A precise analysis method for internet user behavior based on artificial intelligence

Abstract

This invention discloses an artificial intelligence-based method for precise analysis of internet user behavior, belonging to the field of internet technology. It includes S1 data collection and privacy enhancement processing, S2 behavior modeling and transparent analysis, S3 real-time risk prevention and abuse blocking, and S4 feedback loop and continuous optimization. This invention, while analyzing user behavior, also overcomes the traditional conflict between privacy and efficiency, and achieves a systemic leap in both security and efficiency.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and more specifically, to a method for precise analysis of Internet user behavior based on artificial intelligence. Background Technology

[0002] In today's digital age, the internet generates massive amounts of user behavior data. By analyzing this data, businesses and platforms can gain a deeper understanding of user needs, preferences, and behavioral patterns, thereby providing personalized services, optimizing product design, and developing precise marketing strategies. However, traditional user behavior analysis methods have many limitations.

[0003] Traditional centralized training requires centralized data, but privacy regulations restrict cross-domain sharing. Data from a single institution is insufficient to cover all behavioral patterns, resulting in weak model generalization ability. Raw data aggregated on servers is vulnerable to attacks. The decision-making process of deep learning is opaque, leading users to question the impartiality of the analysis results. Risk control systems based on fixed thresholds are unable to adapt to new types of attacks. Centralized models require data to be sent back to servers for analysis, with peak latency exceeding 500ms and 90% of bandwidth consumed in raw data transmission. Offline training takes several weeks and cannot respond to behavioral drift in real time. Summary of the Invention

[0004] 1. Technical problems to be solved

[0005] In view of the problems existing in the prior art, the purpose of this invention is to provide an artificial intelligence-based method for accurate analysis of Internet user behavior. This invention can not only analyze user behavior, but also break through the traditional contradiction between privacy and efficiency, and achieve a systematic leap in security and efficiency.

[0006] 2. Technical Solution

[0007] To solve the above problems, the present invention adopts the following technical solution:

[0008] A method for precise analysis of internet user behavior based on artificial intelligence, comprising:

[0009] S1. Data collection and enhanced privacy processing;

[0010] S2, Behavioral Modeling and Transparency Analysis;

[0011] S3. Real-time risk prevention and abuse prevention;

[0012] S4, feedback loop and continuous optimization.

[0013] As a preferred embodiment of the present invention, step S1 includes:

[0014] Multi-source heterogeneous data collection: Raw data on user login behavior, browsing history and interaction events are obtained through tracking points, API interfaces and crawler systems, covering website, mobile and social platform channels;

[0015] Terminal log collection: Data from mobile devices / websites is used to add noise using the local differential privacy iOS RAPPOR algorithm before being uploaded to the server;

[0016] Field filtering: Collect necessary fields for business operations and filter sensitive information. The necessary fields include click events and browsing duration, and the sensitive information includes home address and income.

[0017] Dynamic transparency reports: Show users how the data is used and support real-time authorization revocation;

[0018] Missing value handling: KNN imputation or random forest prediction is used to fill in missing values;

[0019] Outlier detection: Identify and filter out anomalous accesses based on Isolation Forest or Z-score statistical methods;

[0020] Generalization and masking: The first 6 digits of the ID number are retained, and the IP address is blurred to the C segment, ensuring that each record is indistinguishable from at least K-1 records under the quasi-identifier.

[0021] As a preferred embodiment of the present invention, the crawler system is a distributed crawler system. The distributed crawler system uses Apache Nifi priority queue to manage tasks, dynamically adjusts the crawling depth / breadth, and combines incremental crawling strategies to reduce redundancy. The API interface obtains third-party data through TLS / SSL encrypted transmission to ensure transmission security. The third-party data includes weather and financial APIs.

[0022] In step S1, the AI-driven classification and grading adopts a sensitivity labeling model and differential encryption. The sensitivity labeling model uses a text classifier such as BERT or CNN to automatically label data levels. Highly sensitive data is encrypted using AES-256, and low-sensitivity data is encrypted using the lightweight ChaCha20 algorithm.

[0023] As a preferred embodiment of the present invention, the privacy computing architecture used in step S1 includes:

[0024] DP Differential Privacy: Add Laplace noise to statistical results to ensure that individuals are not traceable;

[0025] FL Federated Learning: When sample features overlap, the client trains the model locally and uploads the gradient parameters. When sample IDs overlap, intermediate parameters are exchanged using the Paillier algorithm with homomorphic encryption, and the model is updated jointly.

[0026] TEE Trusted Execution Environment: Processes decrypted data within an Intel SGX hardware isolation zone, preventing external theft;

[0027] Data sandbox: The model only accesses the anonymized dataset, and the original data is physically isolated;

[0028] The dynamic risk control architecture used in step S1 includes:

[0029] LSTM-UEBA model: Establishes a baseline based on users' historical behavior, detects deviations in real time, and triggers account lockout;

[0030] Adversarial testing: Injecting GAN to generate adversarial examples to forge traffic, and verifying the robustness of the model;

[0031] Adaptive ε allocation: Dynamically adjusts the privacy budget based on data sensitivity, dynamically adjusting the privacy budget for fields with ε≤0.1 (high sensitivity) or ε≤1.0 (low sensitivity);

[0032] Federated aggregation optimization: The FedAvg algorithm for weighted averaging or the K-modes algorithm for multi-label clustering is used to solve the problem of non-independent and identically distributed data.

[0033] As a preferred embodiment of the present invention, step S2 includes:

[0034] Behavioral modeling: Extract time-series features statistically using a sliding window, construct a heterogeneous graph based on user-device-application interaction relationships, and use GraphSAGE to generate node embedding vectors;

[0035] Dynamic baseline modeling: Use DBSCAN or HDBSCAN to cluster normal behaviors to form an initial baseline. Based on historical normal behavior data, use Isolation Forest or LSTM-Autoencoder to construct a dynamic baseline to identify behaviors that deviate from the normal pattern.

[0036] Online learning update: Use streaming K-means++ to dynamically adjust the baseline cluster centers, reconstruct the behavioral sequence error as the outlier score, and trigger the baseline update when the error exceeds the threshold;

[0037] Multimodal fusion modeling: Each terminal trains an LSTM or Transformer model locally, only uploading gradients to the aggregation server. The server aggregates gradients using FedAvg, generates a global model, and then distributes it.

[0038] Personalized fine-tuning: The client uses the PerFedHAR algorithm to fine-tune the global model based on local data to adapt to individual behavioral differences;

[0039] Transparent analysis mechanism: SHAP interpretability anomaly detection quantifies feature contribution values, interprets model output using SHAP or LIME, visualizes key behavioral nodes using the attention mechanism embedded in the Transformer model, and generates readable reports.

[0040] As a preferred embodiment of the present invention, the algorithm used in step S2 includes:

[0041] XGBoost Ensemble Decision Tree: Output Feature Importance;

[0042] Attention mechanism: Embed attention layers in LSTM or Transformer to visualize key behavior nodes.

[0043] As a preferred embodiment of the present invention, step S3 includes:

[0044] Adversarial example testing: Generate an adversarial example injection test set for the FGSM algorithm to evaluate the model's robustness and false alarm rate;

[0045] Consistency verification: Compare the decision consistency between deep learning models and white-box models to detect model bias;

[0046] Secure aggregation: Employs Secure Multi-Party Computation to encrypt gradients, preventing the server from reverse-engineering the original data;

[0047] Data abuse prevention: Hyperledger Fabric uses blockchain-based permission logs, and all model access behaviors are audited on the blockchain;

[0048] Minimize data retention: Anonymized data is automatically expired and deleted after analysis, retaining only the aggregated statistical results;

[0049] Dynamic strategy adjustment: Combining Q-Learning reinforcement learning to optimize blocking actions and minimize false positives.

[0050] Real-time abuse blocking: When abnormal behavior is detected, it is automatically triggered, and DDoS traffic is diverted and cleaned based on BGP to update the firewall blacklist. An MFA secondary authentication or risk warning pops up, and the behavior deviation is calculated in real time using LSTM network. If the deviation exceeds the threshold, it is blocked.

[0051] As a preferred embodiment of the present invention, the layered defense architecture in step S3 includes:

[0052] Network layer: Flow table rules are issued based on the OpenFlow protocol, and abnormal IP packets are discarded;

[0053] Application layer: Dynamically limit rate or terminate sessions using the Token Bucket algorithm;

[0054] Data layer: Triggers encryption locks or data sandbox isolation to prevent sensitive files from being transferred outside.

[0055] As a preferred embodiment of the present invention, step S4 includes:

[0056] Real-time decision interpretation: The contribution of SHAP values ​​to the output features of the XGBoost risk scoring model;

[0057] Attention visualization: Embed a multi-head attention layer in the Transformer model to highlight key behavior nodes;

[0058] User-side transparent transmission: Risk alerts are accompanied by visual reports;

[0059] GAN generates adversarial examples: simulating novel attack behaviors and testing model blind spots;

[0060] Consistency verification: Compare the decision consistency between deep learning models and logistic regression to detect bias;

[0061] Anonymization retention: The original data is automatically deleted after analysis, and only the aggregated statistical results with differential privacy processing are retained;

[0062] Blockchain audit chain: All model access and data operation records are recorded on the chain to ensure that the operations cannot be tampered with;

[0063] Dynamic access control: dynamically authorizing data access permissions based on attributes;

[0064] Closed-loop optimization effect evaluation: Calculate the Pareto front of privacy budget consumption ε and F1-score model accuracy, measure response latency and false positive rate, and drive iteration based on A / B testing.

[0065] As a preferred embodiment of the present invention, the A / B test-driven iteration step includes:

[0066] Target setting and hypothesis formation: Set quantifiable targets based on risk control needs;

[0067] Hypothesis Proposal: Verifiable hypotheses are proposed based on the output of the behavioral baseline model;

[0068] Single-variable principle: Only adjust the target parameter, keeping other feature engineering consistent;

[0069] Stratified triage mechanism: Users are divided into high-risk groups and low-risk groups based on their risk level. Within each group, users are randomly assigned to either the control group A or the experimental group B to ensure homogeneity between groups.

[0070] Dynamic sample size calculation: The minimum sample size is dynamically adjusted using statistical power Power=0.8 and significance level α=0.05 to avoid Type II errors;

[0071] Differential privacy injection: Laplace noise ε≤0.1 is added during the behavioral feature collection stage to meet GDPR compliance requirements;

[0072] Federated feature aggregation: Each terminal extracts behavioral features locally and only uploads encrypted gradient parameters to the central server;

[0073] Parallel test deployment: Dynamically routing user requests based on the OpenFlow protocol;

[0074] Multi-version comparison: Supports A / B / N testing;

[0075] Drift detection: Real-time calculation of behavior distribution offset using LSTM-Autoencoder;

[0076] Confidence interval analysis: Calculate the 95% confidence interval for the improvement effect;

[0077] SHAP value analysis: Analyzing differences in model decisions;

[0078] Attention mechanism visualization: Comparison of the differences in attention points of the Transformer model in groups A and B;

[0079] Federated model update: The optimal model parameters of group B are encrypted and aggregated through Secure Aggregation to update the global model, and malicious behavior samples generated by GAN are injected to enhance the robustness of the new model. All A / B test operations are recorded to the Hyperledger Fabric chain to ensure that the process is immutable.

[0080] Closed-loop knowledge base construction: Experimental conclusions are stored in a graph database to assist in the generation of subsequent hypotheses.

[0081] 3. Beneficial effects

[0082] Compared with the prior art, the advantages of this invention are:

[0083] (1) This invention integrates online learning and edge computing: LSTM-Autoencoder detects behavior drift in real time, and layered defense performs the first round of risk judgment locally on the terminal. Only high-risk events are reported to the cloud, reducing network load. Under the federated learning framework, the model is hot-updated through A / B testing, and the iteration cycle is compressed from the weekly level to the hourly level.

[0084] (2) This invention achieves a balance between privacy and security, ensures that the original data does not leave the local area, combines differential privacy noise mechanism to meet GDPR compliance requirements, realizes decision traceability through SHAP interpretation and blockchain audit, solves the trust crisis of black box model, and responds to behavioral mutations through online learning and drift detection to reduce false alarm rate. Attached Figure Description

[0085] Figure 1 This is a flowchart illustrating the steps of an artificial intelligence-based method for precise analysis of internet user behavior according to the present invention. Detailed Implementation

[0086] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention. Example:

[0087] Please see Figure 1 A method for precise analysis of internet user behavior based on artificial intelligence, comprising:

[0088] S1. Data collection and enhanced privacy processing;

[0089] S2, Behavioral Modeling and Transparency Analysis;

[0090] S3. Real-time risk prevention and abuse prevention;

[0091] S4, feedback loop and continuous optimization.

[0092] In a specific embodiment of the present invention, by integrating online learning and edge computing: LSTM-Autoencoder detects behavioral drift in real time, layered defense performs the first round of risk assessment locally on the terminal, and only high-risk events are reported to the cloud, reducing network load. Under the federated learning framework, the model is hot-updated through A / B testing, and the iteration cycle is compressed from weekly to hourly.

[0093] Specifically, step S1 includes:

[0094] Multi-source heterogeneous data collection: Raw data on user login behavior, browsing history and interaction events are obtained through tracking points, API interfaces and crawler systems, covering website, mobile and social platform channels;

[0095] Terminal log collection: Data from mobile devices / websites is used to add noise using the local differential privacy iOS RAPPOR algorithm before being uploaded to the server;

[0096] Field filtering: Collect necessary fields for business operations and filter sensitive information. The necessary fields include click events and browsing duration, and the sensitive information includes home address and income.

[0097] Dynamic transparency reports: Show users how the data is used and support real-time authorization revocation;

[0098] Missing value handling: KNN imputation or random forest prediction is used to fill in missing values;

[0099] Outlier detection: Identify and filter out anomalous accesses based on Isolation Forest or Z-score statistical methods;

[0100] Generalization and masking: The first 6 digits of the ID number are retained, and the IP address is blurred to the C segment, ensuring that each record is indistinguishable from at least K-1 records under the quasi-identifier.

[0101] In a specific embodiment of the present invention, multi-source data is collected by distributed crawlers, terminal logs are added with Laplace noise using the RAPPOR algorithm, sensitive fields are processed by K-anonymization and masking, AI classifiers mark sensitivity and then encrypt differentially, field filtering and dynamic transparency reports support user authorization revocation to reduce the risk of sensitive information leakage, and KNN interpolation and Isolation Forest clean up outliers to improve the accuracy of subsequent modeling.

[0102] Specifically, the crawler system is a distributed crawler system. The distributed crawler system uses Apache Nifi priority queues to manage tasks, dynamically adjusts the crawling depth / breadth, and combines incremental crawling strategies to reduce redundancy. The API interface obtains third-party data through TLS / SSL encrypted transmission to ensure transmission security. The third-party data includes weather and financial APIs.

[0103] In step S1, the AI-driven classification and grading adopts a sensitivity labeling model and differential encryption. The sensitivity labeling model uses a text classifier such as BERT or CNN to automatically label data levels. Highly sensitive data is encrypted using AES-256, and low-sensitivity data is encrypted using the lightweight ChaCha20 algorithm.

[0104] In a specific embodiment of the present invention, the distributed crawler adopts an incremental strategy to reduce redundancy, the API interface transmits third-party data through TLS / SSL encryption, the sensitivity labeling model automatically classifies data, highly sensitive data is decrypted and processed within the TEE, encrypted transmission and incremental crawling reduce network overhead, and the TEE hardware isolation blocks external theft and reduces the risk of data leakage.

[0105] Specifically, the privacy computing architecture used in step S1 includes:

[0106] DP Differential Privacy: Add Laplace noise to statistical results to ensure that individuals are not traceable;

[0107] FL Federated Learning: When sample features overlap, the client trains the model locally and uploads the gradient parameters. When sample IDs overlap, intermediate parameters are exchanged using the Paillier algorithm with homomorphic encryption, and the model is updated jointly.

[0108] TEE Trusted Execution Environment: Processes decrypted data within an Intel SGX hardware isolation zone, preventing external theft;

[0109] Data sandbox: The model only accesses the anonymized dataset, and the original data is physically isolated;

[0110] The dynamic risk control architecture used in step S1 includes:

[0111] LSTM-UEBA model: Establishes a baseline based on users' historical behavior, detects deviations in real time, and triggers account lockout;

[0112] Adversarial testing: Injecting GAN to generate adversarial examples to forge traffic, and verifying the robustness of the model;

[0113] Adaptive ε allocation: Dynamically adjusts the privacy budget based on data sensitivity, dynamically adjusting the privacy budget for fields with ε≤0.1 (high sensitivity) or ε≤1.0 (low sensitivity);

[0114] Federated aggregation optimization: The FedAvg algorithm for weighted averaging or the K-modes algorithm for multi-label clustering is used to solve the problem of non-independent and identically distributed data.

[0115] In a specific embodiment of the present invention, federated learning selects horizontal or vertical modes according to the scenario, the LSTM-UEBA model establishes a behavioral baseline, GAN generates adversarial examples to test robustness, privacy budget is adaptively allocated, homomorphic encryption realizes secure parameter exchange when sample IDs are aligned, the UEBA model detects deviations in real time, and the account lockout response latency is <50ms.

[0116] Specifically, step S2 includes:

[0117] Behavioral modeling: Extract time-series features statistically using a sliding window, construct a heterogeneous graph based on user-device-application interaction relationships, and use GraphSAGE to generate node embedding vectors;

[0118] Dynamic baseline modeling: Use DBSCAN or HDBSCAN to cluster normal behaviors to form an initial baseline. Based on historical normal behavior data, use Isolation Forest or LSTM-Autoencoder to construct a dynamic baseline to identify behaviors that deviate from the normal pattern.

[0119] Online learning update: Use streaming K-means++ to dynamically adjust the baseline cluster centers, reconstruct the behavioral sequence error as the outlier score, and trigger the baseline update when the error exceeds the threshold;

[0120] Multimodal fusion modeling: Each terminal trains an LSTM or Transformer model locally, only uploading gradients to the aggregation server. The server aggregates gradients using FedAvg, generates a global model, and then distributes it.

[0121] Personalized fine-tuning: The client uses the PerFedHAR algorithm to fine-tune the global model based on local data to adapt to individual behavioral differences;

[0122] Transparent analysis mechanism: SHAP interpretability anomaly detection quantifies feature contribution values, interprets model output using SHAP or LIME, visualizes key behavioral nodes using the attention mechanism embedded in the Transformer model, and generates readable reports.

[0123] In a specific embodiment of the present invention, a sliding window extracts temporal features, GraphSAGE generates user-device embedding vectors, DBSCAN clusters normal behavior, streaming K-means++ dynamically updates the baseline, federated aggregation of the global model, the client performs personalized fine-tuning through PerFedHAR, SHAP and attention mechanisms visualize key nodes, graph embedding captures complex relationships to improve behavior recognition accuracy, PerFedHAR solves the Non-IID data problem and improves the local model's F1-score.

[0124] Specifically, the algorithm used in step S2 includes:

[0125] XGBoost Ensemble Decision Tree: Output Feature Importance;

[0126] Attention mechanism: Embed attention layers in LSTM or Transformer to visualize key behavior nodes.

[0127] In a specific embodiment of the present invention, XGBoost outputs feature importance, Transformer multi-head attention layer highlights key behavioral nodes, and attention heatmap and SHAP report reduce the false positive complaint rate.

[0128] Specifically, step S3 includes:

[0129] Adversarial example testing: Generate an adversarial example injection test set for the FGSM algorithm to evaluate the model's robustness and false alarm rate;

[0130] Consistency verification: Compare the decision consistency between deep learning models and white-box models to detect model bias;

[0131] Secure aggregation: Employs Secure Multi-Party Computation to encrypt gradients, preventing the server from reverse-engineering the original data;

[0132] Data abuse prevention: Hyperledger Fabric uses blockchain-based permission logs, and all model access behaviors are audited on the blockchain;

[0133] Minimize data retention: Anonymized data is automatically expired and deleted after analysis, retaining only the aggregated statistical results;

[0134] Dynamic strategy adjustment: Combining Q-Learning reinforcement learning to optimize blocking actions and minimize false positives.

[0135] Real-time abuse blocking: When abnormal behavior is detected, it is automatically triggered, and DDoS traffic is diverted and cleaned based on BGP to update the firewall blacklist. An MFA secondary authentication or risk warning pops up, and the behavior deviation is calculated in real time using LSTM network. If the deviation exceeds the threshold, it is blocked.

[0136] In a specific embodiment of the present invention, FGSM is used to test blind spots in adversarial sample testing models, blockchain records all operations, Q-Learning optimizes blocking strategies, LSTM network calculates deviation in real time, MFA secondary authentication is triggered when the threshold is exceeded, blockchain audit chain ensures that operations are tamper-proof, reduces data abuse events, Q-Learning reduces false positives, and dynamic rate limiting ensures a normal user experience.

[0137] Specifically, the layered defense architecture in step S3 includes:

[0138] Network layer: Flow table rules are issued based on the OpenFlow protocol, and abnormal IP packets are discarded;

[0139] Application layer: Dynamically limit rate or terminate sessions using the Token Bucket algorithm;

[0140] Data layer: Triggers encryption locks or data sandbox isolation to prevent sensitive files from being transferred outside.

[0141] In a specific embodiment of the present invention, the network layer discards abnormal IP packets through OpenFlow, the application layer dynamically limits the rate or terminates the session, and the data layer isolates sensitive files through a sandbox. The three-layer linkage reduces the DDoS attack cleanup latency to within 100ms.

[0142] Specifically, step S4 includes:

[0143] Real-time decision interpretation: The contribution of SHAP values ​​to the output features of the XGBoost risk scoring model;

[0144] Attention visualization: Embed a multi-head attention layer in the Transformer model to highlight key behavior nodes;

[0145] User-side transparent transmission: Risk alerts are accompanied by visual reports;

[0146] GAN generates adversarial examples: simulating novel attack behaviors and testing model blind spots;

[0147] Consistency verification: Compare the decision consistency between deep learning models and logistic regression to detect bias;

[0148] Anonymization retention: The original data is automatically deleted after analysis, and only the aggregated statistical results with differential privacy processing are retained;

[0149] Blockchain audit chain: All model access and data operation records are recorded on the chain to ensure that the operations cannot be tampered with;

[0150] Dynamic access control: dynamically authorizing data access permissions based on attributes;

[0151] Closed-loop optimization effect evaluation: Calculate the Pareto front of privacy budget consumption ε and F1-score model accuracy, measure response latency and false positive rate, and drive iteration based on A / B testing.

[0152] In specific embodiments of the present invention, SHAP explains the basis of risk scoring, GAN simulates a novel attack test model, privacy budget and F1-score Pareto front assess privacy-utility balance, ABAC dynamically authorizes access, anonymization retention and automatic deletion reduce storage costs, and Pareto optimization improves model accuracy.

[0153] Specifically, the A / B test-driven iteration steps include:

[0154] Target setting and hypothesis formation: Set quantifiable targets based on risk control needs;

[0155] Hypothesis Proposal: Verifiable hypotheses are proposed based on the output of the behavioral baseline model;

[0156] Single-variable principle: Only adjust the target parameter, keeping other feature engineering consistent;

[0157] Stratified triage mechanism: Users are divided into high-risk groups and low-risk groups based on their risk level. Within each group, users are randomly assigned to either the control group A or the experimental group B to ensure homogeneity between groups.

[0158] Dynamic sample size calculation: The minimum sample size is dynamically adjusted using statistical power Power=0.8 and significance level α=0.05 to avoid Type II errors;

[0159] Differential privacy injection: Laplace noise ε≤0.1 is added during the behavioral feature collection stage to meet GDPR compliance requirements;

[0160] Federated feature aggregation: Each terminal extracts behavioral features locally and only uploads encrypted gradient parameters to the central server;

[0161] Parallel test deployment: Dynamically routing user requests based on the OpenFlow protocol;

[0162] Multi-version comparison: Supports A / B / N testing;

[0163] Drift detection: Real-time calculation of behavior distribution offset using LSTM-Autoencoder;

[0164] Confidence interval analysis: Calculate the 95% confidence interval for the improvement effect;

[0165] SHAP value analysis: Analyzing differences in model decisions;

[0166] Attention mechanism visualization: Comparison of the differences in attention points of the Transformer model in groups A and B;

[0167] Federated model update: The optimal model parameters of group B are encrypted and aggregated through Secure Aggregation to update the global model, and malicious behavior samples generated by GAN are injected to enhance the robustness of the new model. All A / B test operations are recorded to the Hyperledger Fabric chain to ensure that the process is immutable.

[0168] Closed-loop knowledge base construction: Experimental conclusions are stored in a graph database to assist in the generation of subsequent hypotheses.

[0169] In a specific embodiment of the present invention, hierarchical flow ensures homogeneity between groups, federated feature aggregation encrypts gradients, the parameters of the winning model are updated to the global model via Secure Aggregation, dynamic sample size calculation avoids Type II errors, and federated aggregation improves accuracy while protecting privacy.

[0170] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and its improved concept, should be covered within the scope of protection of the present invention.

Claims

1. A method for precise analysis of internet user behavior based on artificial intelligence, characterized in that, include: S1. Data collection and enhanced privacy processing; S2, Behavioral Modeling and Transparency Analysis; S3. Real-time risk prevention and abuse prevention; S4, Feedback Loop and Continuous Optimization; Step S1 includes: Multi-source heterogeneous data collection: Raw data on user login behavior, browsing history and interaction events are obtained through tracking points, API interfaces and crawler systems, covering website, mobile and social platform channels; Terminal log collection: Data from mobile devices / websites is used to add noise using the local differential privacy iOS RAPPOR algorithm before being uploaded to the server; Field filtering: Collect necessary fields for business operations and filter sensitive information. The necessary fields include click events and browsing duration, and the sensitive information includes home address and income. Dynamic transparency reports: Show users how the data is used and support real-time authorization revocation; Missing value handling: KNN imputation or random forest prediction is used to fill in missing values; Outlier detection: Identify and filter out anomalous accesses based on Isolation Forest or Z-score statistical methods; Generalization and masking: The first 6 digits of the ID number are retained, and the IP address is blurred to the C segment, ensuring that each record is indistinguishable from at least K-1 records under the quasi-identifier; Step S2 includes: Behavioral modeling: Extract time-series features statistically using a sliding window, construct a heterogeneous graph based on user-device-application interaction relationships, and use GraphSAGE to generate node embedding vectors; Dynamic baseline modeling: Use DBSCAN or HDBSCAN to cluster normal behaviors to form an initial baseline. Based on historical normal behavior data, use Isolation Forest or LSTM-Autoencoder to construct a dynamic baseline to identify behaviors that deviate from the normal pattern. Online learning update: Use streaming K-means++ to dynamically adjust the baseline cluster centers, reconstruct the behavioral sequence error as the outlier score, and trigger the baseline update when the error exceeds the threshold; Multimodal fusion modeling: Each terminal trains an LSTM or Transformer model locally, only uploading gradients to the aggregation server. The server aggregates gradients using FedAvg, generates a global model, and then distributes it. Personalized fine-tuning: The client uses the PerFedHAR algorithm to fine-tune the global model based on local data to adapt to individual behavioral differences; Transparent analysis mechanism: SHAP interpretability anomaly detection quantifies feature contribution values, interprets model output using SHAP or LIME, visualizes key behavioral nodes using the Transformer model's embedded attention mechanism, and generates readable reports.

2. The method for precise analysis of internet user behavior based on artificial intelligence according to claim 1, characterized in that, The crawler system is a distributed crawler system. The distributed crawler system uses Apache Nifi priority queue to manage tasks, dynamically adjusts the crawling depth / breadth, and combines incremental crawling strategies to reduce redundancy. The API interface obtains third-party data through TLS / SSL encrypted transmission to ensure transmission security. The third-party data includes weather and financial APIs. In step S1, the AI-driven classification and grading adopts a sensitivity labeling model and differential encryption. The sensitivity labeling model uses a text classifier such as BERT or CNN to automatically label data levels. Highly sensitive data is encrypted using AES-256, and low-sensitivity data is encrypted using the lightweight ChaCha20 algorithm.

3. The method for precise analysis of internet user behavior based on artificial intelligence according to claim 2, characterized in that, The privacy computing architecture used in step S1 includes: DP Differential Privacy: Add Laplace noise to statistical results to ensure that individuals are not traceable; FL Federated Learning: When sample features overlap, the client trains the model locally and uploads the gradient parameters. When sample IDs overlap, intermediate parameters are exchanged using the Paillier algorithm with homomorphic encryption, and the model is updated jointly. TEE Trusted Execution Environment: Processes decrypted data within an Intel SGX hardware isolation zone, preventing external theft; Data sandbox: The model only accesses the anonymized dataset, and the original data is physically isolated; The dynamic risk control architecture used in step S1 includes: LSTM-UEBA model: Establishes a baseline based on users' historical behavior, detects deviations in real time, and triggers account lockout; Adversarial testing: Injecting GAN to generate adversarial examples to forge traffic, and verifying the robustness of the model; Adaptive ε allocation: Dynamically adjusts the privacy budget based on data sensitivity, dynamically adjusting the privacy budget for fields with ε≤0.1 (high sensitivity) or ε≤1.0 (low sensitivity); Federated aggregation optimization: The FedAvg algorithm for weighted averaging or the K-modes algorithm for multi-label clustering is used to solve the problem of non-independent and identically distributed data.

4. The method for precise analysis of internet user behavior based on artificial intelligence according to claim 3, characterized in that, The algorithm used in step S2 includes: XGBoost Ensemble Decision Tree: Output Feature Importance; Attention mechanism: Embed attention layers in LSTM or Transformer to visualize key behavior nodes.

5. The method for precise analysis of internet user behavior based on artificial intelligence according to claim 4, characterized in that, Step S3 includes: Adversarial example testing: Generate an adversarial example injection test set for the FGSM algorithm to evaluate the model's robustness and false alarm rate; Consistency verification: Compare the decision consistency between deep learning models and white-box models to detect model bias; Secure aggregation: Employs Secure Multi-Party Computation to encrypt gradients, preventing the server from reverse-engineering the original data; Data abuse prevention: Hyperledger Fabric uses blockchain-based permission logs, and all model access behaviors are audited on the blockchain; Minimize data retention: Anonymized data is automatically expired and deleted after analysis, retaining only the aggregated statistical results; Dynamic strategy adjustment: Combining Q-Learning reinforcement learning to optimize blocking actions and minimize false positives. Real-time abuse blocking: When abnormal behavior is detected, it is automatically triggered, and DDoS traffic is diverted and cleaned based on BGP to update the firewall blacklist. An MFA secondary authentication or risk warning pops up, and the behavior deviation is calculated in real time using LSTM network. If the deviation exceeds the threshold, it is blocked.

6. The method for precise analysis of internet user behavior based on artificial intelligence according to claim 5, characterized in that, The layered defense architecture in step S3 includes: Network layer: Flow table rules are issued based on the OpenFlow protocol, and abnormal IP packets are discarded; Application layer: Dynamically limit rate or terminate sessions using the Token Bucket algorithm; Data layer: Triggers encryption locks or data sandbox isolation to prevent sensitive files from being transmitted outside.

7. The method for precise analysis of internet user behavior based on artificial intelligence according to claim 6, characterized in that, Step S4 includes: Real-time decision interpretation: The contribution of SHAP values ​​to the output features of the XGBoost risk scoring model; Attention visualization: Embed a multi-head attention layer in the Transformer model to highlight key behavior nodes; User-side transparent transmission: Risk alerts are accompanied by visual reports; GAN generates adversarial examples: simulating novel attack behaviors and testing model blind spots; Consistency verification: Compare the decision consistency between deep learning models and logistic regression to detect bias; Anonymization retention: The original data is automatically deleted after analysis, and only the aggregated statistical results with differential privacy processing are retained; Blockchain audit chain: All model access and data operation records are recorded on the chain to ensure that the operations cannot be tampered with; Dynamic access control: dynamically authorizing data access permissions based on attributes; Closed-loop optimization effect evaluation: Calculate the Pareto front of privacy budget consumption ε and F1-score model accuracy, measure response latency and false positive rate, and drive iteration based on A / B testing.

8. The method for precise analysis of internet user behavior based on artificial intelligence according to claim 7, characterized in that, The A / B test-driven iteration steps include: Target setting and hypothesis formation: Set quantifiable targets based on risk control needs; Hypothesis Proposal: Verifiable hypotheses are proposed based on the output of the behavioral baseline model; Single-variable principle: Only adjust the target parameter, keeping other feature engineering consistent; Stratified triage mechanism: Users are divided into high-risk groups and low-risk groups based on their risk level. Within each group, users are randomly assigned to either the control group A or the experimental group B to ensure homogeneity between groups. Dynamic sample size calculation: The minimum sample size is dynamically adjusted using statistical power Power=0.8 and significance level α=0.05 to avoid Type II errors; Differential privacy injection: Laplace noise ε≤0.1 is added during the behavioral feature collection stage to meet GDPR compliance requirements; Federated feature aggregation: Each terminal extracts behavioral features locally and only uploads encrypted gradient parameters to the central server; Parallel test deployment: Dynamically routing user requests based on the OpenFlow protocol; Multi-version comparison: Supports A / B / N testing; Drift detection: Real-time calculation of behavior distribution offset using LSTM-Autoencoder; Confidence interval analysis: Calculate the 95% confidence interval for the improvement effect; SHAP value analysis: Analyzing differences in model decisions; Attention mechanism visualization: Comparison of the differences in attention points of the Transformer model in groups A and B; Federated model update: The optimal model parameters of group B are encrypted and aggregated through Secure Aggregation to update the global model, and malicious behavior samples generated by GAN are injected to enhance the robustness of the new model. All A / B test operations are recorded to the Hyperledger Fabric chain to ensure that the process is immutable. Closed-loop knowledge base construction: Experimental conclusions are stored in a graph database to assist in the generation of subsequent hypotheses.

Images