Abnormal behavior detection method and system, electronic equipment and storage medium

Abstract

The invention relates to an abnormal behavior detection method and system, electronic equipment and a storage medium. The method comprises the steps that operation data of a current user is obtained firstly, the operation data comprises a plurality of operation graph nodes, the operation graph nodes are used for representing operation behaviors of the current user in a service system, then connection relations between the operation graph nodes are constructed, and a user operation graph is generated; and extracting a user behavior sequence in the user operation graph through the walk control parameters, vectorizing the user behavior sequence to generate a user behavior vector, and performing anomaly detection on the user behavior vector based on a pre-constructed spatial index tree to obtain a detection result for the current user. According to the scheme provided by the invention, abnormal operation behaviors can be accurately identified from mass data, and the safety of an enterprise business system is remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of system security technology, and in particular to abnormal behavior detection methods, systems, electronic devices, and storage media. Background Art

[0002] With the continuous development of digital industries, enterprises have significantly increased their focus on intranet security. Especially with the increasing concentration of data assets and the increasing use of remote work, ensuring the security of enterprise intranets has become a key focus of information security governance. Abnormal behavior within enterprise intranets can often lead to information leaks, system intrusions, and even core business disruptions, posing significant risks and financial losses to business operations.

[0003] Abnormal behavior within an enterprise's internal network is typically detected using technical means such as system permission auditing and user behavior analysis. System permission auditing focuses on verifying the access control configuration of resources such as operating systems, business systems, and databases. The goal is to ensure compliance with permission allocation and usage, thereby promptly identifying security risks such as unauthorized access and unauthorized operations. User behavior analysis collects and models user behavior within the system. When actual behavior deviates from the expected model, it identifies it as a potential abnormal operation. This can help identify intranet theft and leaks in complex scenarios.

[0004] Among related technologies, enterprise log data is widely used for abnormal behavior analysis. Enterprise log data comprehensively records various operational details of employees on systems and devices, such as login behavior, file access, network connections, operation time and frequency, etc., providing important data support for abnormal behavior analysis.

[0005] Although relevant technologies have initially acquired the ability to detect abnormal intranet behavior based on enterprise log data, in actual applications, abnormal intranet behavior is mostly caused by employees who are familiar with internal defenses and have access rights, and the proportion of abnormal behavior data is negligible and can easily be overwhelmed by massive normal behavior data.

[0006] At the same time, corporate business has strategic cyclicality and behavioral data is complex and changeable, which greatly increases the difficulty of extracting employee behavior patterns from massive data, and makes accurately detecting abnormal behavior in massive data a daunting task. Summary of the Invention

[0007] In order to solve or partially solve the problems existing in the related technologies, the present application provides an abnormal behavior detection method, system, electronic device and storage medium, which can accurately identify abnormal behavior from massive data and improve the security of enterprise business systems.

[0008] The first aspect of the present application provides a method for detecting abnormal behavior, comprising: Acquire operation data of the current user, wherein the operation data includes a plurality of operation graph nodes, and the operation graph nodes are used to represent the operation behavior of the current user in the business system; Build the connection relationship between each operation graph node to generate the user operation graph; extracting a user behavior sequence from the user operation graph using a walk control parameter, and vectorizing the user behavior sequence to generate a user behavior vector; Anomaly detection is performed on the user behavior vector based on a pre-built spatial index tree to obtain a detection result for the current user.

[0009] In one example, the wandering control parameters include a first wandering control parameter and a second wandering control parameter. Extracting a user behavior sequence from the user operation graph using the wandering control parameters and vectorizing the user behavior sequence to generate a user behavior vector includes: Generate a corresponding random walk path by adjusting the first walk control parameter and the second walk control parameter; Extracting the user behavior sequence from the user operation graph based on the random walk path; The user behavior sequence is input into a pre-trained embedding model, and the embedding model vectorizes the user behavior sequence to generate the user behavior vector.

[0010] In one example, the step of adjusting the first and second walk control parameters to generate a corresponding random walk path includes: By adjusting the value of the first wandering control parameter, a first jump probability of returning from the current node to the last visited node is determined, and the numerical relationship between the first wandering control parameter and the first jump probability is inversely proportional; By adjusting the value of the second wandering control parameter, a second jump probability of jumping from the current node to a node far away from the last visited node is determined, and the numerical relationship between the second wandering control parameter and the second jump probability is inversely proportional; Based on the first jump probability and the second jump probability, a corresponding random walk path is generated.

[0011] In one example, extracting the user behavior sequence from the user operation graph based on the random walk path includes: sequentially accessing the operation graph nodes in the user operation graph according to the random walk path, and extracting attribute information associated with the operation graph nodes and connection relationships between the operation graph nodes; Combining the attribute information and the connection relationship into the user behavior sequence; The attribute information includes at least the operation type, operation time period and operation host model of the operation behavior, and the connection relationship is an edge relationship obtained based on one or more connections of the operation type, the operation time period and the operation host model.

[0012] In one example, the embedding model is trained as follows: Constructing a pre-training model, a prediction function, and a cross-entropy loss function, wherein the pre-training model includes at least an input layer, a hidden layer, and an output layer; wherein the input layer is used to represent the central node of the behavior sequence by one-hot encoding, the hidden layer is used to map the behavior sequence to a low-dimensional vector space to obtain the behavior vector, and the output layer is used to predict the probability distribution corresponding to the central node based on the prediction function; Obtain a historical behavior sequence, and determine a central node of the historical behavior sequence and a context node corresponding to the central node; When the pre-training model is trained using the historical behavior sequence, the probability distribution between the central node and the context node is calculated using the prediction function; The loss value between the probability distribution and the true label of the context node is calculated by the cross entropy loss function until the pre-trained model converges to generate the embedding model.

[0013] In one example, performing anomaly detection on the user behavior vector based on the pre-built spatial index tree to obtain a detection result for the current user includes: Inputting the user behavior vector into the pre-built spatial index tree; Determining the user behavior vector as a current query point; Performing a neighbor search operation on the current query point through the spatial index tree to obtain a neighbor vector set corresponding to the user behavior vector; Calculating an anomaly score between the user behavior vector and the set of neighboring vectors; When the abnormality score is greater than a preset threshold, it is determined that the operation behavior of the current user is an abnormal operation behavior; When the abnormality score is less than or equal to the preset threshold, it is determined that the operation behavior of the current user is a normal operation behavior.

[0014] In one example, each internal node in the spatial index tree includes a splitting dimension and a splitting value, and performing a neighbor search operation on the current query point through the spatial index tree to obtain a set of neighbor vectors corresponding to the user behavior vector includes: Starting from the root node of the spatial index tree, recursively enter one of the subtrees of the spatial index tree according to the numerical relationship between the coordinate value of the current query point on the splitting dimension and the splitting value of the tree node; Traversing the subtree, recording a first candidate node adjacent to the current query point and a first proximity distance of the first candidate node; Backtrack to the parent node of the first candidate node; If another subtree of the parent node intersects with a hypersphere with the current query point as the center and the first proximity distance as the radius, traverse the other subtree and record a second candidate node adjacent to the current query point and a second proximity distance of the second candidate node; The first neighboring distance is compared with the second neighboring distance to determine that the first candidate node or the second candidate node is a neighboring node of the current query point, and vectors corresponding to multiple neighboring nodes constitute the neighboring vector set.

[0015] A second aspect of the present application provides an abnormal behavior detection system, comprising: An operation data acquisition module is used to acquire the operation data of the current user, wherein the operation data includes a plurality of operation graph nodes, and the operation graph nodes are used to represent the operation behavior of the current user in the business system; A user operation graph generation module is used to construct the connection relationship between each operation graph node and generate a user operation graph; A user behavior vector generation module is configured to extract a user behavior sequence from the user operation graph using a walk control parameter, and vectorize the user behavior sequence to generate a user behavior vector; The anomaly detection module is used to perform anomaly detection on the user behavior vector based on a pre-built spatial index tree to obtain a detection result for the current user.

[0016] A third aspect of the present application provides an electronic device, including: processor; and The memory stores executable codes thereon, and when the executable codes are executed by the processor, the processor is caused to execute the method described above.

[0017] A fourth aspect of the present application provides a computer-readable storage medium having executable code stored thereon. When the executable code is executed by a processor of an electronic device, the processor is caused to execute the method described above.

[0018] A fifth aspect of the present application provides a computer program product, which includes computer instructions, and when the computer instructions are executed by a processor, implements the method described above.

[0019] The technical solution provided by the present application may include the following beneficial results: In an embodiment of the present application, the operation data of the current user is first obtained, and the operation data includes multiple operation graph nodes. The operation graph nodes are used to represent the operation behavior of the current user in the business system. Then, the connection relationship between each operation graph node is constructed to generate a user operation graph, and the user behavior sequence in the user operation graph is extracted through the wandering control parameter, and the user behavior sequence is vectorized to generate a user behavior vector. The user behavior vector is detected for anomalies based on a pre-built spatial index tree to obtain a detection result for the current user.

[0020] Compared with related technologies, the technical solution of the present application maps the current user's various operation behaviors in the business system into operation graph nodes, which is conducive to analyzing the connection relationship between each operation graph node and constructing a user operation graph, facilitating a comprehensive understanding of user behavior characteristics. By flexibly setting the wandering control parameters, the corresponding user behavior sequence is extracted from the user operation graph, and the user behavior vector is generated after vectorization. The user behavior vector is efficiently detected for anomalies based on a pre-built spatial index tree, thereby realizing accurate identification of abnormal operation behaviors from massive data and significantly improving the security of the enterprise business system.

[0021] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other objects, features and advantages of the present application will become more apparent by describing in more detail exemplary embodiments of the present application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the present application.

[0023] Figure 1 This is a flow chart of an abnormal behavior detection method shown in an embodiment of the present application; Figure 2 This is another flowchart of an abnormal behavior detection method shown in an embodiment of the present application; Figure 3 This is a flow chart of a method for detecting abnormal behavior in an enterprise intranet based on embedding of user operation graphs, as shown in an embodiment of the present application; Figure 4 This is a schematic diagram of the structure of an abnormal behavior detection system shown in an embodiment of the present application; Figure 5 It is a structural diagram of an electronic device shown in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following describes embodiments of the present application in more detail with reference to the accompanying drawings. Although the accompanying drawings illustrate embodiments of the present application, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0025] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0026] It should be understood that although the terms "first", "second", "third", etc. may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0027] With the continuous development of digital industries, enterprises have significantly increased their focus on intranet security. Especially with the increasing concentration of data assets and the increasing use of remote work, ensuring the security of enterprise intranets has become a key focus of information security governance. Abnormal behavior within enterprise intranets can often lead to information leaks, system intrusions, and even core business disruptions, posing significant risks and financial losses to business operations.

[0028] Abnormal behavior within an enterprise's internal network is typically detected using technical means such as system permission auditing and user behavior analysis. System permission auditing focuses on verifying the access control configuration of resources such as operating systems, business systems, and databases. The goal is to ensure compliance with permission allocation and usage, thereby promptly identifying security risks such as unauthorized access and unauthorized operations. User behavior analysis collects and models user behavior within the system. When actual behavior deviates from the expected model, it identifies it as a potential abnormal operation. This can help identify intranet theft and leaks in complex scenarios.

[0029] Among related technologies, enterprise log data is widely used for abnormal behavior analysis. Enterprise log data comprehensively records various operational details of employees on systems and devices, such as login behavior, file access, network connections, operation time and frequency, etc., providing important data support for abnormal behavior analysis.

[0030] Although relevant technologies have initially acquired the ability to detect abnormal intranet behavior based on enterprise log data, in actual applications, abnormal intranet behavior is mostly caused by employees who are familiar with internal defenses and have access rights, and the proportion of abnormal behavior data is negligible and can easily be overwhelmed by massive normal behavior data.

[0031] At the same time, corporate business has strategic cyclicality and behavioral data is complex and changeable, which greatly increases the difficulty of extracting employee behavior patterns from massive data, and makes accurately detecting abnormal behavior in massive data a daunting task.

[0032] In related technologies, there is a problem that it is difficult to accurately identify abnormal user behavior from massive data, resulting in poor security protection performance of enterprise business systems.

[0033] To address the above issues, an embodiment of the present application provides an abnormal behavior detection method that can accurately identify abnormal behavior from massive data and improve the security of enterprise business systems.

[0034] The technical solutions of the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0035] Figure 1 This is a flow chart of an abnormal behavior detection method shown in an embodiment of the present application.

[0036] See also Figure 1 , the method includes at least the following steps.

[0037] Step 101: Acquire the operation data of the current user. The operation data includes a plurality of operation graph nodes. The operation graph nodes are used to represent the operation behavior of the current user in the business system.

[0038] In an embodiment of the present application, it is applied to an abnormal behavior detection system, which can communicate with various business systems to obtain the current user's operating behavior and related operating data in the business system in real time.

[0039] In this application, operation data consists of multiple operation graph nodes, each of which represents an operation performed by the current user in the business system, such as login, logout, data query, data download, file access, etc., performed by the user in the user interface provided by the business system. By structuring the current user's operation data into multiple operation graph nodes, the foundational data for the subsequent construction of the user operation graph is provided, enabling more accurate modeling and analysis of the current user's operation behavior in the business system.

[0040] Among them, the current user refers to a legitimate user who has pre-registered in the business system and passed identity authentication. His or her identity information comes from information such as the login account, access device identifier or network address.

[0041] Step 102: construct connection relationships between the nodes of each operation graph to generate a user operation graph.

[0042] In an embodiment of the present application, after obtaining multiple operation graph nodes, the connection relationship between each operation graph node is constructed according to a preset composition strategy to generate a user operation graph, thereby obtaining a graph structure with certain regularities and deep semantics.

[0043] The connection relationship between the nodes of the operation graph refers to the operation sequence relationship or causal relationship between multiple operation behaviors of the current user in the business system.

[0044] A user operation graph describes a series of operations performed by the current user in a business system in the form of a graph structure. The user operation graph consists of multiple operation graph nodes and edges. Each operation graph node represents an operation performed by the current user in the business system. Operation graph nodes are connected by edges, which represent the logical direction of the operation.

[0045] As an example, based on the multiple operation diagram nodes obtained in step 101, the system establishes a connection relationship between the nodes according to a preset composition strategy. The preset composition strategy includes but is not limited to the following methods: Graph composition strategy ①: Build edge connections based on the chronological order of operations, following the logic of "first to last." For example, if the user performs the "Login" operation at 10:00 and the "Access Module A" operation at 10:01, an edge is established between the "Login" node and the "Access Module A" node, pointing from the former to the latter.

[0046] Graph composition strategy ②: Based on business logic, establish edges connecting semantically dependent or co-occurring operation graph nodes. For example, "Access module A" is often followed by "Access data A." Therefore, establish an edge from "Access module A" to "Access data A" between the two nodes.

[0047] After constructing the connection relationship between each operation graph node in the above method, a complete user operation graph can be generated, which helps to restore the current user's actual operation path in the business system. The system can more comprehensively understand the timing characteristics and behavior patterns of its operation behavior and accurately capture the characteristics of the operation behavior.

[0048] Step 103 : extracting a user behavior sequence from the user operation graph using the walk control parameters, and vectorizing the user behavior sequence to generate a user behavior vector.

[0049] In an embodiment of the present application, the user behavior sequence in the user operation graph is efficiently extracted through the walk control parameter, and the user behavior sequence is vectorized to generate a representative user behavior vector.

[0050] The wandering control parameters refer to parameters used to control the wandering user operation graph. In this application, the wandering control parameters include at least a first wandering control parameter and a second wandering control parameter, and the first wandering control parameter and the second wandering control parameter correspond to wandering strategies at different levels.

[0051] As an example, the first walk control parameter can control the probability of revisiting the previous operation graph node, thereby adjusting the probability of behavior repetition or looping in the user operation behavior sequence. The second walk control parameter can control the direction of random walk exploration, thereby guiding a broader and deeper search of the user operation graph.

[0052] The user behavior sequence refers to the operation behavior path generated based on the connection relationship in the user operation graph, which can accurately reflect the continuous behavior trajectory of the current user in the business system.

[0053] User behavior vectors are numerical representations of user behavior sequences obtained by vectorizing and encoding them. In models, they are used to comprehensively characterize user behavior structures, operational preferences, and behavioral patterns, facilitating subsequent machine learning tasks such as similarity comparison, clustering, classification, and anomaly detection. User behavior vectors can be generated using techniques such as word embedding models, graph representation learning methods, and deep sequence modeling networks, and possess excellent discriminative and expressive capabilities.

[0054] Step 104 : Perform anomaly detection on the user behavior vector based on the pre-built spatial index tree to obtain a detection result for the current user.

[0055] In the embodiment of the present application, for the user behavior vector generated in step 103, anomaly detection is performed through a pre-built spatial index tree to generate a detection result for the current user.

[0056] The spatial index tree refers to a pre-built tree data structure that can retrieve user behavior vectors from multidimensional space and supports similarity search and efficient anomaly detection. This structure recursively partitions the vector space, mapping each user behavior vector to a specific region within the vector space, thereby constructing a hierarchical index relationship. Its core is to use the current user's behavior vector as the query input, using the spatial index tree to quickly find its set of neighboring nodes, calculate the similarity or distance between the current vector and its neighbors, and then convert the similarity or distance into an anomaly score.

[0057] The detection result refers to the evaluation result based on the user behavior vector of the current user, which is used to reflect whether the current user's operation behavior deviates from the normal behavior. If the current user's operation behavior deviates from the normal behavior, the generated detection result is that the current user's operation behavior is abnormal operation behavior, and an early warning information is generated to remind the management personnel of the business system. If the current user's operation behavior does not deviate from the normal behavior, the generated detection result is that the current user's operation behavior is normal operation behavior.

[0058] In an embodiment of the present application, the operation data of the current user is first obtained. The operation data includes multiple operation graph nodes. The operation graph nodes are used to represent the operation behavior of the current user in the business system. Then, the connection relationship between each operation graph node is constructed to generate a user operation graph. The user behavior sequence in the user operation graph is extracted through the wandering control parameter, and the user behavior sequence is vectorized to generate a user behavior vector. The user behavior vector is detected for anomalies based on a pre-built spatial index tree to obtain the detection result for the current user.

[0059] Compared with related technologies, the technical solution of the present application maps the current user's various operation behaviors in the business system into operation graph nodes, which is conducive to analyzing the connection relationship between each operation graph node and constructing a user operation graph, facilitating a comprehensive understanding of user behavior characteristics. By flexibly setting the wandering control parameters, the corresponding user behavior sequence is extracted from the user operation graph, and the user behavior vector is generated after vectorization. The user behavior vector is efficiently detected for anomalies based on a pre-built spatial index tree, thereby realizing accurate identification of abnormal operation behaviors from massive data and significantly improving the security of the enterprise business system.

[0060] Figure 2 This is another flowchart of an abnormal behavior detection method shown in an embodiment of the present application. Figure 2 relatively Figure 1 The technical solution of an embodiment of the present application is described in more detail and applied to an abnormal behavior detection system. The method includes at least the following steps.

[0061] Step 201: Acquire the current user's operation data.

[0062] In this embodiment of the application, the abnormal behavior detection system is connected to the business system of the enterprise, referring to Figure 3 , Figure 3 This is a flow chart of the method for detecting abnormal behavior in an enterprise intranet based on the embedding of user operation graphs shown in an embodiment of the present application. In fact, the abnormal behavior detection system performs abnormal detection on the current user's operation behavior based on the enterprise intranet data embedded in the user operation graph. The overall technical process mainly includes three parts: user operation graph construction, user behavior representation and anomaly detection.

[0063] Graph embedding is a technique that maps nodes, edges, or subgraphs in an operational graph structure into low-dimensional vectors, aiming to preserve the structural features and semantic relationships of the original graph. This application constructs a mapping function so that similar nodes or edges in the vector space also have similar features and relationships in the original graph, facilitating computer processing and analysis.

[0064] Abnormal behavior detection involves the use of various technologies and methods to monitor and analyze the behavior of entities such as systems, networks, or users to identify those that deviate significantly from normal behavior patterns. Its purpose is to promptly detect potential security threats, illegal operations, or abnormal events. By building behavioral models, setting thresholds, and applying machine learning algorithms, real-time behavioral data is compared with expected normal behavior to promptly identify potential security threats, abnormal events, or violations, triggering early warnings or protective measures.

[0065] An intranet is a local area network established within an enterprise. It connects various internal devices, including computers, servers, and printers, through network equipment such as routers and switches. Intranets typically use private IP address blocks and are isolated from external public networks. They offer high security, controllability, and stability, and are widely used to safeguard enterprise operations and information systems.

[0066] As an example, the abnormal behavior detection system requests data from the business system. The business system returns the current user's operation data collected in real time or periodically to the abnormal behavior detection system. The abnormal behavior detection system first performs data preprocessing operations such as denoising, filtering, and formatting on the operation data, and then extracts user behavior logs from the operation data. Different processing strategies are adopted according to the type of log file to screen and parse the key fields in the log entries to form standardized operation graph nodes.

[0067] In this application, the operation data includes log files such as device.csv, http.csv, email.csv, file.csv, and logon.csv. For different types of log data, different processing and extraction methods are used to extract the corresponding fields and form an operation graph node set.

[0068] Each operation graph node can be represented by a five-tuple:<subject,object,operation,time,host> Among them, subject represents the operation subject, including attributes such as the user name, object represents the object being operated, including attributes such as the file name, operation represents the operation type, time represents the time, and host represents the server or host on which the current log file occurs.

[0069] On this basis, the abnormal behavior detection system establishes directed edges between the nodes of the operation graph according to the sequence or causal relationship of the current user's operation behavior, forming a complete user operation graph, providing clear structure and semantic data for subsequent graph embedding modeling and abnormal behavior detection, and improving the modeling ability and recognition accuracy of complex operation behaviors.

[0070] Step 202: construct the connection relationship between the nodes of each operation graph to generate a user operation graph.

[0071] In an embodiment of the present application, after obtaining the set of operation graph nodes, it is necessary to construct association relationships between the various operation graph nodes based on heuristic rules, so as to form a complete user operation graph structure.

[0072] To better differentiate the operational behaviors of different users, the present embodiment constructs a separate user operation graph for each user and divides the behavioral sequences into daily units. Since users in an enterprise typically assume different roles and perform diverse tasks, constructing a daily user operation graph effectively captures their daily behavioral patterns and serves as a baseline for user behavior, facilitating the timely detection of abnormal behaviors that deviate from normal behavior and reducing the possibility of misjudgment.

[0073] Optionally, the connection relationship is an edge relationship obtained based on one or more connections of an operation type, an operation time period, and an operation host model.

[0074] Edge relationships based on operation type connections connect operation graph nodes of the same operation type through edges. For example, if a user performs multiple "file read" operations at different times, the system can connect operation nodes of the same type in chronological order, thereby accurately detecting the operation behavior of a specific operation type.

[0075] Edge relationships based on time period connections connect the nodes in the operation graph within a specific time period. For example, if you set a time window (such as an hour, a day, or a week), the system can connect the nodes in the operation graph within that time period in chronological order, accurately detecting operations within that specific time period.

[0076] Edge relationships based on console model connections connect nodes in the operation graph for the same console model used by a user. For example, the system can connect nodes in the operation graph for the same console model in chronological order to accurately detect the operation behavior of a specific device.

[0077] It is worth noting that in actual use, the system can establish a connection relationship based on only one of the operation type, operation time period and operation host model, or can establish a connection relationship by combining the operation type, operation time period and operation host model.

[0078] As an example, the system constructs a user operation graph based on the "user-date" dimension, that is, the operation graph nodes generated by the same user on the same day are combined with edge relationships between the nodes in chronological order to generate a user operation graph.

[0079] Considering that most non-administrator users typically perform operations only on a few specific hosts or their dedicated terminals, the system can construct a user's daily behavior patterns on each host. If a user logs in from a host they rarely or never access, this indicates potential abnormal login behavior. Specifically, the system constructs a user operation graph based on the "user-host-date" dimensions. The operation graph nodes for the same user on the same host and within the same day are linked chronologically to create an edge relationship, generating a user operation graph.

[0080] In addition, in actual scenarios, some malicious log records involve multiple operation types, such as a user viewing sensitive files on another person's host and sending them to a personal mailbox. Such operation types can be associated through specific rules.

[0081] At the same time, there may be attacks involving only a single operation type, such as a user uploading a confidential file to an external address after visiting a website. For this type of behavior, a mapping approach centered around operation type eliminates interference from other operation types and directly maps the operation behavior to the user operation graph, helping to more accurately detect this type of attack path. Because these behaviors all occur on a specific host, it is necessary to construct a user's daily behavior pattern for each operation type on each host. This approach improves the accuracy of identifying anomalous behavior, especially when distinguishing true threats from normal activity. Specifically, the system constructs a user operation graph based on the "user-host-operation type-date" dimensions, chronologically linking operation graph nodes that share the same operation type, host, and day.

[0082] This application generates user operation graphs of different granularities through the above method, thereby recording the user's daily behavior patterns, which is conducive to improving the accuracy of anomaly detection.

[0083] Step 203 : extracting a user behavior sequence from the user operation graph using the walk control parameters, and vectorizing the user behavior sequence to generate a user behavior vector.

[0084] In an embodiment of the present application, the system can first automatically capture the user behavior sequence from the user operation graph through the walk control parameters, and then convert the user behavior sequence into a vector form that can be recognized and learned by the model through vectorization operations.

[0085] In the present application, the wandering control parameters include a first wandering control parameter and a second wandering control parameter. The user behavior sequence in the user operation graph is extracted through the wandering control parameters, and the user behavior sequence is vectorized to generate a user behavior vector, including: generating a corresponding random wandering path by adjusting the first wandering control parameter and the second wandering control parameter, extracting the user behavior sequence from the user operation graph based on the random wandering path, inputting the user behavior sequence into a pre-trained embedding model, and using the embedding model to vectorize the user behavior sequence to generate a user behavior vector.

[0086] Taking the improved Node2vec algorithm of this application as an example, Node2vec introduces parameters p and q, and uses parameters p and q to implement an adjustable random walk strategy. In this application, the first walk control parameter can be parameter p, which determines the probability of returning to the previous node, and the second walk control parameter can be parameter q, which determines the probability of moving away from the previous node. By flexibly adjusting the values ​​of p and parameter q, different types of random walk paths are generated to ensure that long-distance dependencies between nodes can be mined, potential connection patterns can be discovered, and local neighborhood features of nodes can be obtained, thereby better capturing the local structural information and global structural information of the operation graph nodes in the user operation graph.

[0087] Furthermore, the present application generates a corresponding random walk path by adjusting the first walk control parameter and the second walk control parameter, and the process includes at least: determining a first jump probability of returning from the current node to the last visited node by adjusting the value of the first walk control parameter, and the numerical relationship between the first walk control parameter and the first jump probability is an inverse proportional relationship; and determining a second jump probability of jumping from the current node to a node away from the last visited node by adjusting the value of the second walk control parameter, and the numerical relationship between the second walk control parameter and the second jump probability is an inverse proportional relationship; based on the first jump probability and the second jump probability, a corresponding random walk path is generated.

[0088] In this application, Node2Vec adjusts the values ​​of the first and second walk control parameters to dynamically adjust the walk preferences of BFS (Breadth-First Search) and DFS (Depth-First Search). This application considers these two search strategies and develops a node transfer mechanism with biased random walks.

[0089] Referring to formula ①, given the current node v, the probability of accessing the next node x can be obtained by the following formula. is the unnormalized transition probability between node v and node x, and Z is a normalization constant.

[0090] , formula① If the current random walk passes through the edge (t, v) to reach the node v, then the unnormalized transition probability .in is the edge weight between nodes v and x, The definition of is as follows, where Represents the shortest distance between node t and node x, as shown in formula ②, Node2Vec only considers The case where the value is {0, 1, 2}.

[0091] , formula② The parameter p controls the probability of revisiting a node that has just been visited: if the value of p is large, the probability of a node that has just been visited being visited again will be very low. This strategy can avoid the program jumping back and forth between two nodes and guide the program to explore outward moderately. If the value of p is small, the program will tend to explore local information.

[0092] The parameter q controls the direction of random walk exploration: if the value of q is large, the program tends to visit nodes close to node t, similar to BFS. If the value of q is small, the program tends to explore nodes farther away from t, similar to DFS.

[0093] The first jump probability obtained based on the parameter p and the second jump probability obtained based on the parameter q can be achieved by starting from a starting node, selecting the next adjacent node according to a certain probability and continuously moving forward until the specified length is reached, thereby forming a random walk path.

[0094] In the present application, a user behavior sequence can be extracted from a user operation graph based on a random walk path. The process at least includes: sequentially accessing the operation graph nodes in the user operation graph according to the random walk path, extracting the attribute information associated with the operation graph nodes and the connection relationship between each operation graph node, and combining the attribute information and the connection relationship into a user behavior sequence.

[0095] The attribute information includes at least the operation type, operation time period and operation host model of the operation behavior, and the node connection relationship is an edge relationship obtained based on one or more connections among the operation type, operation time period and operation host model.

[0096] It can be understood that starting from any operation graph node, a random walk path containing several operation graph nodes is generated according to the probability rule. Each walk simulates a possible continuous operation trajectory of a user. Multiple walks can obtain multiple user behavior sequences.

[0097] This application uses the Node2vec algorithm to capture the complex structural information of nodes in the operation graph, explore the neighboring nodes of the current node and the relationship between nodes farther away, and encode this information into the vector embedding of the node. In this process, graph structure context information is also introduced to enhance the robustness of anomaly detection and avoid the impact of single-point local feature mutations on the results.

[0098] Next, the user behavior sequence is input into the pre-trained embedding model, which vectorizes the user behavior sequence and generates a user behavior vector.

[0099] Taking the pre-trained Skip-Gram model (skip-gram model) as an example, in order to map the acquired user behavior sequence into a low-dimensional dense vector space, the Skip-Gram model is used to vectorize the sequence data.

[0100] Optionally, the embedding model is trained as follows: Step A: Construct a pre-training model, a prediction function, and a cross-entropy loss function. The pre-training model includes at least an input layer, a hidden layer, and an output layer. The input layer is used to represent the central node of the behavior sequence through one-hot encoding, the hidden layer is used to map the behavior sequence to a low-dimensional vector space to obtain a behavior vector, and the output layer is used to predict the probability distribution corresponding to the central node based on the prediction function.

[0101] Step B: Obtain a historical behavior sequence, and determine the central node of the historical behavior sequence and the context node corresponding to the central node.

[0102] Step C: When the pre-trained model is trained using a historical behavior sequence, a prediction function is used to calculate the probability distribution between the central node and the context node.

[0103] Step D: Calculate the probability distribution and context nodes through the cross entropy loss function.

[0104] The core of the Skip-Gram model is a simple neural network that takes a node as input and attempts to predict the context nodes around that node. In Node2vec, the nodes in the user action graph are analogous to words in natural language processing, and the node sequences are analogous to sentences.

[0105] The pre-trained model mainly consists of an input layer, a hidden layer, and an output layer. The input layer is a one-hot encoding vector that represents the current center node. The hidden layer is a vector space with a dimension of d, that is, a low-dimensional vector representation space of the node. The output layer is a vector space with a length of A vector of is the total number of nodes in the graph, each element corresponds to a node, and represents the probability of the node being the context node of the current center node.

[0106] The prediction function used by the model is to maximize the probability of the center node co-occurring with its context nodes. For a given node sequence , assuming the window size is k, that is, the context nodes of each central node are the k nodes before and after it. , whose context node set is , the goal is to maximize the following probability, as shown in the following formula ③: , formula ③ in, is a given central node When the context node The probability of occurrence is calculated using the Softmax function (exponential normalization function), as shown in the following formula ④: , formula ④ in, Is the central node The vector representation of Is the context node The vector representation of .

[0107] After determining the prediction function, the predicted probability distribution is compared with the true context node label (also a one-hot encoded vector), and the loss is calculated using the cross entropy loss function, as shown in the following formula ⑤: , formula⑤ At this point, the model structure of the embedding model has been built, and the prediction function and cross entropy loss function have been clarified.

[0108] After the pre-training model is built, the training of the model relies on a large amount of training data as input, that is, determining the central node in the historical behavior sequence and its corresponding context node to construct training data pairs and thus update the model parameters.

[0109] Among them, historical behavior sequence refers to user sequence data with clear behavior labels that have occurred within a historical time period. This data reflects the user's continuous operation behavior in a specific business scenario.

[0110] Finally, the stochastic gradient descent algorithm is used to update the model parameters to minimize the loss function. During the training process, the generated node sequence is continuously traversed, and the model parameters are gradually adjusted so that the vector representation of the node can better reflect its structure and semantic information in the user operation graph.

[0111] This application uses the aforementioned vector representation learning process to map the nodes in the user operation graph to a low-dimensional vector space, so that nodes with similar graph structure also have similar embeddings in the vector space, supporting subsequent anomaly detection work.

[0112] Step 204: Input the user behavior vector into the pre-built spatial index tree.

[0113] In an embodiment of the present application, the pre-constructed spatial index tree may be a KD tree (k-dimensional tree, k-dimensional spatial tree).

[0114] During training, good vector embeddings are first extracted from the training user action graph and stored in a KD-tree.

[0115] The KD tree is a binary tree that divides data points in the k-dimensional space into different subspaces according to certain rules. Each node represents a hyperrectangular area in the k-dimensional space, and each leaf node corresponds to a data point.

[0116] Each internal node in a KD tree contains a splitting dimension and a splitting value. The splitting dimension determines the dimension along which the data point is to be split, while the splitting value is a threshold for that dimension. By comparing the value of a data point on the splitting dimension with the splitting value, the data point is assigned to the left or right subtree. Thus, the path from the root node to a leaf node corresponds to a series of partitioning processes, ultimately locating each data point to a specific leaf node.

[0117] The organizational structure of the KD tree facilitates nearest neighbor search, that is, given a query point, find the data point closest to it in the KD tree. Starting from the root node, the decision is made whether to search the left subtree or the right subtree based on the comparison of the query point's value on the splitting dimension with the splitting value of the current node. During the traversal process, the nearest point currently found and its distance are recorded. When a leaf node is reached, the data point corresponding to the leaf node is used as the current nearest point. Then, backtrack to the parent node to check whether there are other subtrees that may contain closer data points. If another subtree of the current node intersects with a hypersphere centered on the query point and with the current nearest distance as the radius, then it is necessary to continue searching in that subtree and update the nearest point and nearest distance. Repeat this process until all subtrees that may contain closer points have been traversed.

[0118] In the nearest neighbor search task, the time complexity of the KD tree is usually Therefore, this method uses KD tree to accelerate k-nearest neighbor search.

[0119] After training, the system can find outliers and detect abnormal behavior through three steps: k-nearest neighbor search, similarity calculation and filtering.

[0120] Step 205: Determine the user behavior vector as the current query point.

[0121] In practical applications, the current user's operation behavior is converted into a vector representation as the current query point, which is used for comparison or retrieval with known behavior samples or historical behavior sequences.

[0122] Step 206: Perform a neighbor search operation on the current query point through the spatial index tree to obtain a neighbor vector set corresponding to the user behavior vector.

[0123] In an embodiment of the present application, the process of performing a neighbor search operation on the current query point through the spatial index tree to obtain a neighbor vector set corresponding to the user behavior vector includes at least: starting from the root node of the spatial index tree, recursively entering one of the subtrees of the spatial index tree based on the numerical relationship between the coordinate value of the current query point on the splitting dimension and the splitting value of the tree node, traversing the subtree, recording the first candidate node adjacent to the current query point and the first neighbor distance of the first candidate node, and tracing back to the parent node of the first candidate node. If another subtree of the parent node intersects with a hypersphere centered on the current query point and with the first neighbor distance as the radius, traversing another subtree, recording the second candidate node adjacent to the current query point and the second neighbor distance of the second candidate node, comparing the first neighbor distance with the second neighbor distance, determining that the first candidate node or the second candidate node is a neighbor node of the current query point, and the vectors corresponding to multiple neighbor nodes constitute the neighbor vector set.

[0124] Among them, the hypersphere is a high-dimensional sphere in multidimensional space. If another subtree of the parent node intersects with the hypersphere with the current query point as the center and the first neighbor distance as the radius, it means that there may be a closer node in the other subtree. Therefore, it is necessary to further traverse the other subtree to avoid missing a better solution.

[0125] The first neighbor distance refers to the distance between the current query point and the first candidate node, which is the node currently found after recursive search in the current subtree and has the smallest distance to the query point.

[0126] The second neighboring distance refers to the distance between the current query point and the second candidate node. The second candidate node is a candidate node that is searched from another subtree after determining that another subtree may contain a closer node during backtracking.

[0127] After comparing the two, the node with the smaller distance is selected as the nearest neighbor of the current query point: If the first distance is smaller than the second distance, it means that the first candidate node is closer to the current query point, so the first candidate node is retained as the nearest neighbor of the current query point. If the second distance is smaller than the first distance, it means that the second candidate node is closer to the current query point, so the result is updated and the second candidate node is selected as the nearest neighbor of the current query point.

[0128] In practical applications, if multiple neighboring nodes need to be searched, this can be achieved by maintaining a priority queue structure of size K, which is used to record the K candidate nodes that are currently closest to the query point.

[0129] At this point, if the hypersphere constructed with the current query point as the center and the first neighbor distance as the radius intersects with another subtree of the parent node, it means that the subtree may contain a node closer than the current K candidate nodes. In the process of traversing the other subtree, whenever a new candidate node is found, its distance is compared with the farthest node in the priority queue. If the distance of the new candidate node is less than the distance of the farthest node, the farthest node is removed from the priority queue and the new candidate node is added to the queue, thereby continuously updating the set of K nearest neighbor nodes, and finally obtaining the closest K nearest neighbor nodes in the vector space. The vectors of the K candidate nodes formed constitute the final set of nearest neighbor vectors.

[0130] As an example, assuming that the coordinate value of the current query point on the splitting dimension is less than the splitting value of the tree node, then recursively enter the left subtree of the spatial index tree and traverse the left subtree. Assuming that the coordinate value of the current query point on the splitting dimension is greater than or equal to the splitting value of the tree node, then recursively enter the right subtree of the spatial index tree and traverse the right subtree until reaching the leaf node.

[0131] The sample vector stored in the leaf node is used as the initial nearest neighbor candidate vector, and backtracking is performed from the leaf node upward. For each parent node backtracked to, it is determined whether the area corresponding to its untraversed subtree intersects with the hypersphere centered on the query vector and with the current minimum distance as the radius. If so, the search is continued for the untraversed subtree, and the current set of nearest neighbor candidate vectors and distance values ​​are updated, so that subspaces where nearest neighbors are impossible can be quickly excluded during the search.

[0132] The backtracking and judgment process is repeated until all subtree nodes that may contain more nearest neighbor vectors are visited, and finally a nearest neighbor vector set consisting of the k nearest neighbor vectors of the query vector is obtained.

[0133] Step 207: Calculate anomaly scores between the user behavior vector and the set of neighboring vectors.

[0134] In the embodiment of the present application, a similarity criterion is applied to evaluate the closeness between the user behavior vector and its neighbors, and calculate the anomaly score, such as the following formula ⑥: , formula ⑥ in, is the average distance between all training vectors and their k nearest neighbors. It is the average distance between the target vector and its k nearest neighbors, as shown in the following formula ⑦: , formula ⑦ That is, the anomaly score measures whether the user behavior vector is significantly different from its neighboring behaviors in the vector space.

[0135] Step 208: When the abnormality score is greater than a preset threshold, it is determined that the current user's operation behavior is an abnormal operation behavior.

[0136] If the anomaly score is greater than the preset threshold, the user behavior vector is considered an outlier, and the current user's operation behavior is determined to be abnormal, and an early warning and manual review are triggered.

[0137] Step 209: When the abnormality score is less than or equal to the preset threshold, it is determined that the current user's operation behavior is a normal operation behavior.

[0138] If the anomaly score is less than or equal to the preset threshold, the user behavior vector is considered not to be an outlier and the current user's operation behavior is determined to be normal.

[0139] In an embodiment of the present application, operation data of the current user is obtained, the operation data includes multiple operation graph nodes, the operation graph nodes are used to represent the operation behavior of the current user in the business system, a connection relationship between each operation graph node is constructed, and a user operation graph is generated. The user behavior sequence in the user operation graph is extracted through the walk control parameter, and the user behavior sequence is vectorized to generate a user behavior vector. The user behavior vector is input into a pre-built spatial index tree, and the user behavior vector is determined to be the current query point. A neighbor search operation is performed on the current query point through the spatial index tree to obtain a neighbor vector set corresponding to the user behavior vector, and an anomaly score between the user behavior vector and the neighbor vector set is calculated. When the anomaly score is greater than a preset threshold, it is determined that the operation behavior of the current user is an abnormal operation behavior. When the anomaly score is less than or equal to the preset threshold, it is determined that the operation behavior of the current user is a normal operation behavior.

[0140] As you can understand, this technical solution aims to accurately detect and identify abnormal user behavior within enterprise intranets. It first structures the operational data, extracts key operational events, and constructs a user operation graph. It then employs the Node2vec graph embedding algorithm combined with the Skip-Gram neural network model to implement a biased random walk strategy, balancing breadth-first and depth-first search. This generates a large number of local behavior sequences within the graph, which can be considered "context." During the anomaly detection phase, the system employs an efficient spatial indexing mechanism based on KD trees to perform k-nearest neighbor searches on user behavior vectors, significantly reducing the time required for anomaly detection. Anomaly scores are calculated based on proximity, with higher scores indicating a greater deviation from normal behavior. When the score exceeds a preset threshold, the behavior is deemed abnormal or potentially malicious, ensuring the security of the business system.

[0141] Corresponding to the aforementioned application function implementation method embodiment, the present application also provides an abnormal behavior detection system, an electronic device and corresponding embodiments.

[0142] Figure 4 This is a structural diagram of an abnormal behavior detection system shown in an embodiment of the present application.

[0143] See also Figure 4 , an abnormal behavior detection system, comprising: Operation data acquisition module 401 is used to acquire the operation data of the current user. The operation data includes multiple operation graph nodes. The operation graph nodes are used to represent the operation behavior of the current user in the business system. The user operation graph generation module 402 is used to construct the connection relationship between the nodes of each operation graph to generate a user operation graph; A user behavior vector generation module 403 is configured to extract a user behavior sequence from a user operation graph using a walk control parameter, and vectorize the user behavior sequence to generate a user behavior vector; The anomaly detection module 404 is configured to perform anomaly detection on the user behavior vector based on the pre-built spatial index tree to obtain a detection result for the current user.

[0144] As an optional example of an embodiment of the present application, the wandering control parameter includes a first wandering control parameter and a second wandering control parameter, and the user behavior vector generation module 403 includes: A random walk path generation submodule, configured to generate a corresponding random walk path by adjusting a first walk control parameter and a second walk control parameter; The user behavior sequence extraction submodule is used to extract user behavior sequences from the user operation graph based on random walk paths; The user behavior vector generation submodule is used to input the user behavior sequence into a pre-trained embedding model, and the embedding model vectorizes the user behavior sequence to generate a user behavior vector.

[0145] As an optional example of an embodiment of the present application, the random walk path generation submodule is used to: By adjusting the value of the first wandering control parameter, a first jump probability of returning from the current node to the last visited node is determined, and the numerical relationship between the first wandering control parameter and the first jump probability is inversely proportional; By adjusting the value of the second wandering control parameter, a second jump probability of jumping from the current node to a node far away from the last visited node is determined, and the numerical relationship between the second wandering control parameter and the second jump probability is inversely proportional; Based on the first jump probability and the second jump probability, a corresponding random walk path is generated.

[0146] As an optional example of an embodiment of the present application, the user behavior sequence extraction submodule is used to: Visit the operation graph nodes in the user operation graph in sequence according to the random walk path, and extract the attribute information associated with the operation graph nodes and the connection relationship between each operation graph node; Combining attribute information and connection relationships into user behavior sequences; The attribute information includes at least the operation type, operation time period and operation host model of the operation behavior, and the connection relationship is an edge relationship obtained based on one or more connections among the operation type, operation time period and operation host model.

[0147] As an optional example of an embodiment of the present application, the training process of the embedding model is as follows: Construct a pre-trained model, a prediction function, and a cross-entropy loss function. The pre-trained model includes at least an input layer, a hidden layer, and an output layer. The input layer is used to represent the central node of the behavior sequence using a one-hot encoding method. The hidden layer is used to map the behavior sequence to a low-dimensional vector space to obtain a behavior vector. The output layer is used to predict the probability distribution corresponding to the central node based on the prediction function. Obtain the historical behavior sequence and determine the central node of the historical behavior sequence and the context node corresponding to the central node; When the pre-trained model is trained using historical behavior sequences, a prediction function is used to calculate the probability distribution between the center node and the context nodes; The loss value between the probability distribution and the true label of the context node is calculated through the cross entropy loss function until the pre-trained model converges to generate an embedding model.

[0148] As an optional example of the embodiment of the present application, the anomaly detection module 404 includes: Vector input submodule, used to input user behavior vectors into the pre-built spatial index tree; A query point determination submodule is used to determine the user behavior vector as the current query point; The neighbor search submodule is used to perform a neighbor search operation on the current query point through the spatial index tree to obtain the neighbor vector set corresponding to the user behavior vector; The anomaly score calculation submodule is used to calculate the anomaly score between the user behavior vector and the set of neighboring vectors; The determination submodule is used to determine that the current user's operation behavior is abnormal when the abnormality score is greater than a preset threshold; and to determine that the current user's operation behavior is normal when the abnormality score is less than or equal to the preset threshold.

[0149] As an optional example of an embodiment of the present application, each internal node in the spatial index tree includes a splitting dimension and a splitting value, and the neighbor search submodule is used to: Starting from the root node of the spatial index tree, recursively enter one of the subtrees of the spatial index tree according to the numerical relationship between the coordinate value of the current query point on the split dimension and the split value of the tree node; Traverse the subtree and record the first candidate node adjacent to the current query point and the first adjacent distance of the first candidate node; Backtrack to the parent node of the first candidate node; If another subtree of the parent node intersects with the hypersphere centered at the current query point and with the first neighbor distance as the radius, traverse the other subtree and record the second candidate node adjacent to the current query point and the second neighbor distance of the second candidate node; The first neighboring distance is compared with the second neighboring distance to determine that the first candidate node or the second candidate node is a neighboring node of the current query point, and vectors corresponding to multiple neighboring nodes constitute a neighboring vector set.

[0150] Regarding the system in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated again here.

[0151] Figure 5 It is a structural diagram of an electronic device shown in an embodiment of the present application.

[0152] See also Figure 5 , the electronic device 500 includes a memory 510 and a processor 520.

[0153] The processor 520 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor. Memory 510 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage. ROM may store static data or instructions required by processor 520 or other computer modules. Permanent storage may be a readable and writable storage device. Permanent storage may be a non-volatile storage device that retains stored instructions and data even when the computer is powered off. In some embodiments, the permanent storage device utilizes a mass storage device (e.g., a magnetic or optical disk, flash memory). In other embodiments, the permanent storage device may be a removable storage device (e.g., a floppy disk, optical drive). System memory may be a readable and writable storage device or a volatile readable and writable storage device, such as dynamic random access memory (DRAM). System memory may store some or all instructions and data required by the processor during operation. Furthermore, memory 510 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (e.g., DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), as well as magnetic disks and / or optical disks. In some embodiments, the memory 510 may include a readable and / or writable removable storage device, such as a compact disc (CD), a read-only digital versatile disc (e.g., DVD-ROM, double-layer DVD-ROM), a read-only Blu-ray disc, an ultra-density optical disc, a flash memory card (e.g., SD card, mini SD card, Micro-SD card, etc.), a magnetic floppy disk, etc. Computer-readable storage media do not include carrier waves and transient electronic signals transmitted wirelessly or wired.

[0154] The memory 510 stores executable codes. When the executable codes are processed by the processor 520 , the processor 520 may execute part or all of the above-mentioned methods.

[0155] In addition, the method according to the present application may also be implemented as a computer program or a computer program product, which includes computer program code instructions for executing some or all of the steps in the above method of the present application.

[0156] Alternatively, the present application can also be implemented as a computer-readable storage medium (or non-transitory machine-readable storage medium or machine-readable storage medium), which stores executable code (or computer program or computer instruction code) and, when executed by a processor of an electronic device (or server, etc.), enables the processor to perform part or all of the steps of the above-mentioned method according to the present application.

[0157] The present application also provides a computer program product, which includes computer instructions, and when the computer instructions are executed by a processor, the method described above is implemented.

[0158] The embodiments of the present application have been described above. The above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to the technology in the market, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting abnormal behavior, characterized in that: include: Acquire operation data of the current user, wherein the operation data includes a plurality of operation graph nodes, and the operation graph nodes are used to represent the operation behavior of the current user in the business system; Build the connection relationship between each operation graph node to generate the user operation graph; extracting a user behavior sequence from the user operation graph using a walk control parameter, and vectorizing the user behavior sequence to generate a user behavior vector; Anomaly detection is performed on the user behavior vector based on a pre-built spatial index tree to obtain a detection result for the current user.

2. The method according to claim 1, characterized in that The wandering control parameters include a first wandering control parameter and a second wandering control parameter. Extracting a user behavior sequence from the user operation graph using the wandering control parameters and vectorizing the user behavior sequence to generate a user behavior vector includes: Generate a corresponding random walk path by adjusting the first walk control parameter and the second walk control parameter; Extracting the user behavior sequence from the user operation graph based on the random walk path; The user behavior sequence is input into a pre-trained embedding model, and the embedding model vectorizes the user behavior sequence to generate the user behavior vector.

3. The method according to claim 2, characterized in that Generating a corresponding random walk path by adjusting the first walk control parameter and the second walk control parameter includes: By adjusting the value of the first wandering control parameter, a first jump probability of returning from the current node to the last visited node is determined, and the numerical relationship between the first wandering control parameter and the first jump probability is inversely proportional; By adjusting the value of the second wandering control parameter, a second jump probability of jumping from the current node to a node far away from the last visited node is determined, and the numerical relationship between the second wandering control parameter and the second jump probability is inversely proportional; Based on the first jump probability and the second jump probability, a corresponding random walk path is generated.

4. The method according to claim 2 or 3, characterized in that The extracting the user behavior sequence from the user operation graph based on the random walk path includes: sequentially accessing the operation graph nodes in the user operation graph according to the random walk path, and extracting attribute information associated with the operation graph nodes and connection relationships between the operation graph nodes; Combining the attribute information and the connection relationship into the user behavior sequence; The attribute information includes at least the operation type, operation time period and operation host model of the operation behavior, and the connection relationship is an edge relationship obtained based on one or more connections of the operation type, the operation time period and the operation host model.

5. The method according to claim 2, characterized in that The training process of the embedding model is as follows: Constructing a pre-training model, a prediction function, and a cross-entropy loss function, wherein the pre-training model includes at least an input layer, a hidden layer, and an output layer; wherein the input layer is used to represent the central node of the behavior sequence by one-hot encoding, the hidden layer is used to map the behavior sequence to a low-dimensional vector space to obtain the behavior vector, and the output layer is used to predict the probability distribution corresponding to the central node based on the prediction function; Obtain a historical behavior sequence, and determine a central node of the historical behavior sequence and a context node corresponding to the central node; When the pre-training model is trained using the historical behavior sequence, the probability distribution between the central node and the context node is calculated using the prediction function; The loss value between the probability distribution and the true label of the context node is calculated by the cross entropy loss function until the pre-trained model converges to generate the embedding model.

6. The method according to claim 1, wherein The performing anomaly detection on the user behavior vector based on the pre-built spatial index tree to obtain a detection result for the current user includes: Inputting the user behavior vector into the pre-built spatial index tree; Determining the user behavior vector as a current query point; Performing a neighbor search operation on the current query point through the spatial index tree to obtain a neighbor vector set corresponding to the user behavior vector; Calculating an anomaly score between the user behavior vector and the set of neighboring vectors; When the abnormality score is greater than a preset threshold, it is determined that the operation behavior of the current user is an abnormal operation behavior; When the abnormality score is less than or equal to the preset threshold, it is determined that the operation behavior of the current user is a normal operation behavior.

7. The method according to claim 6, characterized in that Each internal node in the spatial index tree includes a splitting dimension and a splitting value. The performing of a neighbor search operation on the current query point through the spatial index tree to obtain a neighbor vector set corresponding to the user behavior vector includes: Starting from the root node of the spatial index tree, recursively enter one of the subtrees of the spatial index tree according to the numerical relationship between the coordinate value of the current query point on the splitting dimension and the splitting value of the tree node; Traversing the subtree, recording a first candidate node adjacent to the current query point and a first proximity distance of the first candidate node; Backtrack to the parent node of the first candidate node; If another subtree of the parent node intersects with a hypersphere with the current query point as the center and the first proximity distance as the radius, traverse the other subtree and record a second candidate node adjacent to the current query point and a second proximity distance of the second candidate node; The first neighboring distance is compared with the second neighboring distance to determine that the first candidate node or the second candidate node is a neighboring node of the current query point, and vectors corresponding to multiple neighboring nodes constitute the neighboring vector set.

8. An abnormal behavior detection system, characterized in that: include: An operation data acquisition module is used to acquire the operation data of the current user, wherein the operation data includes a plurality of operation graph nodes, and the operation graph nodes are used to represent the operation behavior of the current user in the business system; A user operation graph generation module is used to construct the connection relationship between each operation graph node and generate a user operation graph; A user behavior vector generation module is configured to extract a user behavior sequence from the user operation graph using a walk control parameter, and vectorize the user behavior sequence to generate a user behavior vector; The anomaly detection module is used to perform anomaly detection on the user behavior vector based on a pre-built spatial index tree to obtain a detection result for the current user.

9. An electronic device, characterized in that: include: processor; as well as A memory having executable codes stored thereon, which, when executed by the processor, causes the processor to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable codes stored thereon, wherein when the executable codes are executed by a processor of an electronic device, the processor is caused to execute the method according to any one of claims 1 to 7.

Images