A method and system for analyzing abnormal operation behavior based on service behavior distribution

Abstract

The application provides a kind of based on the abnormal operation behavior analysis method and system of business behavior distribution, the steps of the method include: obtaining the historical business data of the business department to which target user belongs, each business operation is vectorized, and the corresponding operation vector is obtained;Each business vector is identified by using a classification model to identify the business operation category, and the first preset number of business operation categories before the business operation of the target user is used to construct a prediction vector, and the operation category of the business operation of the target user is predicted based on the prediction vector;The initial abnormal value of the actual business operation of the target user is calculated based on the prediction result;The category-related weight is determined based on the operation category of the actual business operation of the target user and the operation category of the prediction result, and the operation abnormal value is calculated;The prediction abnormal value is calculated based on the operation abnormal value, and the dynamic baseline is constructed based on the prediction abnormal value corresponding to the business operation;Whether the user is an abnormal user is determined based on the dynamic baseline.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of smart power plants, and in particular to an abnormal operation behavior analysis method and system based on business behavior distribution. BACKGROUND

[0002] In the operation and management of smart power plants, the identification of abnormal operations of business data, especially the monitoring of network intrusion and illegal handling behavior, has become a core means to ensure the safe and stable operation of power plants, prevent potential risks, and maintain data integrity and compliance. The importance of this innovative practice not only lies in the accurate identification and rapid response to immediate security threats, but also in its profound impact on the optimization of long-term operation strategies, the enhancement of data asset protection capabilities, and the improvement of industry compliance.

[0003] First, from the perspective of power plant safety, smart power plants, as highly informationized industrial systems, cover equipment operation, energy management, environmental monitoring, and other key areas. The security of these data directly affects the operational efficiency and stability of the power plant. Network intrusion, such as hacking attacks and malicious software implants, not only can lead to data leakage and equipment out of control, but also can cause a chain reaction, resulting in serious security incidents. AI technology can extract network behavior features from massive amounts of business data through deep learning algorithms, and build an efficient anomaly detection model. Once abnormal network activity is detected, such as unauthorized access attempts and abnormal data transmission, the AI system can immediately issue a warning, providing timely intervention opportunities for the power plant network security team, effectively blocking attack paths, and protecting the power plant from network threats.

[0004] Second, AI identification of network intrusion and illegal handling behavior is crucial for maintaining data integrity and compliance in power plants. The accuracy and integrity of business data in smart power plants are the foundation for ensuring scientific decision-making and efficient operation. Network intrusion often involves data tampering, deletion, or theft, which not only undermines data authenticity but also can affect normal operation of the power plant. AI technology can monitor data access and modification behavior in real time, compare it with pre-set compliance standards, and trigger an alarm immediately if abnormal operations such as unauthorized data modification or sensitive data leakage are detected, prompting the power plant to take emergency measures to restore data integrity and ensure business continuity.

[0005] However, existing AI identification often only analyzes historical data of a single user to determine whether subsequent business operations are abnormal, which lacks accuracy.

[0006] Therefore, the present application is proposed. SUMMARY

[0007] The purpose of this invention is to provide a method and system for analyzing abnormal operation behavior based on business behavior distribution. This solution first calculates an initial abnormal value, then calculates the operation abnormal value by using the relevant weights calculated with other user data, and combines the data of other users and the user's own data to determine whether the user is abnormal.

[0008] This invention provides a method for analyzing abnormal operation behavior based on business behavior distribution, the method comprising the following steps:

[0009] Obtain the business department to which the target user belongs, call the historical business data of that business department, and vectorize each business operation in the historical business data to obtain the operation vector for each business operation.

[0010] A classification model is used to identify the business operation category for each business vector. A prediction vector is constructed based on the first preset number of business operation categories before the target user's business operation. The operation category of the target user's business operation is then predicted based on the prediction vector.

[0011] Based on the predicted probability values ​​of each operation category and the actual operation category of the target user's business operations, the initial outlier value of the target user's actual business operations is calculated.

[0012] The category-related weights are determined based on the actual business operation categories of the target users and the operation categories corresponding to the highest probability values. Operation anomalies are then calculated based on the category-related weights and the initial anomalies.

[0013] Calculate the predicted outlier value based on the operation outlier value corresponding to the first preset number of business operations before the target user's business operation in historical business data, and construct the dynamic baseline of the target user based on the predicted outlier value corresponding to each business operation of the target user.

[0014] The actual abnormal values ​​of multiple business operations of the target user are compared with the dynamic baseline to determine whether the user is an abnormal user.

[0015] The above scheme first uses a pre-set classification model to categorize each business operation in a department, and calculates the initial outlier value of the actual business operation based on the predicted probability of each operation category. This step calculates the initial outlier value based on the principle that the higher the consistency between the predicted operation and the actual operation, the lower the probability of an anomaly. This initially determines the degree of anomaly of the operation. Since operations of operation categories with high correlation are easily substituted, this scheme further determines the relevant weights based on the correlation of operation categories, and calculates the operation outlier value again by combining data from other users to ensure the accuracy of the operation outlier value calculation. In the final judgment step, a dynamic baseline is constructed by using the predicted operation outlier values ​​of multiple operations and compared with the actual operation outlier value to ensure the accuracy of the user's anomaly judgment.

[0016] In some embodiments of the present application, in the step of constructing a prediction vector based on the first preset number of service operation categories before the service operation of the target user, the corresponding category code is determined based on the category of the service operation, and the category codes corresponding to the first preset number of service operation categories before the service operation of the target user are sequentially connected to obtain the prediction vector.

[0017] In some embodiments of the present application, in the step of predicting the operation category of the service operation of the target user based on the prediction vector, a pre-set convolutional neural network model is used for prediction, the convolutional neural network includes a plurality of convolutional layers and a classification layer, and the prediction value of the probability value of the next service operation for each operation category is output by the last classification layer.

[0018] In some embodiments of the present application, based on the predicted probability value of each operation category and the operation category of the actual service operation of the target user, the step of calculating the initial abnormal value of the actual service operation of the target user includes:

[0019] Based on the predicted probability value of each operation category, the operation category corresponding to the second predetermined number of maximum probability values is screened to construct an operation group.

[0020] It is determined whether the operation category of the actual service operation of the target user belongs to the operation category in the operation group.

[0021] If it belongs, the initial abnormal value is calculated based on the probability value corresponding to the operation category.

[0022] If it does not belong, the initial abnormal value is calculated using a pre-set initial value.

[0023] Using the above scheme, the subsequent data operation is first predicted by the convolutional neural network model, the initial abnormal value is calculated based on the predicted operation category of the service operation and the operation category of the actual service operation of the target user, the abnormal degree of the user operation is preliminarily determined, and the abnormal degree of the single operation of the user is determined based on the principle that each user in the same department needs to perform a unified logical chain of business.

[0024] In some embodiments of the present application, in the step of calculating the initial abnormal value based on the probability value corresponding to the operation category or calculating the initial abnormal value using a pre-set initial value, the initial abnormal value is calculated using the following formula:

[0025]

[0026] Wherein, τ1 represents the initial abnormal value, α represents the probability value or the pre-set initial value, and σ represents a pre-set calculation constant.

[0027] According to the scheme, if the operation category of the actual service operation of the target user is in the operation group, an initial abnormal value is calculated through a corresponding probability value, the greater the probability value is, the more consistent the predicted service operation is, and thus the greater the probability value is, the smaller the initial abnormal value calculated in the calculation process is, so as to ensure the calculation accuracy.

[0028] In some embodiments of the application, the first calculation method and the second calculation method are used in the step of determining the category-related weight based on the operation category of the actual service operation of the target user and the operation category corresponding to the maximum probability value.

[0029] The first calculation method reads the category-related weight of the operation category of the actual service operation of the target user and the operation category corresponding to the maximum probability value from a pre-set reference table.

[0030] The second calculation method calculates the correlation degree of the operation vector of the actual service operation of the target user and the standard category vector pre-set for the operation category corresponding to the maximum probability value by using a pre-set correlation degree calculation model, and determines the correlation weight based on the correlation degree.

[0031] According to the scheme, the category-related weight is calculated by two methods, the category-related weight represents the correlation degree of the actual service operation and the operation category corresponding to the maximum probability value, and the abnormal value of the user operation can be further reflected through the difference between the actual service operation and the operation category corresponding to the maximum probability value, so as to ensure the calculation accuracy.

[0032] In some embodiments of the application, in the step of calculating the correlation degree of the operation vector of the actual service operation of the target user and the standard category vector pre-set for the operation category corresponding to the maximum probability value by using a pre-set correlation degree calculation model, if the second calculation method is used, a calculation model with a convolutional neural network structure is used as the correlation degree calculation model, or a Euclidean distance algorithm, a Mahalanobis distance algorithm or a Manhattan distance algorithm is used to construct the correlation degree calculation model.

[0033] In some embodiments of the application, the reciprocal of the correlation degree is calculated as the correlation weight, and in the step of calculating the operation abnormal value based on the category-related weight and the initial abnormal value, the operation abnormal value is calculated by using the following formula:

[0034]

[0035] Wherein, T2 represents the operation abnormal value, D represents the correlation degree, and τ1 represents the initial abnormal value.

[0036] In some embodiments of the present application, in the step of calculating the predicted abnormal value from the abnormal values corresponding to the first preset number of business operations before the target user's business operation in the historical business data, the abnormal values corresponding to the first preset number of business operations before the target user's business operation in the historical business data are constructed as an input vector and input into a preset long short-term memory network model (LSTM), and the long short-term memory network model outputs the predicted abnormal value, so as to determine the corresponding predicted abnormal value of the target user's business operation.

[0037] According to the above scheme, since the previous operation of the target user's business operation often has an impact on the subsequent operation, the present scheme calculates the operation abnormal value of the previous operation in the same way, calculates the predicted abnormal value of the subsequent operation based on the operation abnormal value of the previous operation, and determines the abnormal degree of the user based on the relative difference between the predicted abnormal value and the actual abnormal value, instead of simply determining the abnormal degree of the user based on the size of the abnormal value, thereby ensuring the accuracy of the determination of the user abnormality.

[0038] In some embodiments of the present application, in the step of constructing the dynamic baseline of the target user based on the predicted abnormal value corresponding to each business operation of the target user, the order of the predicted abnormal value is determined based on the time sequence of the business operation of the target user, and the predicted abnormal value is sequentially connected in the coordinate system to construct the dynamic baseline of the target user.

[0039] In some embodiments of the present application, in the step of comparing the actual operation abnormal value of the target user's multiple business operations with the dynamic baseline to determine whether the user is an abnormal user:

[0040] The coverage range of the dynamic baseline is determined based on a preset fluctuation range;

[0041] An actual change curve is constructed based on the actual operation abnormal value of the target user's business operation, the area value of the range surrounded by the actual change curve above the dynamic baseline and the coverage range of the dynamic baseline is calculated, and whether the user is an abnormal user is determined based on the area value.

[0042] According to the above scheme, the range of the dynamic baseline is determined by the preset fluctuation range, and when the actual operation abnormal value of the target user's business operation exceeds the coverage range, there may be a certain abnormality, thereby ensuring the accurate determination of the abnormal user.

[0043] In some embodiments of the present application, if the target user is an abnormal user, the steps of the method further include:

[0044] determine whether the target user is an outlier user based on a proportion of business operations of users other than the target user in each operation category in historical business data of the business department and a proportion of business operations of the target user in each operation category in the historical business data of the business department;

[0045] if the target user is an abnormal user and is not an outlier user, issuing a user warning based on the target user.

[0046] With the above scheme, the scheme is first based on the characteristics of pipeline work of users in the same department, and each user in the same department needs to perform unified logical chain of business. Whether the user's operation is on the logical chain is determined. If the user is invaded in the middle, there is a case of jumping out of the logical chain, and whether it is an abnormal user is determined. Since even users in the same department may have individual outlier users, the outlier user often has different work logic from other users in the same department from the beginning, so the scheme further determines whether the user is an outlier user through all the data of the user after determining the abnormal user, to avoid misjudgment of the outlier user.

[0047] In some embodiments of the present application, in the step of determining whether the target user is an outlier user based on a proportion of business operations of users other than the target user in each operation category in historical business data of the business department and a proportion of business operations of the target user in each operation category in the historical business data of the business department:

[0048] based on the business operations of the users other than the target user in the historical business data of the business department, the proportion of business operations of each operation category is counted, and a first proportion sequence is obtained;

[0049] based on the business operations of the target user in the target time period, the proportion of business operations of each operation category is counted, and a second proportion sequence is obtained;

[0050] based on the first proportion sequence and the second proportion sequence, the user outlier degree is determined, and whether the user is an outlier user is determined based on the user outlier degree.

[0051] In some embodiments of the present application, in the step of determining the user outlier degree based on the first proportion sequence and the second proportion sequence, the difference value of each operation category is calculated based on the corresponding value of each operation category in the first proportion sequence and the second proportion sequence, the difference sequence is constructed based on the difference value of each operation category, and the user outlier degree is calculated based on the difference sequence.

[0052] Another aspect of the present application also relates to an abnormal operation behavior analysis system based on business operation behavior distribution, comprising a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, and the processor being configured to execute the computer instructions stored in the memory, and the system implementing the steps implemented by the method.

[0053] In summary, the present application has the following advantages:

[0054] 1、The present application first determines the operation category of each business operation in a department through a pre-set classification model, and calculates the actual business operation initial abnormal value based on the predicted probability of each operation category. In this step, the initial abnormal value is calculated based on the principle that the higher the consistency between the predicted operation and the actual operation, the lower the possibility of abnormality. The abnormality degree of the operation is preliminarily determined. Since the operation of the operation category with high correlation is easy to be replaced, the present application further determines the correlation weight based on the correlation of the operation category, and calculates the operation abnormal value again combined with the data of other users to ensure the accuracy of the operation abnormal value calculation. In the final determination step, the dynamic baseline is constructed by the operation abnormal values of the predicted multiple operations, and compared with the actual operation abnormal value to ensure the accuracy of the user abnormality determination.

[0055] 2、The present application first predicts the subsequent data operation through a convolutional neural network model, calculates the initial abnormal value through the predicted operation category of the business operation and the actual operation category of the business operation of the target user, preliminarily determines the abnormality degree of the user operation, and determines the abnormality degree of the single operation of the user based on the principle that the users in the same department need to perform unified logical chain of business.

[0056] 3、Since the previous operation of the target user's business operation often has an impact on the subsequent operation, the present application calculates the operation abnormal value in the same way for the previous operation, and calculates the predicted abnormal value of the subsequent operation based on the operation abnormal value of the previous operation. The abnormality degree of the user is determined based on the relative difference between the predicted abnormal value and the actual abnormal value, rather than simply determining the abnormality degree of the user based on the size of the abnormal value, to ensure the accuracy of the user abnormality determination.

[0057] 4、The scheme is first based on the same department user work exists pipeline work characteristics, the same department of each user needs to carry on the principle of uniform logic chain to the business, through judging whether the user's operation is on the logic chain, if the user is invaded in the middle, there is a situation of jumping out of the logic chain, judge whether it is an abnormal user; and because even the same department users may also exist individual outliers, the outlier user often works logically different from other users in the same department from the beginning, therefore, the scheme therefore further determines whether the user is an outlier user after determining the abnormal user, to avoid misjudgment of the outlier user. BRIEF DESCRIPTION OF DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, without creative labor, can also obtain other drawings according to these drawings.

[0059] Figure 1 The first embodiment of the present application based on the schematic diagram of the abnormal operation behavior analysis method of business behavior distribution;

[0060] Figure 2 The second embodiment of the present application based on the schematic diagram of the abnormal operation behavior analysis method of business behavior distribution;

[0061] Figure 3 The step diagram of the step S300 in the present scheme is expanded;

[0062] Figure 4 The step diagram of the step S600 of the first embodiment of the present application is expanded;

[0063] Figure 5 The step diagram of the step after determining the abnormal user in the present scheme is expanded. DETAILED DESCRIPTION

[0064] The exemplary embodiments will be described in detail hereinbelow with reference to the drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not representative of all embodiments consistent with the present application. Rather, they are merely examples of systems and methods consistent with some aspects of the present application as detailed in the appended claims.

[0065] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the present application and the accompanying claims, the singular form "a", "an" and "the" include plural references unless the context clearly dictates otherwise. It will be further understood that the terms "and / or", as used herein, refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0066] As Figure 1 illustrated, the present application provides an abnormal operation behavior analysis method based on business behavior distribution, the steps of the method include:

[0067] Step S100, obtaining the business department to which the target user belongs, calling the historical business data of the business department, performing vectorization processing on each business operation of the historical business data, and obtaining an operation vector corresponding to each business operation;

[0068] In some embodiments of the present application, in the step of performing vectorization processing on each business operation of the historical business data, the BERT or RoBERTa model is used to perform vectorization processing on the business operation.

[0069] Step S200, using a classification model to identify the business operation category of each business vector, constructing a prediction vector based on the first preset number of business operation categories before the business operation of the target user, and predicting the operation category of the business operation of the target user based on the prediction vector;

[0070] In the specific implementation process, the classification model uses a multilayer perceptron, a convolutional neural network or a recurrent neural network model.

[0071] Multilayer Perceptron (MLP): Fully connected neural network, can process nonlinear classification tasks.

[0072] Convolutional Neural Network (CNN): Extract spatial features through convolution kernels, good at image classification (such as the performance of ResNet in ImageNet competition).

[0073] Recurrent Neural Network (RNN): Process sequence data, such as LSTM and GRU for text sentiment classification or time series prediction. Can capture time-dependent relationships.

[0074] In some embodiments of the present application, the business operation category includes data collection, monitoring, database management, data analysis and optimization, data interaction and sharing, and process management and compliance operation.

[0075] Specific examples include:

[0076] Data collection operations include collecting the operating parameters (such as temperature, pressure, and vibration values) of the generator set, power transmission and transformation equipment, etc. through sensors and SCADA systems. For example, the boiler system data collection of a coal-fired power plant and the real-time monitoring of wind power in a wind farm;

[0077] Monitoring operations include recording the manual control instructions and operation history of the operators on the equipment, such as unit start-stop and valve adjustment, etc.

[0078] Database management operations include storing structured data (such as equipment parameters and production logs) using database systems such as SQL Server; periodically transferring historical data to backup servers; filtering outliers and unifying formats for the collected raw data, such as eliminating sensor noise interference.

[0079] Data analysis and optimization operations include analyzing the equipment operating status through big data to predict vibration faults or energy efficiency losses of the generator set. For example, using TDM systems to monitor the vibration trends of steam turbines; and building prediction models (such as LSTM and ARIMA) based on historical load data to optimize power generation plans and grid dispatching.

[0080] Data interaction and sharing operations include connecting power plant data to grid dispatching systems (such as AGC automatic power generation control) and third-party supervision platforms; and integrating production control area and management information area data to build a plant-level monitoring information system.

[0081] Process management and compliance operations include developing data labeling rules and processing procedures based on the "Power Industry Data Classification and Grading Specification"; and periodically verifying whether data operations comply with regulations such as the "Basic Requirements for Network Security Protection".

[0082] Step S300, based on the predicted probability values of each operation category and the operation category of the target user's actual business operation, calculate the initial anomaly value of the target user's actual business operation;

[0083] Step S400, based on the operation category of the target user's actual business operation and the operation category corresponding to the maximum probability value, determine the category-related weight, and based on the category-related weight and the initial anomaly value, calculate the operation anomaly value;

[0084] Step S500, based on the operation anomaly values corresponding to the first preset number of business operations of the target user in the historical business data, calculate the prediction anomaly value, and based on the prediction anomaly value corresponding to each business operation of the target user, build the dynamic baseline of the target user;

[0085] Step S600, compare the actual operation anomaly values of the target user's multiple business operations with the dynamic baseline, and determine whether the user is an abnormal user.

[0086] With the above scheme, the scheme first classifies the operation category of each business operation in a department through a pre-set classification model, and calculates the initial abnormal value of the actual business operation based on the predicted probability of each operation category. In this step, the initial abnormal value is calculated based on the principle that the higher the consistency between the predicted operation and the actual operation, the lower the possibility of abnormality. The abnormality degree of the operation is preliminarily determined, and since the operation of the operation category with high correlation is easy to be replaced, the scheme further determines the correlation weight based on the correlation of the operation category, and calculates the operation abnormal value again combined with the data of other users to ensure the accuracy of the operation abnormal value calculation. In the final determination step, the operation abnormal value of the predicted multiple operations is constructed to form a dynamic baseline, which is compared with the actual operation abnormal value to ensure the accuracy of the user abnormality determination.

[0087] In some embodiments of the present application, in the step of constructing a prediction vector based on the first pre-set number of business operation categories before the business operation of the target user, the corresponding category code is determined based on the category of the business operation, and the category codes corresponding to the first pre-set number of business operation categories before the business operation of the target user are sequentially connected to obtain the prediction vector.

[0088] In some embodiments of the present application, the corresponding category code is determined based on the category of the business operation, and the category code is obtained by vectorization processing using a BERT or RoBERTa model.

[0089] In some embodiments of the present application, in the step of predicting the operation category of the business operation of the target user based on the prediction vector, a pre-set convolutional neural network model is used for prediction. The convolutional neural network includes multiple convolutional layers and classification layers, and the prediction value of the probability value of each operation category of the next business operation is output by the last classification layer.

[0090] As shown in Figure 3 In some embodiments of the present application, based on the predicted probability value of each operation category and the operation category of the actual business operation of the target user, the step of calculating the initial abnormal value of the actual business operation of the target user includes:

[0091] In the specific implementation process, the operation category of the actual business operation of the target user is also subjected to vectorization processing, and a classification model is used to classify each business vector.

[0092] Step S310: screening the operation category corresponding to the second pre-determined number of probability values with the largest probability value based on the predicted probability value of each operation category, and constructing an operation group;

[0093] Step S320: determining whether the operation category of the actual business operation of the target user belongs to the operation category in the operation group;

[0094] Step S331, if belongs, then calculate the initial abnormal value based on the probability value corresponding to the operation category;

[0095] Step S332, if does not belong, then calculate the initial abnormal value using the pre-set initial value.

[0096] With the above scheme, the scheme first predicts the subsequent data operation through the convolutional neural network model, calculates the initial abnormal value through the operation category of the predicted business operation and the operation category of the actual business operation of the target user, preliminarily determines the abnormality degree of the user operation, and determines the abnormality degree of the single operation of the user based on the principle that each user in the same department needs to perform unified logical chain of business.

[0097] In some embodiments of the present application, in the step of calculating the initial abnormal value based on the probability value corresponding to the operation category or calculating the initial abnormal value using the pre-set initial value, the initial abnormal value is calculated using the following formula:

[0098]

[0099] Wherein, τ1 represents the initial abnormal value, α represents the probability value or the pre-set initial value, and σ represents the pre-set calculation constant.

[0100] With the above scheme, if the operation category of the actual business operation of the target user is in the operation group, the initial abnormal value is calculated through the corresponding probability value. The greater the probability value, the more consistent with the predicted business operation, so the greater the probability value in the calculation process, the smaller the calculated initial abnormal value, ensuring the calculation accuracy.

[0101] In some embodiments of the present application, the first calculation method and the second calculation method are used in the step of determining the category-related weight based on the operation category corresponding to the maximum probability value and the operation category of the actual business operation of the target user:

[0102] The first calculation method reads the category-related weight corresponding to the operation category of the actual business operation of the target user and the operation category corresponding to the maximum probability value from the pre-set reference table;

[0103] In the specific implementation process, the horizontal and vertical table headers in the pre-set reference table are all operation types in the same order, and the position where the row and column intersect is the corresponding related weight.

[0104] The second calculation method calculates the correlation degree between the operation vector of the actual business operation of the target user and the standard category vector pre-set for the operation category corresponding to the maximum probability value based on the pre-set correlation degree calculation model, and determines the related weight based on the correlation degree.

[0105] In the implementation process, the correlation calculation model can adopt a convolutional neural network model, which includes an input layer, a convolutional layer, a pooling layer and a fully connected layer.

[0106] By the above scheme, the category correlation weight is calculated in two ways, and the category correlation weight represents the correlation degree of the actual business operation and the operation category corresponding to the maximum probability value, which can further reflect the abnormal value of the user operation through the difference between the actual business operation and the operation category corresponding to the maximum probability value, thereby ensuring the calculation accuracy.

[0107] In some embodiments of the present application, in the step of calculating the correlation between the operation vector of the actual business operation of the target user and the standard category vector preset for the operation category corresponding to the maximum probability value using a preset correlation calculation model, if the second calculation method is used, a convolutional neural network structure calculation model is used as the correlation calculation model, or a Euclidean distance algorithm, a Mahalanobis distance algorithm or a Manhattan distance algorithm is used to construct the correlation calculation model.

[0108] Specifically, when the Euclidean distance algorithm, the Mahalanobis distance algorithm or the Manhattan distance algorithm is used to construct the correlation calculation model, the smaller the distance value, the higher the correlation.

[0109] Euclidean Distance

[0110] Definition: the straight-line distance between two points in a multidimensional space, and the calculation formula is the square sum of the difference in each dimension.

[0111] Manhattan Distance

[0112] Definition: the sum of the absolute values of the difference in each dimension, reflecting the actual distance of the city street path.

[0113] Mahalanobis Distance

[0114] Definition: a standardized distance based on the data covariance matrix, which eliminates the correlation and dimension influence between variables.

[0115] In some embodiments of the present application, the reciprocal of the correlation is calculated as the correlation weight, and in the step of calculating the operation abnormal value based on the category correlation weight and the initial abnormal value, the operation abnormal value is calculated using the following formula:

[0116]

[0117] Wherein, τ2 represents the operation abnormal value, D represents the correlation, and τ1 represents the initial abnormal value.

[0118] In some embodiments of the present application, in the step of calculating the predicted abnormal value from the abnormal values of the first preset number of business operations of the target user in the historical business data before the business operation of the target user, the abnormal values of the first preset number of business operations of the target user in the historical business data before the business operation of the target user are constructed as an input vector and input into a preset long short-term memory network model (LSTM), and the long short-term memory network model outputs the predicted abnormal value, so as to determine the corresponding predicted abnormal value of the business operation of the target user.

[0119] According to the above scheme, since the previous operation of the target user's business operation often has an impact on the subsequent operation, the present scheme calculates the operation abnormal value of the previous operation in the same way, calculates the predicted abnormal value of the subsequent operation based on the operation abnormal value of the previous operation, and determines the abnormal degree of the user based on the relative difference between the predicted abnormal value and the actual abnormal value, instead of simply determining the abnormal degree of the user based on the size of the abnormal value, thereby ensuring the accuracy of the determination of the user abnormality.

[0120] In some embodiments of the present application, in the step of constructing the dynamic baseline of the target user based on the predicted abnormal value corresponding to each business operation of the target user, the order of the predicted abnormal value is determined based on the time sequence of the business operation of the target user, and the predicted abnormal value is sequentially connected in the coordinate system to construct the dynamic baseline of the target user.

[0121] As shown in Figure 4 In some embodiments of the present application, in the step of comparing the actual operation abnormal value of the plurality of business operations of the target user with the dynamic baseline to determine whether the user is an abnormal user:

[0122] In step S610, the coverage range of the dynamic baseline is determined based on a preset fluctuation range.

[0123] In the specific implementation process, the fluctuation range is the range of each point of the dynamic baseline extending upward, specifically, the height difference set based on the actual situation, and the height of the fluctuation range extending upward from the original point.

[0124] In step S620, an actual change curve is constructed based on the actual operation abnormal value of the business operation of the target user, the area value of the range surrounded by the actual change curve above the dynamic baseline and the coverage range of the dynamic baseline is calculated, and whether the user is an abnormal user is determined based on the area value.

[0125] In the specific implementation process, in the step of determining whether the user is an abnormal user based on the area value, if the area value is greater than a preset area threshold, the target user is an abnormal user.

[0126] Specifically, in the step of calculating the area value of the range surrounded by the coverage of the actual change curve above the dynamic baseline and the dynamic baseline, the two-dimensional coordinate system where the dynamic baseline is located is uniformly divided into unit area rectangles, and the total area of the abnormal area is determined based on the number of rectangles covered by the coverage of the actual change curve above the dynamic baseline and the dynamic baseline.

[0127] By using the above scheme, the range of the dynamic baseline is determined by the pre-set fluctuation range, and when the actual operation abnormal value of the target user's business operation exceeds the coverage range, there may be certain abnormalities, thereby ensuring accurate group determination of abnormal users.

[0128] As shown in the above Figure 2 , in some embodiments of the present application, if the target user is an abnormal user, the steps of the method further include:

[0129] Step S700, determining whether the target user is an outlier user based on the proportion of the business operation of the user other than the target user in each operation category of the business operation in the historical business data of the business department and the proportion of the business operation of the target user in each operation category of the business operation in the historical business data of the business department.

[0130] Step S800, if the target user is an abnormal user and is not an outlier user, issuing a user warning based on the target user.

[0131] In the specific implementation process, the user warning mode can be a network message sending mode to send a message to a management side mobile terminal.

[0132] By using the above scheme, the present application first determines whether the user's operation is on the logical chain based on the characteristics of the pipeline work of the users of the same department, the principle of unified logical chain of business of each user of the same department, and the existence of jumping out of the logical chain if the user is invaded in the middle. If the user is an abnormal user, the present application further determines whether the user is an outlier user through all the data of the user after determining the abnormal user, thereby avoiding misjudgment of the outlier user.

[0133] As shown in the above Figure 5 , in some embodiments of the present application, in the step of determining whether the target user is an outlier user based on the proportion of the business operation of the user other than the target user in each operation category of the business operation in the historical business data of the business department and the proportion of the business operation of the target user in each operation category of the business operation in the historical business data of the business department:

[0134] In step S710, the proportion of the business operation of each operation category is counted based on the business operation of the user other than the target user in the historical business data of the business department, and a first proportion sequence is obtained.

[0135] In step S720, the proportion of the business operation of each operation category is counted based on the business operation of the target user in the target time period, and a second proportion sequence is obtained.

[0136] In the specific implementation process, the order of the corresponding operation categories in the first proportion sequence and the second proportion sequence is the same order.

[0137] In step S730, the user outlier degree is determined based on the first proportion sequence and the second proportion sequence, and it is determined whether the user is an outlier user based on the user outlier degree.

[0138] In some embodiments of the present application, in the step of determining the user outlier degree based on the first proportion sequence and the second proportion sequence, the difference value of each operation category is calculated based on the corresponding value of each operation category in the first proportion sequence and the second proportion sequence, a difference sequence is constructed based on the difference value of each operation category, and the user outlier degree is calculated based on the difference sequence.

[0139] In the specific implementation process, in the step of calculating the difference value of each operation category based on the corresponding value of each operation category in the first proportion sequence and the second proportion sequence, the difference between the corresponding values of the two operations in the first proportion sequence and the second proportion sequence is calculated, and the absolute value is calculated as the difference value.

[0140] The embodiment of the present application also provides an abnormal operation behavior analysis system based on business behavior distribution, which comprises a computer device, the computer device comprises a processor and a memory, the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the system realizes the steps realized by the method.

[0141] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and when the computer program is executed by the processor, the preceding abnormal operation behavior analysis system based on business behavior distribution is realized. The computer readable storage medium can be a tangible storage medium, such as random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the technical field.

[0142] Those of ordinary skill in the art will appreciate that the various illustrative components, systems and methods described in connection with the embodiments disclosed herein can be implemented as hardware, software, or both. The particular implementation is dependent on the specific application and design constraints imposed on the overall system. Skilled persons can implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application. When implemented in hardware, for example, the hardware can comprise an electronic circuit, an Application Specific Integrated Circuit (ASIC), a suitable firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the application are the program or code segments to perform a specific task. The program or code segments can be stored in a machine-readable medium, or transmitted by a carrier wave as data signals over a transmission medium or communication link.

[0143] It is to be understood that the application is not limited to the particular configurations and processes described herein and shown in the drawings. For simplicity, detailed descriptions of known methods and apparatuses are omitted so as not to obscure the disclosure. In the above-described embodiments, several specific steps are described and illustrated as examples. However, the method processes of the present application are not limited to the specific steps described and illustrated, and the order of the steps can be changed, or other steps can be added, or replaced, or eliminated, depending on the application.

[0144] In the present application, features described and / or illustrated in relation to one embodiment can be used in the same or a similar way in one or more other embodiments, and / or combined with or instead of features of other embodiments.

[0145] The above description is only preferred embodiments of the present application, and is not intended to limit the present application. The embodiments of the present application can be variously changed and modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the present application.

Claims

1. A method for analyzing abnormal operational behavior based on business behavior distribution, characterized in that, The steps of the method include: Obtain the business department to which the target user belongs, call the historical business data of that business department, and vectorize each business operation in the historical business data to obtain the operation vector for each business operation. A classification model is used to identify the business operation category for each business vector. A prediction vector is constructed based on the first preset number of business operation categories before the target user's business operation. The operation category of the target user's business operation is then predicted based on the prediction vector. Based on the predicted probability values ​​of each operation category and the actual operation category of the target user's business operations, the initial outlier value of the target user's actual business operations is calculated. The category-related weights are determined based on the actual business operation categories of the target users and the operation categories corresponding to the highest probability values. Operation anomalies are then calculated based on the category-related weights and the initial anomalies. Calculate the predicted outlier value based on the operation outlier value corresponding to the first preset number of business operations before the target user's business operation in historical business data, and construct the dynamic baseline of the target user based on the predicted outlier value corresponding to each business operation of the target user. The actual abnormal values ​​of multiple business operations of the target user are compared with the dynamic baseline to determine whether the user is an abnormal user.

2. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1, characterized in that, If the target user is an abnormal user, the method further includes the following steps: Based on the proportion of business operations by users other than the target user in each operation category in the historical business data of the business department, and based on the proportion of business operations by the target user in each operation category in the historical business data of the business department, determine whether the target user is an outlier. If the target user is an abnormal user but not an outlier, a user alert will be issued based on that target user.

3. The abnormal operation behavior analysis method based on business behavior distribution according to claim 2, characterized in that, In the step of determining whether a target user is an outlier, based on the proportion of business operations by users other than the target user in each operation category in the historical business data of the business department, and the proportion of business operations by the target user in each operation category in the historical business data of the business department: Based on the historical business data of the business departments, the proportion of business operations of users other than the target users in each operation category is statistically analyzed to obtain the first proportion sequence; Based on the business operations of target users within a target time period, the proportion of each operation category is statistically analyzed to obtain a second proportion sequence; The user outlier degree is determined based on the first proportion sequence and the second proportion sequence, and whether the user is an outlier user is determined based on the user outlier degree.

4. The abnormal operation behavior analysis method based on business behavior distribution according to claim 3, characterized in that, In the step of determining user outlier degree based on the first proportion sequence and the second proportion sequence, the difference value of each operation category is calculated based on the value corresponding to each operation category in the first proportion sequence and the second proportion sequence, a difference sequence is constructed based on the difference values ​​of each operation category, and the user outlier degree is calculated based on the difference sequence.

5. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 or 2, characterized in that, In the step of constructing a prediction vector based on a first preset number of business operation categories before the target user's business operations, the corresponding category code is determined based on the category of the business operation, and the category codes corresponding to the first preset number of business operation categories before the target user's business operations are sequentially concatenated to obtain the prediction vector.

6. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1, characterized in that, In the step of predicting the operation category of the target user's business operation based on the prediction vector, a pre-set convolutional neural network model is used for prediction. The convolutional neural network includes multiple convolutional layers and classification layers. The last classification layer outputs the predicted probability value of the next business operation for each operation category.

7. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1, characterized in that, Based on the predicted probability values ​​of each operation category and the actual operation category of the target user's business operations, the steps for calculating the initial outlier values ​​of the target user's actual business operations include: Based on the predicted probability values ​​of each operation category, select the operation category corresponding to the second predetermined number of probability values ​​with the largest probability value and construct an operation group; Determine whether the actual business operation performed by the target user belongs to the operation category in the operation group; If it belongs to that category, then calculate the initial outlier value based on the probability value corresponding to that operation category; If it does not belong to the category, the initial outlier value is calculated using the preset initial value.

8. The abnormal operation behavior analysis method based on business behavior distribution according to claim 7, characterized in that, In the step of calculating the initial outlier based on the probability value corresponding to the operation category or using a preset initial value, the initial outlier is calculated using the following formula: in, α represents the initial outlier value, α represents the probability value or the preset initial value, and σ represents the preset calculation constant.

9. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1, characterized in that, In the step of determining category-related weights based on the actual business operation categories of target users and the operation categories corresponding to the highest probability values, the first calculation method and the second calculation method are adopted: The first calculation method involves reading the actual business operation category of the target user and the operation category corresponding to the highest probability value from a pre-set lookup table to determine the category-related weights. The second calculation method is to use a pre-set relevance calculation model to calculate the relevance between the operation vector of the target user's actual business operation and the standard category vector of the operation category corresponding to the operation category with the highest probability value, and determine the relevant weight based on the relevance.

10. The abnormal operation behavior analysis method based on business behavior distribution according to claim 9, characterized in that, In the step of calculating the relevance between the operation vector of the target user's actual business operation and the standard category vector of the operation category corresponding to the operation category with the highest probability value using a pre-set relevance calculation model, if the second calculation method is adopted, a calculation model with a convolutional neural network structure is used as the relevance calculation model, or a relevance calculation model is constructed using Euclidean distance algorithm, Mahalanobis distance algorithm or Manhattan distance algorithm.

11. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1 or 8, characterized in that, The reciprocal of the relevance is used as the relevance weight. In the step of calculating the operational outlier based on the category relevance weight and the initial outlier, the operational outlier is calculated using the following formula: in, This indicates an operational outlier, and D represents the relevance. This indicates the initial outlier.

12. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1, characterized in that, In the step of calculating the predicted anomaly value based on the operation anomaly value corresponding to the first preset number of business operations before the target user's business operation in historical business data, the operation anomaly value corresponding to the first preset number of business operations before the target user's business operation in historical business data is constructed as an input vector and input into a preset long short-term memory network model. The long short-term memory network model outputs the predicted anomaly value to determine the predicted anomaly value corresponding to the target user's business operation.

13. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1, characterized in that, In the step of constructing a dynamic baseline for a target user based on the predicted outliers corresponding to each business operation of the target user, the order of the predicted outliers is determined based on the time sequence of the target user's business operations, and the predicted outliers are connected in the coordinate system to construct the dynamic baseline for the target user.

14. The abnormal operation behavior analysis method based on business behavior distribution according to claim 1, characterized in that, In the step of comparing the actual abnormal values ​​of multiple business operations of the target user with the dynamic baseline to determine whether the user is an abnormal user: The coverage area of ​​the dynamic baseline will be determined based on the preset fluctuation range; An actual change curve is constructed based on the actual abnormal values ​​of the target user's business operations. The area value of the range enclosed by the actual change curve above the dynamic baseline and the coverage area of ​​the dynamic baseline is calculated. Based on the area value, it is determined whether the user is an abnormal user.

15. An abnormal operation behavior analysis system based on business behavior distribution, characterized in that: The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method according to any one of claims 1-14.

Images