraded to strengthen the control of high-risk operations. Furthermore, the generated correlation analysis report integrates behavioral deviations and filtering records, providing comprehensive data support for security audits and policy optimization, enhancing the security management and risk prevention capabilities of financial institutions.

[0071] In some embodiments, the method further comprises: S1711. Collect interception records triggered in the real-time filtering and their corresponding behavior deviations; In this embodiment, in order to further optimize the sensitive information identification rule base and dynamic filtering strategy, it is necessary to collect the interception records triggered by real-time filtering and their corresponding behavioral deviations. Specifically, all operation records that trigger interception are collected from the real-time filtering system. The collected interception records are associated with the corresponding behavioral deviations. The behavioral deviation reflects the degree of deviation of user behavior from the normal pattern and is an important basis for triggering interception. The interception records and their corresponding behavioral deviations are stored in a database, and these data are marked for subsequent analysis and optimization.

[0072] S1712. Generate rule optimization parameters based on the distribution of sensitive fields and the mutation points of behavior deviation in the interception record; Furthermore, to optimize the sensitive information identification rule base, it is necessary to generate rule optimization parameters based on the distribution of sensitive fields and behavioral deviation mutation points in interception records. Specifically, the collected interception records are analyzed, the number of interceptions and distribution of each sensitive field are counted, the changing trend of behavioral deviation is analyzed, and mutation points are identified. A mutation point is a point where behavioral deviation increases significantly in a short period of time, usually indicating an abnormal change in user behavior patterns. The sensitive field distribution and behavioral deviation mutation points are combined to generate rule optimization parameters. These parameters include: Field weight adjustment: adjusting the weight of the field in the rule base based on the interception frequency of the sensitive field; Deviation threshold adjustment: adjusting the deviation threshold based on the behavioral deviation mutation point.

[0073] S1713. Synchronize the optimization parameters to the sensitive information identification rule library through federated learning; Furthermore, to further optimize the sensitive information identification rule base, it is necessary to synchronize the generated rule optimization parameters with the sensitive information identification rule base through federated learning. Specifically, a federated learning architecture is constructed, with multiple data centers or business systems within the bank serving as participating nodes. These nodes jointly synchronize and update the rule optimization parameters through encrypted communication and distributed computing. The generated rule optimization parameters are encrypted to ensure data security during transmission. Through the federated learning protocol, the encrypted optimization parameter package is synchronized from the central node (such as the head office data center) to each participating node (such as the branch data center). Each node locally decrypts and applies these optimization parameters to update the local sensitive information identification rule base.

[0074] S1714. Dynamically adjust the threshold of the multi-level sensitive factor dynamic filtering strategy based on the updated rule base.

[0075] In this embodiment, in order to further optimize the dynamic filtering strategy, it is necessary to dynamically adjust the thresholds of the multi-level sensitive factor dynamic filtering strategy based on the updated sensitive information identification rule base. Specifically, it is necessary to confirm that the sensitive information identification rule base has been updated according to the optimized parameters. Based on the updated rule base, the current threshold settings of the multi-level sensitive factor dynamic filtering strategy are analyzed. Based on the optimized parameters, the thresholds of the filtering strategy are dynamically adjusted. The adjusted thresholds are applied to the real-time filtering system to ensure that the system can dynamically filter according to the latest rule base and threshold settings. Furthermore, the system also monitors the effectiveness of the adjusted filtering strategy in real time, records the interception records and behavioral deviation changes before and after the strategy adjustment, and further optimizes the threshold settings based on the monitoring results to ensure the effectiveness and adaptability of the filtering strategy.

[0076] This implementation collects interception records and behavioral deviations from real-time filtering to generate rule optimization parameters. These are then synchronized with the sensitive information identification rule base through federated learning to dynamically adjust filtering policy thresholds. This process enables continuous optimization of the rule base and dynamic adjustment of filtering policies, enhancing the system's adaptability and security protection. This allows financial institutions to more accurately identify and respond to abnormal behavior, effectively reducing the risk of data leakage.

[0077] Please refer to the following for details: Figure 2 , Figure 2 Schematic diagram of the basic structure of the user entity behavior abnormality analysis and processing device in this embodiment.

[0078] like Figure 2 As shown, a user entity behavior anomaly analysis and processing device includes: an access link module 1100, which is used to construct a user access link based on user behavior data collected from multiple sources, wherein the user behavior data includes data collected from business logs, security logs and network traffic; a sensitive information module 1200, which is used to obtain a sensitive information feature library and a sensitive information identification rule library obtained by tracing the leakage events in the reporting case library; a behavior profile module 1300, which is used to use the sensitive information identification rule library to convert the user access link into a multi-dimensional behavior profile; a deviation calculation module 1400, which is used to calculate the corresponding behavior deviation based on the user access link and the multi-dimensional behavior profile through an attention mechanism network model; an information filtering module 1500, which is used to implement context-aware real-time filtering of the data in transmission based on the behavior deviation and the sensitive information feature library and a multi-level sensitive factor dynamic filtering strategy.

[0079] The aforementioned user entity behavior anomaly analysis and processing device forms a complete user entity behavior anomaly analysis and processing method by constructing user access links, generating multi-dimensional behavior profiles, calculating behavior deviations, and implementing dynamic filtering. This method can accurately capture dynamic changes in user behavior and identify potential abnormal operations in real time. By calculating behavior deviations through an attention mechanism network model and combining it with a multi-level sensitive factor dynamic filtering strategy, the system can flexibly adjust filtering measures based on risk levels and effectively block high-risk behaviors. In addition, the method also has self-evolutionary learning capabilities, can automatically update the rule base, adapt to the ever-changing threat environment, and enhance the security and adaptability of the system. Overall, this proposal significantly enhances financial institutions' ability to prevent internal illegal operations, ensures customer information security, reduces the risk of data leakage, and improves operational efficiency and compliance.

[0080] To solve the above technical problems, the present application also provides a computer device. Figure 3 , Figure 3This is a basic structural block diagram of the computer device in this embodiment.

[0081] like Figure 3 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a non-volatile storage medium, a memory and a network interface connected via a system bus. Among them, the non-volatile storage medium of the computer device stores an operating system, a database and computer-readable instructions, and the database may store a control information sequence. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor may execute a method for analyzing and processing abnormal user entity behavior. The network interface of the computer device is used to connect and communicate with the terminal. Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0082] In this embodiment, the processor is used to execute Figure 2 The access link module 1100, sensitive information module 1200, behavior profiling module 1300, deviation calculation module 1400, and information filtering module 1500 form a comprehensive method for analyzing and handling abnormal user entity behavior by constructing user access links, generating multi-dimensional behavior profiles, calculating behavior deviations, and implementing dynamic filtering. This method accurately captures dynamic changes in user behavior and identifies potential abnormal operations in real time. By calculating behavior deviations using an attention network model and combining it with a dynamic filtering strategy based on multi-level sensitive factors, the system can flexibly adjust filtering measures based on risk level, effectively blocking high-risk behavior. Furthermore, this method possesses self-evolutionary learning capabilities, automatically updating the rule base to adapt to the ever-changing threat landscape and improving system security and adaptability. Overall, this proposal significantly enhances financial institutions' ability to prevent internal misconduct, safeguards customer information security, reduces the risk of data leakage, and improves operational efficiency and compliance.

[0083] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the user entity behavior abnormality analysis and processing method described in any of the above embodiments.

[0084] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0085] Those skilled in the art will appreciate that the steps, measures, and schemes in the various operations, methods, and processes discussed in this application may be interchanged, modified, combined, or deleted. Furthermore, other steps, measures, and schemes in the various operations, methods, and processes discussed in this application may also be interchanged, modified, rearranged, decomposed, combined, or deleted. Furthermore, steps, measures, and schemes in the prior art that are similar to those disclosed in this application may also be interchanged, modified, rearranged, decomposed, combined, or deleted.

[0086] The above description is only part of the implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for analyzing and processing abnormal behavior of user entities, characterized in that: include: Building a user access link based on user behavior data collected from multiple sources, wherein the user behavior data includes data collected from business logs, security logs, and network traffic; Obtain a sensitive information feature database and a sensitive information identification rule database obtained through tracing and analyzing the leakage incidents in the reporting case database; Utilizing the sensitive information identification rule library, the user access link is converted into a multi-dimensional behavior profile; Through the attention mechanism network model, the corresponding behavior deviation is calculated based on the user access link and multi-dimensional behavior portrait; According to the behavior deviation and the sensitive information feature library, context-aware real-time filtering is implemented on the data in transmission based on a multi-level sensitive factor dynamic filtering strategy.

2. The method for analyzing and processing abnormal behavior of user entities according to claim 1, characterized in that: The method of constructing a user access link based on user behavior data collected from multiple sources includes: Extracting user static attributes and dynamic operation events from at least one of a business log, a security log, and network traffic; Constructing a heterogeneous graph including user nodes and resource nodes based on the user static attributes and dynamic operation events; wherein the static attributes serve as node features of the heterogeneous graph, and the dynamic operation events serve as edges with timestamps in the heterogeneous graph; The edges of the heterogeneous graph are traversed in time series to generate access paths with context information to build user access links.

3. The method for analyzing and processing abnormal behavior of user entities according to claim 1, characterized in that: The attention mechanism network model is used to calculate the corresponding behavior deviation based on the user access link and multi-dimensional behavior profile, including: Divide the user access link into behavior segments according to the time window, and obtain the behavior profile corresponding to each behavior segment; Calculating the similarity between the behavior portrait corresponding to each behavior segment and the normal portrait through the attention mechanism network; generating a dynamic deviation curve based on the standard deviation of the similarity and the number of mutations; The behavior deviation is determined according to the dynamic deviation curve.

4. The method for analyzing and processing abnormal behavior of user entities according to claim 1, characterized in that: The real-time filtering includes: When the behavior deviation exceeds a first threshold, desensitizing low-risk sensitive fields of the data being transmitted based on the sensitive information feature library; When the behavior deviation exceeds a second threshold, activating operation blocking for the matching sensitive data field; The level of the filtering strategy is dynamically increased or decreased according to the real-time rate of change of the behavior deviation.

5. The method for analyzing and processing abnormal behavior of user entities according to claim 1, characterized in that: The real-time filtering also includes: Calculate a comprehensive risk value by weighting the behavior deviation score and the confidentiality level of the sensitive data field; When the comprehensive risk value reaches a third threshold, the user's current access link is blocked.

6. The method for analyzing and processing abnormal behavior of user entities according to claim 4, characterized in that: After the real-time filtering, the following steps are also included: Statistically generate a heat map of the distribution of sensitive data fields whose operations are blocked; When the distribution heat map indicates that the same feature operation is repeatedly triggered, the level of the filtering strategy is automatically upgraded; Generates a correlation analysis report containing behavioral deviations and filtered records.

7. The method for analyzing and processing abnormal behavior of user entities according to claim 1, characterized in that: The method further comprises: Collecting interception records triggered in the real-time filtering and their corresponding behavioral deviations; Generate rule optimization parameters based on the distribution of sensitive fields and the mutation points of behavior deviation in the interception records; Synchronizing the optimization parameters to the sensitive information identification rule base through federated learning; The threshold value of the multi-level sensitive factor dynamic filtering strategy is dynamically adjusted based on the updated rule base.

8. A device for analyzing and processing abnormal behavior of user entities, characterized in that: include: An access link module, configured to construct a user access link based on user behavior data collected from multiple sources, wherein the user behavior data includes data collected from business logs, security logs, and network traffic; The sensitive information module is used to obtain the sensitive information feature library and sensitive information identification rule library obtained by tracing the source of the leakage incidents in the reporting case library; A behavior profiling module, configured to convert the user access link into a multi-dimensional behavior profile using the sensitive information identification rule library; A deviation calculation module is used to calculate the corresponding behavior deviation based on the user access link and multi-dimensional behavior profile through an attention mechanism network model; The information filtering module is used to implement context-aware real-time filtering of the data in transmission based on the behavior deviation and the sensitive information feature library and a multi-level sensitive factor dynamic filtering strategy.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the method for analyzing and processing abnormal user entity behavior as claimed in any one of claims 1 to 7.

10. A storage medium storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the method for analyzing and processing abnormal user entity behavior as claimed in any one of claims 1 to 7.

Images