Internet user behavior accurate analysis method based on artificial intelligence

Abstract

The invention discloses an internet user behavior accurate analysis method based on artificial intelligence, which belongs to the technical field of internet and comprises the steps of S1, data acquisition and privacy enhancement processing, S2, behavior modeling and transparent analysis, S3, real-time risk prevention and control and abuse blocking and S4, feedback closed loop and continuous optimization. On the basis of analyzing user behaviors, the traditional contradiction between privacy and efficiency can be broken through, and systematic improvement of safety and efficiency can be achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet, more particularly, to an Internet user behavior accurate analysis method based on artificial intelligence. BACKGROUND

[0002] In today's digital age, the Internet has generated a large amount of user behavior data. By analyzing these data, enterprises and platforms can gain a deep understanding of user needs, preferences and behavior patterns, and thus provide personalized services, optimize product design, develop precise marketing strategies, etc. However, traditional user behavior analysis methods have many limitations.

[0003] Traditional centralized training requires centralized data, but privacy regulations restrict cross-domain sharing, single institution data is difficult to cover global behavior patterns, model generalization ability is weak, original data aggregation to the server is vulnerable to attack, deep learning decision-making process is not transparent, users question the fairness of the analysis results, risk control systems based on fixed thresholds are difficult to adapt to new attacks, centralized models need to return data to the server for analysis, peak delay > 500ms, and 90% of bandwidth is consumed for original data transmission, offline training takes several weeks, and cannot respond to behavior drift in real time. SUMMARY

[0004] 1. Technical problem to be solved In view of the problems in the prior art, the purpose of the present application is to provide an Internet user behavior accurate analysis method based on artificial intelligence, which can break through the traditional contradiction between privacy and efficiency, and realize the systematic leap of safety and efficiency on the basis of analyzing user behavior.

[0005] 2. Technical solution

[0006] To solve the above problems, the present application adopts the following technical solution: An Internet user behavior accurate analysis method based on artificial intelligence, comprising: S1, data collection and privacy enhancement processing; S2, behavior modeling and transparent analysis; S3, real-time risk prevention and abuse blocking; S4, feedback loop and continuous optimization.

[0007] As a preferred embodiment of the present application, the step S1 comprises: Multi-source heterogeneous data collection: obtain user login behavior, browsing track and interaction event original data through burying points, API interface and crawler system, covering website, mobile terminal and social platform channel; Terminal log collection: Add noise to mobile terminal / web site embedded data through local differential privacy iOS RAPPOR algorithm, and then upload to server; Field filtering: Collect necessary fields of business, and shield sensitive information, the necessary fields including click events and browsing time, and the sensitive information including home address and income; Dynamic transparency reporting: Show data use to users, and support real-time authorization withdrawal; Missing value processing: Fill in missing values by using KNN interpolation or random forest prediction; Abnormal value detection: Identify and filter abnormal access based on Isolation Forest or Z-score statistics; Generalization and masking: Keep the first 6 digits of the ID number, and blur the IP address to C segment, so that each record is indistinguishable from at least K-1 records under the quasi-identifier.

[0008] As a preferred scheme of the application, the crawler system is a distributed crawler system, the distributed crawler system adopts Apache Nifi priority queue to manage tasks, dynamically adjusts the crawling depth / breadth, combines the incremental crawling strategy to reduce redundancy, and the API interface acquires third-party data through TLS / SSL encrypted transmission, so that the transmission is safe, wherein the third-party data includes weather and financial API; The AI-driven classification and grading in the step S1 adopts a sensitivity marking model and differential encryption, the sensitivity marking model uses a text classifier of BERT or CNN to automatically mark the data level, and uses AES-256 encryption for high-sensitive data and uses a lightweight ChaCha20 algorithm for low-sensitive data.

[0009] As a preferred scheme of the application, the privacy computing architecture used in the step S1 includes: DP differential privacy: Add Laplace noise to statistical results to ensure that individuals are not traceable; FL federated learning: When sample features overlap, the client locally trains a model, uploads gradient parameters, and when sample IDs overlap, exchanges intermediate parameters through Paillier algorithm homomorphic encryption, and jointly updates the model; TEE trusted execution environment: Process decrypted data in the Intel SGX hardware isolation area to block external theft; Data sandbox: The model only accesses the desensitized data set, and the original data is physically isolated; The dynamic risk prevention and control architecture used in the step S1 includes: LSTM-UEBA model: Establish a baseline based on user historical behavior, detect deviations in real time, and trigger account locking; Adversarial test: inject GAN-generated adversarial samples to test model robustness; Adaptive epsilon allocation: dynamically adjust privacy budget based on data sensitivity, adjust privacy budget for high-sensitivity fields with epsilon <= 0.1 or low-sensitivity fields with epsilon <= 1.0; Federal aggregation optimization: use FedAvg algorithm for weighted average or K-modes algorithm for multi-label clustering to solve non-independent and identically distributed data problems.

[0010] As a preferred scheme of the present application, the step S2 comprises: Behavior modeling: extract time series features through sliding window statistics, construct a heterogeneous graph based on user-device-application interaction relationships, and generate node embedding vectors using GraphSAGE; Dynamic baseline modeling: use DBSCAN or HDBSCAN to cluster normal behaviors and form an initial baseline, use Isolation Forest or LSTM-Autoencoder to construct a dynamic baseline based on historical normal behavior data, and identify behaviors that deviate from the normal pattern; Online learning update: use streaming K-means++ to dynamically adjust the baseline cluster center, reconstruct the behavior sequence error as an anomaly score, and trigger baseline update when the error exceeds the threshold; Multi-modal fusion modeling: train LSTM or Transformer models locally on each terminal, upload only the gradient to the aggregation server, and the server aggregates the gradient using FedAvg to generate a global model and then distributes it; Personalized fine-tuning: clients use PerFedHAR algorithm to fine-tune the global model based on local data to adapt to individual behavior differences; Transparent analysis mechanism: use SHAP explainability anomaly detection to quantify feature contribution values, use SHAP or LIME to explain model output, use Transformer model embedded attention mechanism to visualize key behavior nodes, and generate readable reports.

[0011] As a preferred scheme of the present application, the algorithm used in the step S2 comprises: XGBoost integrated decision tree: output feature importance; Attention mechanism: embed attention layers in LSTM or Transformer to visualize key behavior nodes.

[0012] As a preferred scheme of the present application, the step S3 comprises: Adversarial sample test: generate FGSM algorithm adversarial samples to test the test set and evaluate the model robustness and false positive rate; Consistency verification: compare the decision consistency of deep learning models and white-box models to detect model bias; Secure aggregation: Employs Secure Multi-Party Computation to encrypt gradients, preventing the server from reverse-engineering the original data; Data abuse prevention: Hyperledger Fabric uses blockchain-based permission logs, and all model access behaviors are audited on the blockchain; Minimize data retention: Anonymized data is automatically expired and deleted after analysis, retaining only the aggregated statistical results; Dynamic strategy adjustment: Combining Q-Learning reinforcement learning to optimize blocking actions and minimize false positives. Real-time abuse blocking: When abnormal behavior is detected, it is automatically triggered, and DDoS traffic is diverted and cleaned based on BGP to update the firewall blacklist. An MFA secondary authentication or risk warning pops up, and the behavior deviation is calculated in real time using LSTM network. If the deviation exceeds the threshold, it is blocked.

[0013] As a preferred embodiment of the present invention, the layered defense architecture in step S3 includes: Network layer: Flow table rules are issued based on the OpenFlow protocol, and abnormal IP packets are discarded; Application layer: Dynamically limit rate or terminate sessions using the Token Bucket algorithm; Data layer: Triggers encryption locks or data sandbox isolation to prevent sensitive files from being transferred outside.

[0014] As a preferred embodiment of the present invention, step S4 includes: Real-time decision interpretation: The contribution of SHAP values ​​to the output features of the XGBoost risk scoring model; Attention visualization: Embed a multi-head attention layer in the Transformer model to highlight key behavior nodes; User-side transparent transmission: Risk alerts are accompanied by visual reports; GAN generates adversarial examples: simulating novel attack behaviors and testing model blind spots; Consistency verification: Compare the decision consistency between deep learning models and logistic regression to detect bias; Anonymization retention: The original data is automatically deleted after analysis, and only the aggregated statistical results with differential privacy processing are retained; Blockchain audit chain: All model access and data operation records are recorded on the chain to ensure that the operations cannot be tampered with; Dynamic access control: dynamically authorizing data access permissions based on attributes; Closed-loop optimization effect evaluation: Calculate the Pareto front of privacy budget consumption ε and F1-score model accuracy, measure response latency and false positive rate, and drive iteration based on A / B testing.

[0015] As a preferred scheme of the present application, the A / B test driven iteration step comprises: Goal setting and hypothesis formation: set quantifiable goals according to risk control needs; Hypothesis: based on the behavior baseline model output, put forward verifiable hypotheses; Single variable principle: only adjust target parameters, keep other feature engineering consistent; Layered shunt mechanism: based on user risk level, divide high risk group / low risk group, randomly allocate each group to control group A group or experimental group B group, ensure group homogeneity; Dynamic sample size calculation: using statistical power Power=0.8 and significance level α=0.05 to dynamically adjust the minimum sample size, avoid type II error; Differential privacy injection: add Laplace noise ε≤0.1 in the behavior feature collection stage to meet the GDPR compliance requirements; Federal feature aggregation: each terminal extracts behavior features locally, and only uploads encrypted gradient parameters to the central server; Parallel test deployment: based on OpenFlow protocol to dynamically route user requests; Multi-version comparison: support A / B / N test; Drift detection: use LSTM-Autoencoder to calculate behavior distribution offset in real time; Confidence interval analysis: calculate the 95% confidence interval of the improvement effect; SHAP value analysis: analyze model decision differences; Attention mechanism visualization: compare the attention differences of Transformer model in A / B groups; Federal model update: update the global model by encrypting and aggregating the optimal model parameters of B group through Secure Aggregation, inject GAN generated malicious behavior samples to strengthen the robustness of the new model, and record all A / B test operations to Hyperledger Fabric chain to ensure that the process cannot be tampered with; Closed-loop knowledge base construction: deposit experimental conclusions in graph database to assist subsequent hypothesis generation.

[0016] 3. Beneficial effects

[0017] Compared with the prior art, the present application has the following advantages: (1) The present application fuses online learning and edge computing: LSTM-Autoencoder detects behavior drift in real time, performs first round risk judgment locally on the terminal, reports high-risk events to the cloud to reduce network load, and updates the model through A / B test under the federal learning framework, and the iteration period is compressed from week level to hour level.

[0018] (2) The application balances privacy and security, original data does not leave the local, combines a differential privacy noise mechanism, meets GDPR compliance requirements, realizes decision traceability through SHAP explanation and blockchain audit, solves the trust crisis of black box models, responds to behavior mutations through online learning and drift detection, and reduces the false positive rate. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 A step flowchart of the method for accurately analyzing Internet user behavior based on artificial intelligence. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the application. EMBODIMENT

[0021] Please refer to Figure 1 A method for accurately analyzing Internet user behavior based on artificial intelligence, comprising: S1, data acquisition and privacy enhancement processing; S2, behavior modeling and transparent analysis; S3, real-time risk prevention and abuse blocking; S4, feedback loop and continuous optimization.

[0022] In specific embodiments of the application, online learning and edge computing are fused: LSTM-Autoencoder detects behavior drift in real time, layered defense performs the first round of risk judgment locally on the terminal, only high-risk events are reported to the cloud, network load is reduced, under the federated learning framework, the model is updated through A / B testing, and the iteration cycle is compressed from weekly to hourly.

[0023] Specifically, the step S1 comprises: Multi-source heterogeneous data acquisition: user login behavior, browsing trajectory and interactive event raw data are obtained through burying points, API interfaces and crawler systems, covering website, mobile terminal and social platform channels; Terminal log acquisition: mobile terminal / website burying point data are added with noise through local differential privacy iOS RAPPOR algorithm, and then uploaded to the server; Field filtering: necessary fields of business are collected, and sensitive information is shielded, the necessary fields including click events and browsing duration, and the sensitive information including home address and income; Dynamic transparency reporting: show data usage to users, support real-time authorization revocation; Missing value processing: use KNN interpolation or random forest prediction to fill missing values; Anomaly detection: identify and filter abnormal access based on Isolation Forest or Z-score statistics; Generalization and masking: keep the first 6 digits of the ID number, and blur the IP address to C segment, to ensure that each record is indistinguishable from at least K-1 records under the quasi-identifier.

[0024] In specific embodiments of the application, multi-source data is collected by distributed crawler, terminal log adds Laplace noise by RAPPOR algorithm, sensitive field is processed by K-anonymity and masking, AI classifier labels sensitivity and differentiates encryption, field filtering and dynamic transparency reporting support user authorization revocation, reduce the risk of sensitive information leakage, KNN interpolation and Isolation Forest clean up abnormal values, improve the accuracy of subsequent modeling.

[0025] Specifically, the crawler system is a distributed crawler system, the distributed crawler system uses Apache Nifi priority queue to manage tasks, dynamically adjusts the crawling depth / breadth, and reduces redundancy by combining incremental crawling strategy, the API interface transmits third-party data through TLS / SSL encryption to ensure transmission security, wherein the third-party data includes weather, financial API; The AI-driven classification and grading in step S1 uses a sensitivity labeling model and differential encryption, the sensitivity labeling model uses a text classifier of BERT or CNN to automatically label data levels, and uses AES-256 encryption for high-sensitive data and lightweight ChaCha20 algorithm for low-sensitive data.

[0026] In specific embodiments of the application, the distributed crawler uses an incremental strategy to reduce redundancy, the API interface transmits third-party data through TLS / SSL encryption, the sensitivity labeling model automatically classifies data, high-sensitive data is decrypted and processed in TEE, and encryption transmission and incremental crawling reduce network overhead, TEE hardware isolation blocks external theft, and reduces the risk of data leakage.

[0027] Specifically, the privacy computing architecture used in step S1 includes: DP differential privacy: add Laplace noise to statistical results to ensure that individuals are not traceable; FL federated learning: when sample features overlap, the client locally trains the model and uploads gradient parameters, when sample IDs overlap, intermediate parameters are exchanged through homomorphic encryption using the Paillier algorithm, and the model is updated jointly; TEE Trusted Execution Environment: Process decrypted data in Intel SGX hardware isolation area, block external theft; Data sandbox: Model only accesses desensitized data set, original data is physically isolated; The dynamic risk prevention and control architecture used in the step S1 comprises: LSTM-UEBA model: Establish baseline based on user historical behavior, detect deviation in real time, and trigger account lock; Adversarial testing: Inject GAN to generate adversarial samples to fake traffic and test model robustness; Adaptive epsilon allocation: Dynamically adjust privacy budget according to data sensitivity, dynamically adjust privacy budget for high-sensitive fields with epsilon less than or equal to 0.1 or low-sensitive fields with epsilon less than or equal to 1.0; Federal aggregation optimization: Use FedAvg algorithm for weighted average or K-modes algorithm for multi-label clustering to solve non-independent and identically distributed data problems.

[0028] In specific embodiments of the present application, federated learning selects horizontal or vertical mode according to scene, LSTM-UEBA model establishes behavior baseline, GAN generates adversarial samples to test robustness, privacy budget is adaptively allocated, homomorphic encryption realizes safe parameter exchange when sample ID is aligned, UEBA model detects deviation in real time, and account lock response delay is less than 50ms.

[0029] Specifically, the step S2 comprises: Behavior modeling: Extract time series features through sliding window statistics, construct heterogeneous graph based on user-device-application interaction relationship, and generate node embedding vector using GraphSAGE; Dynamic baseline modeling: Use DBSCAN or HDBSCAN to cluster normal behavior to form initial baseline, use Isolation Forest or LSTM-Autoencoder to construct dynamic baseline based on historical normal behavior data, and identify behaviors deviating from normal patterns; Online learning update: Use streaming K-means++ to dynamically adjust baseline cluster center, reconstruct behavior sequence error as anomaly score, and trigger baseline update when error exceeds threshold; Multi-modal fusion modeling: Train LSTM or Transformer model locally on each terminal, upload only gradient to aggregation server, and server aggregates gradient through FedAvg to generate global model and then distribute it; Personalized fine-tuning: Client uses PerFedHAR algorithm to fine-tune global model based on local data to adapt to individual behavior differences; Transparent analysis mechanism: SHAP explainability anomaly detection, quantify feature contribution value, use SHAP or LIME to explain model output, use Transformer model embedded attention mechanism to visualize key behavior nodes, generate readable reports.

[0030] In specific embodiments of the application, sliding window extracts time series features, GraphSAGE generates user-device embedding vectors, DBSCAN clusters normal behavior, streaming K-means++ dynamically updates the baseline, federated aggregation of global models, clients are personalized by PerFedHAR fine-tuning, SHAP and attention mechanism visualize key nodes, graph embedding captures complex relationships, improves behavior recognition accuracy, PerFedHAR solves Non-IID data problems, and improves local model F1-score.

[0031] Specifically, the algorithm used in step S2 includes: XGBoost integrated decision tree: output feature importance; Attention mechanism: embed attention layers in LSTM or Transformer, visualize key behavior nodes.

[0032] In specific embodiments of the application, XGBoost outputs feature importance, Transformer multi-head attention layer highlights key behavior nodes, and attention heat map and SHAP report reduce false complaint rate.

[0033] Specifically, step S3 includes: Adversarial sample testing: generate FGSM algorithm adversarial sample injection test set, evaluate model robustness and false positive rate; Consistency verification: compare the decision consistency of deep learning models and white box models, and detect model bias; Secure aggregation: use Secure Multi-Party Computation to encrypt gradients to prevent servers from reverse-engineering raw data; Data abuse prevention: Hyperledger Fabric's permission log based on blockchain, all model access behavior is audited on-chain; Minimize data retention: anonymized data is automatically deleted after analysis, only aggregated statistical results are retained; Dynamic policy adjustment: combine Q-Learning reinforcement learning to optimize blocking actions and minimize false positive rate, Real-time abuse blocking: when abnormal behavior is detected, it is automatically triggered, based on BGP diversion to clean DDoS traffic, update firewall blacklist, pop up MFA secondary authentication or risk warning, use LSTM network to calculate behavior deviation in real time, and block when the threshold is exceeded.

[0034] In specific embodiments of the application, FGSM adversarial sample tests model blind spots, blockchain records all operations, Q-Learning optimizes blocking strategies, LSTM network calculates deviation in real time, super-threshold triggers MFA secondary authentication, blockchain audit chain ensures operations are tamper-proof, reduces false positive rate, and dynamic speed limit ensures normal user experience.

[0035] Specifically, the layered defense architecture in step S3 includes: Network layer: discard abnormal IP packets based on OpenFlow protocol to issue flow table rules; Application layer: dynamic speed limit or session termination through Token Bucket algorithm; Data layer: trigger encryption lock or data sandbox isolation to block sensitive file export.

[0036] In specific embodiments of the application, the network layer discards abnormal IP packets through OpenFlow, the application layer dynamically limits speed or terminates sessions, and the data layer sandbox isolates sensitive files. The three-layer linkage reduces DDoS attack cleaning delay to within 100ms.

[0037] Specifically, step S4 includes: Real-time decision interpretation: SHAP value contribution to XGBoost risk score model output features; Attention visualization: embed multi-head attention layer in Transformer model to highlight key behavior nodes; User-side transparent transmission: risk alert with visual report; GAN-generated adversarial samples: simulate new attack behaviors to test model blind spots; Consistency verification: compare decision consistency between deep learning model and logistic regression to detect bias; Anonymized retention: automatically delete original data after analysis, only retaining aggregated statistical results processed by differential privacy; Blockchain audit chain: all model access and data operation records are recorded on the chain to ensure operations are tamper-proof; Dynamic access control: dynamically authorize data access rights based on attributes; Closed-loop optimization effect evaluation: calculate Pareto frontier of privacy budget consumption epsilon and F1-score model accuracy, measure response delay and false positive rate, and drive iteration based on A / B testing.

[0038] In specific embodiments of the application, SHAP explains risk score basis, GAN simulates new attack test model, privacy budget and F1-score pareto frontier evaluate privacy-utility balance, ABAC dynamic authorization access, anonymization retention and automatic deletion reduce storage cost, and pareto optimization improves model accuracy.

[0039] Specifically, the A / B test driven iteration step includes: Goal setting and hypothesis formation: set quantifiable goals according to risk control needs; Hypothesis: based on the output of the behavior baseline model, put forward verifiable hypotheses; Single variable principle: only adjust target parameters, keep other feature engineering consistent; Layered shunt mechanism: based on user risk level, divide into high risk group / low risk group, randomly allocate to control group A group or experimental group B group within each group, ensure group homogeneity; Dynamic sample size calculation: use statistical power Power=0.8 and significance level α=0.05 to dynamically adjust the minimum sample size, avoid type II error; Differential privacy injection: add Laplace noise ε≤0.1 in the behavior feature collection stage to meet the GDPR compliance requirements; Federal feature aggregation: each terminal extracts behavior features locally and only uploads encrypted gradient parameters to the central server; Parallel test deployment: based on OpenFlow protocol to dynamically route user requests; Multi-version comparison: support A / B / N testing; Drift detection: use LSTM-Autoencoder to calculate behavior distribution offset in real time; Confidence interval analysis: calculate the 95% confidence interval of the improvement effect; SHAP value analysis: analyze model decision differences; Attention mechanism visualization: compare the attention differences of Transformer model in A / B groups; Federal model update: update the global model by encrypting and aggregating the optimal model parameters of B group through Secure Aggregation, inject GAN generated malicious behavior samples, strengthen the robustness of the new model, and record all A / B test operations to the Hyperledger Fabric chain to ensure the process is tamper-proof; Closed-loop knowledge base construction: deposit experimental conclusions in graph database to assist subsequent hypothesis generation.

[0040] In specific embodiments of the present application, hierarchical flow splitting ensures inter-group homogeneity, federal feature aggregation encrypts the gradient, the winning model parameter updates the global model through Secure Aggregation, dynamic sample size calculation avoids type II errors, and federal aggregation protects privacy and improves accuracy.

[0041] The above merely describes preferred specific embodiments of the present application, but the scope of protection of the present application is not limited thereto, and any person skilled in the art can make equivalent replacements or changes to the technical solutions and improved concepts of the present application within the technical scope disclosed by the present application, which should be covered within the scope of protection of the present application.

Claims

1. An artificial intelligence-based precise analysis method for Internet user behavior, characterized in that, Comprise: S1, data collection and privacy enhancement processing; S2, behavior modeling and transparent analysis; S3, real-time risk prevention and abuse blocking; S4, feedback loop and continuous optimization. 2.The method of claim 1, wherein, The step S1 comprises: Multi-source heterogeneous data collection: obtain user login behavior, browsing track and interaction event raw data through burying points, API interface and crawler system, covering website, mobile terminal and social platform channels; Terminal log collection: add noise to mobile terminal / website burying point data through local differential privacy iOS RAPPOR algorithm, and then upload to server; Field filtering: collect necessary fields of business, shield sensitive information, the necessary fields include click event, browsing time, the sensitive information includes home address, income; Dynamic transparency report: show data use to user, support real-time authorization withdrawal; Missing value processing: fill in missing values by KNN interpolation or random forest prediction; Abnormal value detection: identify and filter abnormal access based on Isolation Forest or Z-score statistical method; Generalization and masking: keep the first 6 digits of ID number, blur IP address to C segment, ensure that each record is indistinguishable from at least K-1 records under quasi-identifier. 3.The method of claim 2, wherein, The crawler system is a distributed crawler system, which uses Apache Nifi priority queue to manage tasks, dynamically adjusts crawling depth / breadth, combines incremental crawling strategy to reduce redundancy, and uses TLS / SSL encryption transmission to obtain third-party data through API interface, to ensure transmission security, wherein the third-party data includes weather, financial API; The AI-driven classification and grading in step S1 uses sensitivity labeling model and differential encryption, the sensitivity labeling model uses BERT or CNN text classifier to automatically label data level, and uses AES-256 encryption for high sensitive data and lightweight ChaCha20 algorithm for low sensitive data. 4.The method of claim 3, wherein the method further comprises: The privacy computing architecture used in step S1 comprises: DP differential privacy: add Laplace noise to statistical results to ensure that individuals are not traceable; FL federated learning: when sample characteristics overlap, client trains model locally, uploads gradient parameters, when sample ID overlaps, exchanges intermediate parameters through Paillier algorithm for homomorphic encryption, and updates model jointly; TEE trusted execution environment: process decrypted data in Intel SGX hardware isolation area to block external theft; Data sandbox: model only accesses desensitized data set, and original data is physically isolated; The dynamic risk prevention architecture used in step S1 comprises: LSTM-UEBA model: establish baseline based on user historical behavior, detect deviation in real time, and trigger account lock; Adversarial testing: inject GAN generated adversarial samples to fake traffic and test model robustness; Adaptive epsilon allocation: dynamically adjust privacy budget according to data sensitivity, dynamically adjust privacy budget for high sensitive field with epsilon less than or equal to 0.1 or low sensitive field with epsilon less than or equal to 1.0; Federal aggregation optimization: use FedAvg algorithm weighted average or K-modes algorithm multi-label clustering to solve non-independent and identically distributed data problem. 5.The method of claim 4, wherein, The step S2 includes: Behavior modeling: Extract time series features through sliding window statistics, construct a heterogeneous graph based on user-device-application interaction relationships, and generate node embedding vectors using GraphSAGE; Dynamic baseline modeling: Cluster normal behaviors using DBSCAN or HDBSCAN to form an initial baseline, and construct a dynamic baseline using Isolation Forest or LSTM-Autoencoder based on historical normal behavior data to identify behaviors deviating from the normal pattern; Online learning update: Dynamically adjust the baseline cluster center using streaming K-means++, reconstruct the behavior sequence error as an anomaly score, and trigger baseline update if the error exceeds the threshold; Multi-modal fusion modeling: Train LSTM or Transformer models locally on each terminal, upload only the gradient to the aggregation server, and generate a global model after aggregating the gradient using FedAvg; Personalized fine-tuning: Use PerFedHAR algorithm on the client side to fine-tune the global model based on local data to adapt to individual behavior differences; Transparent analysis mechanism: Quantify feature contribution values using SHAP explainability anomaly detection, explain model output using SHAP or LIME, visualize key behavior nodes using the attention mechanism embedded in the Transformer model, and generate readable reports. 6.The method of claim 5, wherein the method further comprises: The algorithms used in the step S2 include: XGBoost integrated decision tree: Output feature importance; Attention mechanism: Embed attention layers in LSTM or Transformer to visualize key behavior nodes. 7.The method of claim 6, wherein the method further comprises: The step S3 includes: Adversarial sample testing: Generate FGSM algorithm adversarial samples to inject into the test set to evaluate model robustness and false positive rate; Consistency verification: Compare the decision consistency of deep learning models and white-box models to detect model bias; Secure aggregation: Use Secure Multi-Party Computation to encrypt gradients to prevent the server from reverse-engineering the original data; Data abuse prevention: Hyperledger Fabric uses blockchain-based permission logs to audit all model access behaviors; Minimize data retention: Anonymized data is automatically deleted after analysis, and only aggregated statistical results are retained; Dynamic policy adjustment: Optimize blocking actions using Q-Learning reinforcement learning to minimize false positive rate, Real-time abuse blocking: Automatically trigger when abnormal behavior is detected, update firewall blacklist based on BGP to clean DDoS traffic, pop up MFA secondary authentication or risk alert, use LSTM network to calculate behavior deviation in real time, and block if the threshold is exceeded. 8.The method of claim 7, wherein the method further comprises: The layered defense architecture in the step S3 includes: Network layer: Discard abnormal IP packets based on OpenFlow protocol flow table rules; Application layer: Dynamically limit speed or terminate sessions through Token Bucket algorithm; Data layer: Trigger encryption lock or data sandbox isolation to block sensitive file export. 9.The method of claim 8, wherein, The step S4 includes: Real-time decision explanation: SHAP values are used to explain the feature contributions to the XGBoost risk score model output. Attention visualization: Multi-head attention layers are embedded in the Transformer model to highlight key behavioral nodes. User-side transparent transmission: Risk alerts come with visual reports. GAN-generated adversarial samples: Simulate new attack behaviors to test model blind spots. Consistency verification: Compare the decision consistency of deep learning models and logistic regression to detect bias. Anonymized retention: Analyze and automatically delete original data, retaining only aggregated statistical results processed with differential privacy. Blockchain audit chain: All model access and data operation records are recorded on the chain to ensure that operations cannot be tampered with. Dynamic access control: Attribute-based dynamic authorization of data access rights. Closed-loop optimization effect evaluation: Calculate the Pareto frontier of privacy budget consumption ε and F1-score model accuracy, measure response delay and false positive rate, and drive iteration based on A / B testing. 10.The method of claim 9, wherein the method further comprises: The A / B test-driven iteration step includes: Goal setting and hypothesis formation: Set quantifiable goals based on risk control needs. Hypothesis: Propose verifiable hypotheses based on behavioral baseline model output. Single-variable principle: Only adjust target parameters while keeping other feature engineering consistent. Layered and shunted mechanism: Based on user risk level, divide into high-risk group / low-risk group, and randomly assign each group to control group A or experimental group B to ensure group homogeneity. Dynamic sample size calculation: Use statistical power Power=0.8 and significance level α=0.05 to dynamically adjust the minimum sample size to avoid type II errors. Differential privacy injection: Add Laplace noise ε≤0.1 during behavior feature collection to meet GDPR compliance requirements. Federal feature aggregation: Each terminal extracts behavioral features locally and only uploads encrypted gradient parameters to the central server. Parallel test deployment: Based on the OpenFlow protocol, dynamically route user requests. Multi-version comparison: Supports A / B / N testing. Drift detection: Use LSTM-Autoencoder to calculate behavioral distribution drift in real time. Confidence interval analysis: Calculate the 95% confidence interval of the improvement effect. SHAP value analysis: Analyze model decision differences. Attention mechanism visualization: Compare the attention differences of the Transformer model in A / B groups. Federal model update: Update the global model by encrypting and aggregating the optimal model parameters from group B using Secure Aggregation, inject GAN-generated malicious behavior samples to strengthen the robustness of the new model, and record all A / B test operations on the Hyperledger Fabric chain to ensure the process cannot be tampered with. Closed-loop knowledge base construction: Store experimental conclusions in a graph database to assist subsequent hypothesis generation.

Images