Abnormal operation behavior analysis method and system based on service behavior distribution

Abstract

The invention provides an abnormal operation behavior analysis method and system based on business behavior distribution, and the method comprises the steps: obtaining historical business data of a business department to which a target user belongs, and carrying out the vectorization processing of each business operation, and obtaining a corresponding operation vector; identifying a service operation category for each service vector by adopting a classification model, constructing a prediction vector based on a first preset number of service operation categories before the service operation of the target user, and predicting the operation category of the service operation of the target user based on the prediction vector; calculating an initial abnormal value of the actual business operation of the target user based on the prediction result; determining a category related weight based on the operation category of the actual business operation of the target user and the operation category of the prediction result, and calculating an operation abnormal value; calculating a predicted abnormal value based on the operation abnormal value, and constructing a dynamic baseline based on the predicted abnormal value corresponding to the service operation; and judging whether the user is an abnormal user based on the dynamic baseline.

Description

Technical Field

[0001] The present invention relates to the technical field of smart power plants, and in particular to a method and system for analyzing abnormal operation behavior based on business behavior distribution. Background Art

[0002] In the operation and management of smart power plants, identifying abnormal operations in business data, particularly monitoring network intrusions and non-compliant actions, and employing artificial intelligence (AI) for intelligent analysis have become core tools for ensuring safe and stable power plant operations, preventing potential risks, and maintaining data integrity and compliance. The importance of this innovative practice lies not only in its accurate identification and rapid response to immediate security threats, but also in its profound impact on optimizing power plant long-term operational strategies, enhancing data asset protection capabilities, and improving industry compliance.

[0003] First, from the perspective of power plant security, as a highly information-based industrial system, smart power plants generate business data covering multiple key areas, including equipment operation, energy management, and environmental monitoring. The security of this data is directly related to the operational efficiency and stability of the power plant. Network intrusions, such as hacker attacks and malware injection, can not only lead to data leaks and equipment loss of control, but can also trigger chain reactions and cause serious safety incidents. AI technology, through deep learning algorithms, can extract network behavior characteristics from massive amounts of business data and build efficient anomaly detection models. Once abnormal network activity is detected, such as unauthorized access attempts and abnormal data transmission, the AI ​​system can immediately issue an early warning, providing the power plant's cybersecurity team with an opportunity to intervene promptly, effectively blocking the attack path and protecting the power plant from cyber threats.

[0004] Secondly, AI-enabled identification of network intrusions and handling of violations is crucial for maintaining power plant data integrity and compliance. In smart power plants, the accuracy and integrity of business data are fundamental to ensuring scientific decision-making and efficient operations. Network intrusions are often accompanied by data tampering, deletion, or theft, which not only undermines data authenticity but also potentially impacts the normal operation of the power plant. AI technology can monitor data access and modification behavior in real time, comparing it to pre-set compliance standards. Once abnormal operations are detected, such as unauthorized data modification or sensitive data leakage, an alarm is immediately triggered, prompting the power plant to take emergency measures to restore data integrity and ensure business continuity.

[0005] However, existing AI recognition often only analyzes historical data of a single user to determine whether subsequent business operations are abnormal, and the accuracy is insufficient.

[0006] In view of this, the present invention is proposed. Summary of the Invention

[0007] The purpose of the present invention is to provide a method and system for analyzing abnormal operation behavior based on business behavior distribution. This solution first calculates the initial abnormal value, then calculates the operation abnormal value by the relevant weight calculated with other user data, and combines the data of other users and the user's own data to determine whether the user is abnormal.

[0008] The present invention provides a method for analyzing abnormal operation behavior based on business behavior distribution, the method comprising the following steps:

[0009] Obtain the business department to which the target user belongs, call the historical business data of the business department, vectorize each business operation in the historical business data, and obtain the operation vector corresponding to each business operation;

[0010] Using a classification model to identify a business operation category for each business vector, constructing a prediction vector based on a first preset number of business operation categories before the target user's business operation, and predicting the operation category of the target user's business operation based on the prediction vector;

[0011] Calculate the initial abnormal value of the target user's actual business operation based on the predicted probability value of each operation category and the operation category of the target user's actual business operation;

[0012] Determine the category-related weight based on the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value, and calculate the operation anomaly value based on the category-related weight and the initial anomaly value;

[0013] Calculating a predicted abnormal value based on the abnormal values ​​of the first preset number of business operations of the target user in the historical business data, and building a dynamic baseline for the target user based on the predicted abnormal value corresponding to each business operation of the target user;

[0014] The actual operation abnormality values ​​of multiple business operations of the target user are compared with the dynamic baseline to determine whether the user is an abnormal user.

[0015] Adopting the above scheme, this scheme first uses a preset classification model to classify the operation category of each business operation in a department, and calculates the initial anomaly value of the actual business operation based on the predicted probability of each operation category. This step calculates the initial anomaly value based on the principle that the higher the consistency between the predicted operation and the actual operation, the lower the possibility of an anomaly, and preliminarily determines the abnormality of the operation. Since operations of operation categories with high operation correlation are easy to replace, this scheme further determines the relevant weights based on the correlation of the operation categories, and calculates the operation anomaly value again in combination with the data of other users to ensure the accuracy of the operation anomaly value calculation. In the final judgment step, a dynamic baseline is constructed by predicting the operation anomaly values ​​of multiple operations, and compared with the actual operation anomaly value to ensure the accuracy of the user's anomaly judgment.

[0016] In some embodiments of the present invention, in the step of constructing a prediction vector based on a first preset number of business operation categories before the target user's business operation, the corresponding category code is determined based on the category of the business operation, and the category codes corresponding to the first preset number of business operation categories before the target user's business operation are sequentially connected to obtain a prediction vector.

[0017] In some embodiments of the present invention, in the step of predicting the operation category of the target user's business operation based on the prediction vector, a preset convolutional neural network model is used for prediction. The convolutional neural network includes multiple convolutional layers and classification layers, and the last classification layer outputs the predicted value of the probability value of the next business operation for each operation category.

[0018] In some embodiments of the present invention, the step of calculating the initial abnormal value of the target user's actual business operation based on the predicted probability value of each operation category and the operation category of the target user's actual business operation includes:

[0019] Based on the predicted probability values ​​of the various operation categories, the operation categories corresponding to the largest second predetermined number of probability values ​​are selected to form an operation group;

[0020] Determine whether the operation category of the target user's actual business operation belongs to the operation category in the operation group;

[0021] If yes, then calculate the initial outlier value based on the probability value corresponding to the operation category;

[0022] If it does not belong to, the preset initial value is used to calculate the initial abnormal value.

[0023] Using the above scheme, this scheme first predicts subsequent data operations through a convolutional neural network model, calculates the initial anomaly value by comparing the operation category of the predicted business operation with the operation category of the target user's actual business operation, and preliminarily determines the abnormality of the user's operation. Based on the principle that each user in the same department needs to have a unified logical chain for the business, the abnormality of the user's single operation is determined.

[0024] In some embodiments of the present invention, in the step of calculating the initial outlier value based on the probability value corresponding to the operation category or using a preset initial value to calculate the initial outlier value, the following formula is used to calculate the initial outlier value:

[0025]

[0026] Wherein, τ1 represents the initial abnormal value, α represents the probability value or the preset initial value, and σ represents the preset calculation constant.

[0027] Using the above scheme, if the operation category of the target user's actual business operation is in the operation group, the initial outlier value is calculated using the corresponding probability value. The larger the probability value, the more consistent it is with the predicted business operation. Therefore, during the calculation process, the larger the probability value, the smaller the calculated initial outlier value, ensuring calculation accuracy.

[0028] In some embodiments of the present invention, the first calculation method and the second calculation method are used in the step of determining the category-related weight based on the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value:

[0029] The first calculation method is to read the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value from a preset comparison table to determine the category-related weight;

[0030] Second calculation method: using a preset correlation calculation model to calculate the correlation between the operation vector of the target user's actual business operation and the preset standard category vector corresponding to the operation category with the maximum probability value, and determining the correlation weight based on the correlation.

[0031] Using the above scheme, this scheme calculates the category-related weights in two ways. The category-related weights represent the degree of correlation between the actual business operation and the operation category corresponding to the maximum probability value. It can further reflect the abnormal value of the user operation through the difference between the actual business operation and the operation category corresponding to the maximum probability value, thereby ensuring the calculation accuracy.

[0032] In some embodiments of the present invention, in the step of using a preset correlation calculation model to calculate the correlation between the operation vector of the target user's actual business operation and the preset standard category vector of the operation category corresponding to the maximum probability value, if the second calculation method is adopted, a calculation model with a convolutional neural network structure is used as the correlation calculation model, or the Euclidean distance algorithm, Mahalanobis distance algorithm or Manhattan distance algorithm is used to construct the correlation calculation model.

[0033] In some embodiments of the present invention, the inverse of the correlation is calculated as the correlation weight. In the step of calculating the operation outlier value based on the category correlation weight and the initial outlier value, the operation outlier value is calculated using the following formula:

[0034]

[0035] Among them, T2 represents the operational outlier, D represents the correlation, and τ1 represents the initial outlier.

[0036] In some embodiments of the present invention, in the step of calculating the predicted abnormal value based on the operation abnormal values ​​corresponding to the first preset number of business operations before the target user's business operation in the historical business data, the operation abnormal value corresponding to the first preset number of business operations before the target user's business operation in the historical business data is constructed as an input vector and input into a preset long short-term memory network model (LSTM). The long short-term memory network model outputs the predicted abnormal value to determine the corresponding predicted abnormal value of the target user's business operation.

[0037] With the above scheme, since the previous operations of the target user's business operations often have an impact on the subsequent operations, this scheme calculates the operation anomaly value for the previous operation in the same way, and calculates the predicted anomaly value for the subsequent operation based on the operation anomaly value of the previous operation. The user's abnormality degree is determined based on the relative difference between the predicted anomaly value and the actual anomaly value, rather than simply determining the user's abnormality degree by the size of the anomaly value, thereby ensuring the accuracy of user anomaly determination.

[0038] In some embodiments of the present invention, in the step of constructing a dynamic baseline of the target user based on the predicted outlier values ​​corresponding to each business operation of the target user, the order of the predicted outlier values ​​is determined based on the timing of the target user's business operations, and the predicted outlier values ​​are sequentially connected in a coordinate system to construct the dynamic baseline of the target user.

[0039] In some embodiments of the present invention, in the step of comparing the actual operation abnormality values ​​of multiple business operations of the target user with the dynamic baseline to determine whether the user is an abnormal user:

[0040] The coverage of the dynamic baseline will be determined based on a preset fluctuation range;

[0041] An actual change curve is constructed based on the actual operation abnormality value of the target user's business operation, and the area value of the range enclosed by the actual change curve above the dynamic baseline and the coverage range of the dynamic baseline is calculated. Based on the area value, it is determined whether the user is an abnormal user.

[0042] By adopting the above scheme, the range of the dynamic baseline is determined by the preset fluctuation range. When the actual operation abnormal value of the target user's business operation exceeds the coverage range, there may be certain abnormalities, ensuring accurate group judgment of abnormal users.

[0043] In some embodiments of the present invention, if the target user is an abnormal user, the method further includes:

[0044] Determine whether the target user is an outlier user based on the proportion of business operations of users other than the target user in each operation category in the historical business data of the business department and the proportion of business operations of the target user in each operation category in the historical business data of the business department;

[0045] If the target user is an abnormal user and not an outlier user, a user warning will be issued based on the target user.

[0046] The above scheme is adopted. First, it is based on the principle that the work of users in the same department has the characteristics of assembly line work. Each user in the same department needs to have a unified logical chain for the business. By determining whether the user's operation is on the logical chain, if the user is invaded in the middle and there is a situation of jumping out of the logical chain, it is determined whether it is an abnormal user; and because even users in the same department may have individual outliers, the outlier users often have a different working logic from other users in the same department from the beginning. Therefore, after determining the abnormal user, this scheme further determines whether the user is an outlier user through all the user's data to avoid misjudgment of outlier users.

[0047] In some embodiments of the present invention, in the step of determining whether the target user is an outlier user based on the proportion of business operations of users other than the target user in the business operations of each operation category in the historical business data of the business department and the proportion of business operations of the target user in the business operations of each operation category in the historical business data of the business department:

[0048] Based on the business operations of users other than the target user in the historical business data of the business department, the proportion of business operations in each operation category is counted to obtain a first proportion sequence;

[0049] Based on the target user's business operations in the target time period, the proportion of business operations of each operation category is counted to obtain a second proportion sequence;

[0050] The user outlier degree is determined based on the first proportion sequence and the second proportion sequence, and whether the user is an outlier user is determined based on the user outlier degree.

[0051] In some embodiments of the present invention, in the step of determining the user outlier degree based on the first proportion sequence and the second proportion sequence, the difference value of each operation category is calculated based on the corresponding value of each operation category in the first proportion sequence and the second proportion sequence, a difference sequence is constructed based on the difference values ​​of each operation category, and the user outlier degree is calculated based on the difference sequence.

[0052] On the other hand, the present invention also relates to an abnormal operation behavior analysis system based on business behavior distribution, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps implemented by the method.

[0053] In summary, the present invention has the following beneficial effects:

[0054] 1. This solution first uses a preset classification model to classify each business operation in a department, and calculates the initial anomaly value of the actual business operation based on the predicted probability of each operation category. This step calculates the initial anomaly value based on the principle that the higher the consistency between the predicted operation and the actual operation, the lower the possibility of an anomaly. The abnormality of the operation is preliminarily determined. Since operations in operation categories with high operational relevance are easy to replace, this solution further determines the relevant weights based on the relevance of the operation categories. The operation anomaly value is calculated again in combination with the data of other users to ensure the accuracy of the operation anomaly value calculation. In the final judgment step, a dynamic baseline is constructed by using the predicted operation anomaly values ​​of multiple operations and compared with the actual operation anomaly value to ensure the accuracy of the user's anomaly judgment.

[0055] 2. This solution first uses a convolutional neural network model to predict subsequent data operations. It then calculates an initial outlier value based on the predicted business operation category and the target user's actual business operation category. This preliminarily determines the degree of abnormality in the user's operation. Based on the principle that all users in the same department need to have a unified logical chain for their operations, the degree of abnormality in a single user operation is determined.

[0056] 3. Because the previous operations of the target user's business operations often have an impact on subsequent operations, this solution uses the same method to calculate the operation anomaly value for the previous operation, and calculates the predicted anomaly value for the subsequent operation based on the operation anomaly value of the previous operation. The user's anomaly degree is determined based on the relative difference between the predicted anomaly value and the actual anomaly value, rather than simply judging the user's anomaly degree based on the size of the anomaly value, ensuring the accuracy of user anomaly determination;

[0057] 4. This solution is based on the principle that users in the same department work in a pipeline manner. Users in the same department need to have a unified logical chain for their business. By determining whether the user's operation is on the logical chain, if the user is invaded midway and there is a situation of jumping out of the logical chain, it is determined whether the user is an abnormal user. Since even users in the same department may have individual outliers, the outlier user often has a different working logic from other users in the same department from the beginning. Therefore, after determining the abnormal user, this solution further determines whether the user is an outlier user through all the user's data to avoid misjudgment of outlier users. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0059] Figure 1 Schematic diagram of a first embodiment of the abnormal operation behavior analysis method based on business behavior distribution of the present invention;

[0060] Figure 2 Schematic diagram of a second embodiment of the abnormal operation behavior analysis method based on business behavior distribution of the present invention;

[0061] Figure 3 This is a schematic diagram of the steps of step S300 in this solution;

[0062] Figure 4 Schematic diagram of an expanded step of step S600 of the first embodiment of the present invention;

[0063] Figure 5 This is a schematic diagram of the steps after identifying abnormal users in this solution. DETAILED DESCRIPTION

[0064] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of systems and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0065] The terms used in this invention are for the purpose of describing specific embodiments only and are not intended to limit the invention. The singular forms "a," "the," and "the" used in this invention and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0066] like Figure 1 As shown, the present invention provides a method for analyzing abnormal operation behavior based on business behavior distribution, the method comprising the following steps:

[0067] Step Si00: Obtain the business department to which the target user belongs, call the historical business data of the business department, perform vectorization processing on each business operation in the historical business data, and obtain the operation vector corresponding to each business operation;

[0068] In some embodiments of the present invention, in the step of vectorizing each business operation of historical business data, the business operation is vectorized using a BERT or RoBERTa model.

[0069] Step S200 , using a classification model to identify a business operation category for each business vector, constructing a prediction vector based on a first preset number of business operation categories before the target user's business operation, and predicting the operation category of the target user's business operation based on the prediction vector;

[0070] In the specific implementation process, the classification model adopts a multi-layer perceptron, a convolutional neural network or a recurrent neural network model;

[0071] Multilayer Perceptron (MLP): A fully connected neural network that can handle nonlinear classification tasks.

[0072] Convolutional Neural Network (CNN): It extracts spatial features through convolution kernels and is good at image classification (such as ResNet's performance in the ImageNet competition).

[0073] Recurrent Neural Network (RNN): Processes sequential data, such as LSTM and GRU for text sentiment classification or time series prediction. It can capture temporal dependencies.

[0074] In some embodiments of the present invention, the business operation categories include data collection, monitoring, database management, data analysis and optimization, data interaction and sharing, and process management and compliance operations;

[0075] Specific examples:

[0076] Data acquisition operations collect operating parameters (such as temperature, pressure, and vibration) of generator sets and power transmission and transformation equipment through sensors and SCADA systems. Examples include boiler system data collection in coal-fired power plants and real-time wind power monitoring in wind farms.

[0077] Monitoring operations include recording the operator's manual control instructions and operation history for the equipment, such as unit start and stop, valve adjustment, etc.

[0078] Database management operations include using database systems such as SQL Server to store structured data (such as equipment parameters and production logs); regularly transferring historical data to a backup server; and filtering outliers and unifying the format of collected raw data, such as eliminating sensor noise interference.

[0079] Data analysis and optimization operations include analyzing equipment operating status through big data to predict vibration failures or energy efficiency losses of generator sets, for example, using the TDM system to monitor turbine vibration trends; and building prediction models (such as LSTM and ARIMA) based on historical load data to optimize power generation plans and grid scheduling.

[0080] Data interaction and sharing operations include connecting power plant data to the grid dispatching system (such as AGC automatic power generation control) and third-party supervision platforms; as well as integrating data from the production control area and management information area to build a plant-level monitoring information system.

[0081] Process management and compliance operations include formulating data labeling rules and processing procedures based on the "Electric Power Industry Data Classification and Grading Specifications"; and regularly verifying whether data operations comply with regulations such as the "Basic Requirements for Network Security Level Protection".

[0082] Step S300 , calculating an initial abnormal value of the target user's actual business operation based on the predicted probability value of each operation category and the operation category of the target user's actual business operation;

[0083] Step S400 , determining a category-related weight based on the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value, and calculating an operation anomaly value based on the category-related weight and the initial anomaly value;

[0084] Step S500, calculating a predicted abnormal value based on the operation abnormal values ​​corresponding to a first preset number of business operations of the target user before the business operation in the historical business data, and building a dynamic baseline for the target user based on the predicted abnormal value corresponding to each business operation of the target user;

[0085] Step S600 : comparing actual abnormal operation values ​​of multiple business operations of the target user with the dynamic baseline to determine whether the user is an abnormal user.

[0086] Adopting the above scheme, this scheme first uses a preset classification model to classify the operation category of each business operation in a department, and calculates the initial anomaly value of the actual business operation based on the predicted probability of each operation category. This step calculates the initial anomaly value based on the principle that the higher the consistency between the predicted operation and the actual operation, the lower the possibility of an anomaly, and preliminarily determines the abnormality of the operation. Since operations of operation categories with high operation correlation are easy to replace, this scheme further determines the relevant weights based on the correlation of the operation categories, and calculates the operation anomaly value again in combination with the data of other users to ensure the accuracy of the operation anomaly value calculation. In the final judgment step, a dynamic baseline is constructed by predicting the operation anomaly values ​​of multiple operations, and compared with the actual operation anomaly value to ensure the accuracy of the user's anomaly judgment.

[0087] In some embodiments of the present invention, in the step of constructing a prediction vector based on a first preset number of business operation categories before the target user's business operation, the corresponding category code is determined based on the category of the business operation, and the category codes corresponding to the first preset number of business operation categories before the target user's business operation are sequentially connected to obtain a prediction vector.

[0088] In some embodiments of the present invention, when determining the corresponding category code based on the category of the business operation, the BERT or RoBERTa model is also used to perform vectorization processing to obtain the category code.

[0089] In some embodiments of the present invention, in the step of predicting the operation category of the target user's business operation based on the prediction vector, a preset convolutional neural network model is used for prediction. The convolutional neural network includes multiple convolutional layers and classification layers, and the last classification layer outputs the predicted value of the probability value of the next business operation for each operation category.

[0090] like Figure 3 As shown, in some embodiments of the present invention, the step of calculating the initial abnormal value of the target user's actual business operation based on the predicted probability value of each operation category and the operation category of the target user's actual business operation includes:

[0091] During the specific implementation process, the operation category of the actual business operation of the target user is also vectorized, and each business vector is classified using a classification model.

[0092] Step S310 , selecting operation categories corresponding to the largest second predetermined number of probability values ​​based on the predicted probability values ​​of the various operation categories, and constructing an operation group;

[0093] Step S320, determining whether the operation category of the target user's actual business operation belongs to the operation category in the operation group;

[0094] Step S331: If yes, calculate the initial outlier value based on the probability value corresponding to the operation category;

[0095] Step S332: If it does not belong to, the initial abnormal value is calculated using the preset initial value.

[0096] Using the above scheme, this scheme first predicts subsequent data operations through a convolutional neural network model, calculates the initial anomaly value by comparing the operation category of the predicted business operation with the operation category of the target user's actual business operation, and preliminarily determines the abnormality of the user's operation. Based on the principle that each user in the same department needs to have a unified logical chain for the business, the abnormality of the user's single operation is determined.

[0097] In some embodiments of the present invention, in the step of calculating the initial outlier value based on the probability value corresponding to the operation category or using a preset initial value to calculate the initial outlier value, the following formula is used to calculate the initial outlier value:

[0098]

[0099] Wherein, τ1 represents the initial abnormal value, α represents the probability value or the preset initial value, and σ represents the preset calculation constant.

[0100] Using the above scheme, if the operation category of the target user's actual business operation is in the operation group, the initial outlier value is calculated using the corresponding probability value. The larger the probability value, the more consistent it is with the predicted business operation. Therefore, during the calculation process, the larger the probability value, the smaller the calculated initial outlier value, ensuring calculation accuracy.

[0101] In some embodiments of the present invention, the first calculation method and the second calculation method are used in the step of determining the category-related weight based on the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value:

[0102] The first calculation method is to read the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value from a preset comparison table to determine the category-related weight;

[0103] In the specific implementation process, the horizontal and vertical headers in the preset comparison table are all in the same order to mark the prohibited operation types, and the intersection position of the row and column is the corresponding relevant weight.

[0104] Second calculation method: using a preset correlation calculation model to calculate the correlation between the operation vector of the target user's actual business operation and the preset standard category vector corresponding to the operation category with the maximum probability value, and determining the correlation weight based on the correlation.

[0105] In a specific implementation process, the correlation calculation model may adopt a convolutional neural network model, which includes an input layer, a convolution layer, a pooling layer and a fully connected layer.

[0106] Using the above scheme, this scheme calculates the category-related weights in two ways. The category-related weights represent the degree of correlation between the actual business operation and the operation category corresponding to the maximum probability value. It can further reflect the abnormal value of the user operation through the difference between the actual business operation and the operation category corresponding to the maximum probability value, thereby ensuring the calculation accuracy.

[0107] In some embodiments of the present invention, in the step of using a preset correlation calculation model to calculate the correlation between the operation vector of the target user's actual business operation and the preset standard category vector of the operation category corresponding to the maximum probability value, if the second calculation method is adopted, a calculation model with a convolutional neural network structure is used as the correlation calculation model, or the Euclidean distance algorithm, Mahalanobis distance algorithm or Manhattan distance algorithm is used to construct the correlation calculation model.

[0108] Specifically, when the Euclidean distance algorithm, the Mahalanobis distance algorithm, or the Manhattan distance algorithm is used to construct a correlation calculation model, the smaller the distance value, the higher the correlation;

[0109] Euclidean Distance

[0110] Definition: The straight-line distance between two points in multidimensional space is calculated as the square root of the sum of the squares of the differences in each dimension.

[0111] Manhattan Distance

[0112] Definition: The sum of the absolute values ​​of the differences in each dimension, reflecting the actual distance of the urban street path;

[0113] Mahalanobis Distance

[0114] Definition: Standardized distance based on the data covariance matrix, eliminating the correlation and dimension effects between variables.

[0115] In some embodiments of the present invention, the inverse of the correlation is calculated as the correlation weight. In the step of calculating the operation outlier value based on the category correlation weight and the initial outlier value, the operation outlier value is calculated using the following formula:

[0116]

[0117] Among them, τ2 represents the operational outlier, D represents the correlation, and τ1 represents the initial outlier.

[0118] In some embodiments of the present invention, in the step of calculating the predicted abnormal value based on the operation abnormal values ​​corresponding to the first preset number of business operations before the target user's business operation in the historical business data, the operation abnormal value corresponding to the first preset number of business operations before the target user's business operation in the historical business data is constructed as an input vector and input into a preset long short-term memory network model (LSTM). The long short-term memory network model outputs the predicted abnormal value to determine the corresponding predicted abnormal value of the target user's business operation.

[0119] With the above scheme, since the previous operations of the target user's business operations often have an impact on the subsequent operations, this scheme calculates the operation anomaly value for the previous operation in the same way, and calculates the predicted anomaly value for the subsequent operation based on the operation anomaly value of the previous operation. The user's abnormality degree is determined based on the relative difference between the predicted anomaly value and the actual anomaly value, rather than simply determining the user's abnormality degree by the size of the anomaly value, thereby ensuring the accuracy of user anomaly determination.

[0120] In some embodiments of the present invention, in the step of constructing a dynamic baseline of the target user based on the predicted outlier values ​​corresponding to each business operation of the target user, the order of the predicted outlier values ​​is determined based on the timing of the target user's business operations, and the predicted outlier values ​​are sequentially connected in a coordinate system to construct the dynamic baseline of the target user.

[0121] like Figure 4 As shown, in some embodiments of the present invention, in the step of comparing the actual operation abnormality values ​​of multiple business operations of the target user with the dynamic baseline to determine whether the user is an abnormal user:

[0122] Step S610, determining the coverage range of the dynamic baseline based on a preset fluctuation range;

[0123] In a specific implementation process, the fluctuation range is the range of each point of the dynamic baseline extending upward. Specifically, it is the height difference set based on actual conditions, and the height of the fluctuation range is extended upward from the position of the original point.

[0124] Step S620: construct an actual change curve based on the actual operation abnormality value of the target user's business operation, calculate the area value of the range enclosed by the actual change curve above the dynamic baseline and the coverage range of the dynamic baseline, and determine whether the user is an abnormal user based on the area value.

[0125] In a specific implementation process, in the step of determining whether the user is an abnormal user based on the area value, if the area value is greater than a preset area threshold, the high-target user is an abnormal user.

[0126] Specifically, in the step of calculating the area value of the range enclosed by the actual change curve above the dynamic baseline and the coverage range of the dynamic baseline, the two-dimensional coordinate system where the dynamic baseline is located is evenly divided into rectangles of unit area, and the total area of ​​the abnormal area is determined based on the number of rectangles covered by the actual change curve above the dynamic baseline and the coverage range of the dynamic baseline.

[0127] By adopting the above scheme, the range of the dynamic baseline is determined by the preset fluctuation range. When the actual operation abnormal value of the target user's business operation exceeds the coverage range, there may be certain abnormalities, ensuring accurate group judgment of abnormal users.

[0128] like Figure 2 As shown, in some embodiments of the present invention, if the target user is an abnormal user, the method further includes:

[0129] Step S700 , determining whether the target user is an outlier user based on the proportion of business operations of users other than the target user in the business operations of each operation category in the historical business data of the business department and the proportion of business operations of the target user in the business operations of each operation category in the historical business data of the business department;

[0130] Step S800: If the target user is an abnormal user and not an outlier user, a user warning is issued based on the target user.

[0131] During the specific implementation process, the user warning method can be to send a message to the management party's mobile terminal through the network.

[0132] The above scheme is adopted. First, it is based on the principle that the work of users in the same department has the characteristics of assembly line work. Each user in the same department needs to have a unified logical chain for the business. By determining whether the user's operation is on the logical chain, if the user is invaded in the middle and there is a situation of jumping out of the logical chain, it is determined whether it is an abnormal user; and because even users in the same department may have individual outliers, the outlier users often have a different working logic from other users in the same department from the beginning. Therefore, after determining the abnormal user, this scheme further determines whether the user is an outlier user through all the user's data to avoid misjudgment of outlier users.

[0133] like Figure 5 As shown, in some embodiments of the present invention, in the step of determining whether the target user is an outlier user based on the proportion of business operations of users other than the target user in the business operations of each operation category in the historical business data of the business department and the proportion of business operations of the target user in the business operations of each operation category in the historical business data of the business department:

[0134] Step S710 , calculating the proportion of business operations in each operation category based on the business operations of users other than the target user in the historical business data of the business department, and obtaining a first proportion sequence;

[0135] Step S720: Counting the proportion of business operations of each operation category based on the business operations of the target user in the target time period to obtain a second proportion sequence;

[0136] In a specific implementation process, the order of the corresponding operation categories in the first proportion sequence and the second proportion sequence is the same.

[0137] Step S730: determining the user outlier degree based on the first proportion sequence and the second proportion sequence, and determining whether the user is an outlier user based on the user outlier degree.

[0138] In some embodiments of the present invention, in the step of determining the user outlier degree based on the first proportion sequence and the second proportion sequence, the difference value of each operation category is calculated based on the corresponding value of each operation category in the first proportion sequence and the second proportion sequence, a difference sequence is constructed based on the difference values ​​of each operation category, and the user outlier degree is calculated based on the difference sequence.

[0139] During the specific implementation process, in the step of calculating the difference value of each operation category based on the corresponding value of each operation category in the first proportion sequence and the second proportion sequence, the difference between the corresponding values ​​of two operations in the first proportion sequence and the second proportion sequence is calculated, and the absolute value is calculated as the difference value.

[0140] An embodiment of the present invention also provides an abnormal operation behavior analysis system based on business behavior distribution, the system including a computer device, the computer device including a processor and a memory, the memory storing computer instructions, the processor being used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the system implements the steps implemented by the method.

[0141] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the aforementioned abnormal operation behavior analysis system based on business behavior distribution. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0142] It should be understood by those skilled in the art that the various exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0143] It should be understood that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated. Those skilled in the art may make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present invention.

[0144] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0145] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations to the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A method for analyzing abnormal operation behavior based on business behavior distribution, characterized in that: The steps of the method include: Obtain the business department to which the target user belongs, call the historical business data of the business department, vectorize each business operation in the historical business data, and obtain the operation vector corresponding to each business operation; Using a classification model to identify a business operation category for each business vector, constructing a prediction vector based on a first preset number of business operation categories before the target user's business operation, and predicting the operation category of the target user's business operation based on the prediction vector; Calculate the initial abnormal value of the target user's actual business operation based on the predicted probability value of each operation category and the operation category of the target user's actual business operation; Determine the category-related weight based on the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value, and calculate the operation anomaly value based on the category-related weight and the initial anomaly value; Calculating a predicted abnormal value based on the abnormal values ​​of the first preset number of business operations of the target user in the historical business data, and building a dynamic baseline for the target user based on the predicted abnormal value corresponding to each business operation of the target user; The actual operation abnormality values ​​of multiple business operations of the target user are compared with the dynamic baseline to determine whether the user is an abnormal user.

2. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 is characterized in that: If the target user is an abnormal user, the method further includes: Determine whether the target user is an outlier user based on the proportion of business operations of users other than the target user in each operation category in the historical business data of the business department and the proportion of business operations of the target user in each operation category in the historical business data of the business department; If the target user is an abnormal user and not an outlier user, a user warning will be issued based on the target user.

3. The abnormal operation behavior analysis method based on business behavior distribution according to claim 2 is characterized in that: In the step of determining whether a target user is an outlier user based on the proportion of business operations of users other than the target user in each operation category in the business department's historical business data and the proportion of business operations of the target user in each operation category in the business department's historical business data: Based on the business operations of users other than the target user in the historical business data of the business department, the proportion of business operations in each operation category is counted to obtain a first proportion sequence; Based on the target user's business operations in the target time period, the proportion of business operations of each operation category is counted to obtain a second proportion sequence; The user outlier degree is determined based on the first proportion sequence and the second proportion sequence, and whether the user is an outlier user is determined based on the user outlier degree.

4. The abnormal operation behavior analysis method based on business behavior distribution according to claim 3 is characterized in that: In the step of determining the user outlier degree based on the first proportion sequence and the second proportion sequence, the difference value of each operation category is calculated based on the corresponding value of each operation category in the first proportion sequence and the second proportion sequence, a difference sequence is constructed based on the difference values ​​of each operation category, and the user outlier degree is calculated based on the difference sequence.

5. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 or 2 is characterized in that: In the step of constructing a prediction vector based on a first preset number of business operation categories before the target user's business operation, a corresponding category code is determined based on the category of the business operation, and the category codes corresponding to the first preset number of business operation categories before the target user's business operation are sequentially connected to obtain a prediction vector.

6. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 is characterized in that: In the step of predicting the operation category of the target user's business operation based on the prediction vector, a preset convolutional neural network model is used for prediction. The convolutional neural network includes multiple convolution layers and classification layers, and the last classification layer outputs the predicted value of the probability value of the next business operation for each operation category.

7. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 is characterized in that: The step of calculating the initial abnormal value of the target user's actual business operation based on the predicted probability value of each operation category and the operation category of the target user's actual business operation includes: Based on the predicted probability values ​​of the various operation categories, the operation categories corresponding to the largest second predetermined number of probability values ​​are selected to form an operation group; Determine whether the operation category of the target user's actual business operation belongs to the operation category in the operation group; If yes, then calculate the initial outlier value based on the probability value corresponding to the operation category; If it does not belong to, the preset initial value is used to calculate the initial abnormal value.

8. The abnormal operation behavior analysis method based on business behavior distribution according to claim 7 is characterized in that: In the step of calculating the initial outlier value based on the probability value corresponding to the operation category or using a preset initial value to calculate the initial outlier value, the following formula is used to calculate the initial outlier value: Wherein, τ1 represents the initial abnormal value, α represents the probability value or the preset initial value, and σ represents the preset calculation constant.

9. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 is characterized in that: In the step of determining the category-related weight based on the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value, the first calculation method and the second calculation method are used: The first calculation method is to read the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value from a preset comparison table to determine the category-related weight; Second calculation method: using a preset correlation calculation model to calculate the correlation between the operation vector of the target user's actual business operation and the preset standard category vector corresponding to the operation category with the maximum probability value, and determining the correlation weight based on the correlation.

10. The abnormal operation behavior analysis method based on business behavior distribution according to claim 9 is characterized in that: In the step of using a preset correlation calculation model to calculate the correlation between the operation vector of the target user's actual business operation and the preset standard category vector of the operation category corresponding to the maximum probability value, if the second calculation method is adopted, a calculation model with a convolutional neural network structure is used as the correlation calculation model, or the Euclidean distance algorithm, Mahalanobis distance algorithm or Manhattan distance algorithm is used to construct the correlation calculation model.

11. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 or 8, characterized in that: The inverse of the correlation is calculated as the correlation weight. In the step of calculating the operation outlier value based on the category correlation weight and the initial outlier value, the operation outlier value is calculated using the following formula: Among them, τ2 represents the operational outlier, D represents the correlation, and τ1 represents the initial outlier.

12. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 is characterized in that: In the step of calculating the predicted abnormal value based on the operation abnormal values ​​corresponding to the first preset number of business operations before the business operation of the target user in the historical business data, the operation abnormal values ​​corresponding to the first preset number of business operations before the business operation of the target user in the historical business data are constructed as an input vector and input into a preset long short-term memory network model. The long short-term memory network model outputs the predicted abnormal value to determine the corresponding predicted abnormal value of the business operation of the target user.

13. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 is characterized in that: In the step of constructing a dynamic baseline of the target user based on the predicted outlier values ​​corresponding to each business operation of the target user, the order of the predicted outliers is determined based on the timing of the business operations of the target user, and the predicted outliers are sequentially connected in a coordinate system to construct the dynamic baseline of the target user.

14. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 is characterized in that: In the step of comparing the actual operation abnormality values ​​of the target user's multiple business operations with the dynamic baseline to determine whether the user is an abnormal user: The coverage of the dynamic baseline will be determined based on a preset fluctuation range; An actual change curve is constructed based on the actual operation abnormality value of the target user's business operation, and the area value of the range enclosed by the actual change curve above the dynamic baseline and the coverage range of the dynamic baseline is calculated. Based on the area value, it is determined whether the user is an abnormal user.

15. An abnormal operation behavior analysis system based on business behavior distribution, characterized by: The system includes a computer device, which includes a processor and a memory, wherein the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps implemented by the method described in any one of claims 1 to 14.

Images