Method and apparatus for monitoring and alerting dangerous behavior for internet platform

Abstract

The application discloses a dangerous behavior monitoring alarm method and device for an Internet platform, and relates to the technical field of monitoring and alarming, and comprises the following steps: acquiring a multi-modal user behavior data stream of the Internet platform in real time for multi-modal fusion analysis, and extracting user behavior joint features; performing dangerous behavior analysis based on the user behavior joint features, calculating a behavior risk probability, correlating a space-time context, and constructing a behavior risk graph; traversing the behavior risk graph to activate a dynamic alarm mechanism to generate a hierarchical alarm instruction, encrypting the hierarchical alarm instruction, sending the encrypted alarm message to a receiving terminal, and generating alarm response feedback data; performing incremental learning according to the alarm response feedback data, updating the behavior risk graph according to the learning result, and generating a hierarchical alarm optimization instruction. The application solves the technical problems of inaccurate dangerous behavior monitoring and untimely early warning in the prior art, and achieves the technical effects of improving the accuracy and real-time performance of dangerous behavior identification.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of monitoring and alarming, and particularly relates to a dangerous behavior monitoring and alarming method and device for an Internet platform. BACKGROUND

[0002] The behaviors of users of an Internet platform are complex and diverse, and traditional monitoring methods often rely on a single data dimension or fixed rules, which are difficult to identify potential high-risk behaviors in a timely manner. In the face of large-scale, multi-modal data environment, this method is prone to identification bias, resulting in insufficient detection accuracy of dangerous behaviors, delayed early warning information, and inability to provide timely and effective early warning for platform security protection. SUMMARY

[0003] The present application provides a dangerous behavior monitoring and alarming method and device for an Internet platform, which is used to solve the technical problems of inaccurate dangerous behavior monitoring and untimely early warning in the prior art.

[0004] In view of the above problems, the present application provides a dangerous behavior monitoring and alarming method and device for an Internet platform.

[0005] In a first aspect of the present application, a dangerous behavior monitoring and alarming method for an Internet platform is provided, which comprises:

[0006] The multi-modal user behavior data stream of the Internet platform is acquired in real time through a data acquisition interface for multi-modal fusion analysis, and user behavior joint features are extracted. Dangerous behavior analysis is performed based on the user behavior joint features, the behavior risk probability is calculated, the spatio-temporal context correlation is associated, and the behavior risk graph is constructed. The behavior risk graph is traversed to activate a dynamic alarm mechanism to generate a hierarchical alarm instruction, the hierarchical alarm instruction is encrypted, the encrypted alarm message is sent to a receiving terminal, and alarm response feedback data is generated. Incremental learning is performed according to the alarm response feedback data, the behavior risk graph is updated according to the learning result, and a hierarchical alarm optimization instruction is generated.

[0007] In a second aspect of the present application, a dangerous behavior monitoring and alarming device for an Internet platform is provided, which comprises:

[0008] The feature extraction module is used for acquiring multi-modal user behavior data streams of an Internet platform in real time through a data acquisition interface for multi-modal fusion analysis and extracting user behavior joint features; the dangerous behavior analysis module is used for performing dangerous behavior analysis based on the user behavior joint features, calculating behavior risk probabilities, performing space-time context correlation, and constructing a behavior risk graph; the feedback data generation module is used for traversing the behavior risk graph to activate a dynamic alarm mechanism to generate hierarchical alarm instructions, performing encryption processing on the hierarchical alarm instructions, sending encrypted alarm messages to a receiving terminal, and generating alarm response feedback data; and the instruction generation module is used for performing incremental learning according to the alarm response feedback data, updating the behavior risk graph according to a learning result, and generating hierarchical alarm optimization instructions.

[0009] The one or more technical solutions provided in the present application have at least the following technical effects or advantages:

[0010] The present application extracts user behavior joint features by acquiring multi-modal user behavior data streams of an Internet platform in real time through a data acquisition interface for multi-modal fusion analysis; performs dangerous behavior analysis based on the user behavior joint features, calculates behavior risk probabilities, performs space-time context correlation, and constructs a behavior risk graph; traverses the behavior risk graph to activate a dynamic alarm mechanism to generate hierarchical alarm instructions, performs encryption processing on the hierarchical alarm instructions, sends encrypted alarm messages to a receiving terminal, and generates alarm response feedback data; performs incremental learning according to the alarm response feedback data, updates the behavior risk graph according to a learning result, and generates hierarchical alarm optimization instructions. The present application solves the technical problems of inaccurate dangerous behavior monitoring and untimely early warning in the prior art, and achieves the technical effects of improving dangerous behavior recognition accuracy and real-time performance through multi-modal fusion analysis and dynamic hierarchical alarm. BRIEF DESCRIPTION OF DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0012] Figure 1 A dangerous behavior monitoring and alarm method flowchart for an Internet platform provided by the embodiments of the present application;

[0013] Figure 2 A dangerous behavior monitoring and alarm device structure diagram for an Internet platform provided by the embodiments of the present application.

[0014] Legend: feature extraction module 11, dangerous behavior analysis module 12, feedback data generation module 13, instruction generation module 14. DETAILED DESCRIPTION

[0015] The present application provides a dangerous behavior monitoring and alarming method and device for an Internet platform, aiming to solve the technical problems of inaccurate dangerous behavior monitoring and untimely early warning in the prior art, through multi-modal fusion analysis and dynamic hierarchical alarming, to achieve the technical effects of improving the accuracy and real-time of dangerous behavior identification.

[0016] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0017] It should be noted that any variation of the terms "comprise" and "have" is intended to cover non-exclusive inclusion, for example, a process, method, device, product or server comprising a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0018] Embodiment one, as shown in the present application provides a dangerous behavior monitoring and alarming method for an Internet platform, the method comprising: Figure 1

[0019] Step S100: Real-time acquisition of multi-modal user behavior data stream of the Internet platform through a data acquisition interface for multi-modal fusion analysis, and extraction of user behavior joint features.

[0020] In the embodiments of the present application, first, the multi-modal user behavior data stream of the Internet platform is acquired in real time through a data acquisition interface. That is, the various behavior forms of the user on the Internet platform are collected, such as text input, click operation, page browsing, voice communication and image uploading, etc., and these data collectively constitute the multi-modal user behavior data stream.

[0021] Next, multi-modal fusion analysis is performed on the multi-modal user behavior data stream. In this process, first, feature analysis is performed on the multi-modal user behavior data stream, and multi-modal feature parameters are extracted. Then, attention weighting calculation is performed on the multi-modal feature parameters to obtain a plurality of attention weights, and the multi-modal feature parameters are fused according to the attention weights to form initial fusion features. Finally, dimension unification processing is performed on the initial fusion features, main feature parameters are extracted and normalized mapping is completed, and user behavior joint features are constructed.​

[0022] Further, the method provided by the application embodiment further comprises:

[0023] performing feature analysis based on the multi-modal user behavior data stream to obtain multi-modal feature parameters; performing attention weighted calculation on the multi-modal feature parameters to obtain a plurality of attention weights; fusing the multi-modal feature parameters according to the plurality of attention weights to obtain initial fusion features; performing dimension unification processing on the initial fusion features to obtain main feature parameters; performing normalization mapping on the main feature parameters to construct the user behavior joint features.

[0024] In the application embodiment, when performing feature analysis based on the multi-modal user behavior data stream, text features are extracted by counting keyword appearance frequency and word frequency distribution for the text modality, acoustic feature parameters are extracted by using audio energy value and frequency spectrum features for the voice modality, visual feature parameters are obtained by color histogram features for the image modality, and behavior feature parameters are generated by counting indexes such as click times and stay time for the behavior log data. Through the process, multi-modal feature parameters are obtained.

[0025] Next, the multi-modal feature parameters are subjected to attention weighted calculation. In the process, the multi-modal feature parameters are input into an attention mechanism. Under the attention mechanism, a query vector (Query), a key vector (Key) and a value vector (Value) are first generated. The correlation scores between features are calculated by performing dot product operation on the query vector and the key vector. The correlation scores are normalized by a Softmax function to obtain a plurality of attention weights.

[0026] Subsequently, the multi-modal feature parameters are fused according to the plurality of attention weights, that is, each type of feature parameter is multiplied by the corresponding attention weight, and then the weighted results are added up to obtain a unified comprehensive representation vector. The comprehensive representation vector is the initial fusion feature.

[0027] After that, the initial fusion features are subjected to dimension unification processing. By using linear transformation, the dimension differences between different modalities are mapped, so that all features are compared and calculated in the same dimension space, and finally the main feature parameters are selected. The main feature parameters are the most representative information under the unified dimension, which are used to describe the user behavior mode.

[0028] Finally, the main feature parameters are subjected to normalization mapping. All feature values are mapped to the range of 0 to 1 by using the minimum-maximum normalization method. After normalization mapping, the user behavior joint features are formed.

[0029] Step S200: performing dangerous behavior analysis based on the user behavior joint features, calculating behavior risk probability, performing spatio-temporal context correlation, and constructing a behavior risk graph.

[0030] In the embodiments of the present application, when performing dangerous behavior analysis based on user behavior joint features, first, the historical dangerous behavior logs of the Internet platform are called to construct a dangerous behavior feature library. Then, the user behavior joint features are used as indexes to search and match the dangerous behavior feature library to generate a matching result containing data matching degrees. Subsequently, risk calculation is performed on individual behavior events of the user behavior joint features according to the data matching degrees to obtain multiple behavior risk probability values.

[0031] Next, spatio-temporal context analysis is performed based on the user behavior joint features to construct a spatio-temporal feature vector, and spatio-temporal correlation calculation is performed on the multiple behavior risk probability values and the spatio-temporal feature vector to obtain a spatio-temporal risk distribution graph containing behavior risk probability. Finally, spatio-temporal weighting is performed according to the behavior risk probability to construct a behavior risk graph.

[0032] Further, the method provided by the embodiments of the present application further includes the following steps:

[0033] The historical dangerous behavior logs of the Internet platform are called to construct a dangerous behavior feature library. The user behavior joint features are used as indexes to search and match the dangerous behavior feature library to generate a matching result containing data matching degrees. Risk calculation is performed on individual behavior events of the user behavior joint features according to the data matching degrees to obtain multiple behavior risk probability values. Spatio-temporal context analysis is performed based on the user behavior joint features to construct a spatio-temporal feature vector. Spatio-temporal correlation calculation is performed on the multiple behavior risk probability values and the spatio-temporal feature vector to obtain a spatio-temporal risk distribution graph containing behavior risk probability. Spatio-temporal weighting is performed according to the behavior risk probability to construct the behavior risk graph.

[0034] In the embodiments of the present application, first, the historical dangerous behavior logs of the Internet platform are called, and the historical dangerous behavior logs are standardized by time stamp, user ID, behavior type, location / IP, session ID, and the like, and are event-templated. The retrievable entries are organized in an inverted index manner to establish a dangerous behavior feature library for searching and comparison.

[0035] When the user behavior joint features are used as indexes to search and match the dangerous behavior feature library, TF-IDF vectorization is used to map the query and the entries in the library to the same vector space, and then the cosine similarity is used to calculate the similarity and sort it to generate a matching result containing similarity values, wherein the similarity values are used as data matching degrees.

[0036] Subsequently, the risk of the single behavior event of the user behavior joint feature is calculated according to the data matching degree. In this process, first, the matching degree range for calibration is determined, which is from the minimum value and the maximum value of the historical sample. Next, a probability scale equal in length to the range is established on a fixed interval, for example, 0 to 1. Then each data matching degree is corresponded to a unique scale of the probability interval according to its position in the calibration range. If the data matching degree exceeds the calibration range, the scale value of the starting point or the ending point of the probability interval is taken respectively. Finally, unified rounding is performed according to the preset decimal place, and the behavior risk probability value of each single behavior event is generated, obtaining a plurality of behavior risk probability values.

[0037] Afterwards, when the spatio-temporal context analysis is performed based on the user behavior joint feature, the sliding time window method is combined with the space grid division, the window width and the step length are set, the event frequency, the average time interval and the latest occurrence time are counted in each window. At the same time, the session environment or the access portal where the event is located is mapped to a unified logical space label, and the time statistics and the logical space label are spliced in a fixed order to obtain a spatio-temporal feature vector.

[0038] Then, the spatio-temporal correlation calculation is performed on the plurality of behavior risk probability values and the spatio-temporal feature vector. In this process, first, a three-dimensional spatio-temporal cubic space is constructed based on the spatio-temporal feature vector, and the plurality of behavior risk probability values are mapped into the space to obtain the spatial correlation strength through the spatial distance calculation. Then, the single behavior event is reversely identified by combining the spatial correlation strength and the behavior risk probability value, and a spatio-temporal correlation matrix is generated. Afterwards, the risk analysis is performed according to the spatio-temporal correlation matrix to determine the corresponding behavior risk probability. Finally, the risk distribution analysis is performed on the single behavior event based on the behavior risk probability, and a spatio-temporal risk distribution map containing the behavior risk probability is formed.

[0039] Finally, the spatio-temporal weighting is performed according to the behavior risk probability. In this process, the spatio-temporal density factor is determined based on the unit spatio-temporal calculation of the spatio-temporal correlation matrix, and the risk trend prediction is performed on the single behavior event by combining the behavior risk probability, obtaining a plurality of weight coefficients. Then, the single behavior event is mapped into a graph node and projected into a spatio-temporal coordinate system by using the spatio-temporal density factor, forming a risk distribution point array. Finally, the plurality of weight coefficients are mapped into the edges between the nodes, and the topological connection is performed on the risk distribution point array, obtaining a behavior risk graph.

[0040] Further, in the method provided by the application embodiment, the spatio-temporal correlation calculation is performed on the plurality of behavior risk probability values and the spatio-temporal feature vector, and a spatio-temporal risk distribution map is obtained, the spatio-temporal risk distribution map containing the behavior risk probability, and the method further comprises:

[0041] constructing a three-dimensional spatio-temporal cube space based on the spatio-temporal feature vector; mapping the plurality of behavior risk probability values to the three-dimensional spatio-temporal cube space for spatial distance calculation to obtain a spatial correlation strength; identifying a single behavior event in reverse according to the spatial correlation strength and the plurality of behavior risk probability values to construct a spatio-temporal correlation matrix; performing risk analysis according to the spatio-temporal correlation matrix to determine a behavior risk probability; and performing risk distribution analysis on the single behavior event according to the spatio-temporal correlation matrix based on the behavior risk probability to construct the spatio-temporal risk distribution map.

[0042] In the embodiments of the present application, when constructing a three-dimensional spatio-temporal cube space based on a spatio-temporal feature vector, a time bucketing and label encoding method is used to divide behavior time into continuous time buckets with fixed granularity, and logical positions such as function modules, session environments, and access portals are encoded into discrete indexes by labels, and then each event is placed into a three-dimensional array in the order of time bucket, logical position, and sequence position, to obtain a three-dimensional spatio-temporal cube space that can be retrieved and aggregated by coordinates.

[0043] Subsequently, the plurality of behavior risk probability values are mapped to the three-dimensional spatio-temporal cube space and spatial distance calculation is performed. In this process, the Euclidean distance method and the neighborhood retrieval method are used. First, the comparable neighboring event set is determined according to the coordinates of each event in the three-dimensional spatio-temporal cube space, then the Euclidean distance between the target event and the neighboring events is calculated one by one, and the distance is converted into a deterministic spatial correlation strength value according to the distance relationship, to obtain the spatial correlation strength.

[0044] Then, the single behavior event is identified in reverse according to the spatial correlation strength and in combination with the plurality of behavior risk probability values. In this process, the adjacency matrix method and the threshold screening method are used. First, each event is assigned a matrix row and column index, and a one-to-one correspondence table of event identification and row and column index is established, then the events that meet the pre-set conditions are written in the corresponding positions of the matrix to form a weight composed of the spatial correlation strength and the behavior risk probability value, while the mapping relationship between the event identification and the matrix position is preserved, to obtain the spatio-temporal correlation matrix.

[0045] Then, the risk analysis is performed according to the spatio-temporal correlation matrix to determine the behavior risk probability. In this process, first, the relevant entries of each event in the spatio-temporal correlation matrix are collected, the behavior risk probability values of the neighboring events are weighted and summed according to the weights recorded in the matrix to form a comprehensive score, then the comprehensive score is mapped to a fixed probability interval through quantile mapping rules, and a numerical result corresponding to each event is output, to obtain the behavior risk probability.

[0046] Finally, based on the behavior risk probability, the risk distribution of a single behavior event is analyzed according to the space-time correlation matrix. In this process, first, a fixed-size sliding window is set in the three-dimensional space-time cubic space, and the window is slid in the time dimension and the logical space dimension. The behavior risk probability in the window coverage range is weighted and averaged according to the adjacent relationship and written in the current position. After traversing the entire three-dimensional space-time cubic space, the distribution result is formed according to the time and logical space, and a space-time risk distribution map containing the behavior risk probability is obtained.

[0047] Further, the method provided by the application embodiment further comprises:

[0048] Based on the unit space-time calculation based on the space-time correlation matrix, the space-time density factor is determined. The risk trend of a single behavior event is predicted based on the behavior risk probability, a plurality of weight coefficients are generated according to the prediction result, the single behavior event is mapped to a graph node according to the space-time density factor, and a risk distribution dot array is generated. The plurality of weight coefficients are mapped to node edges, the risk distribution dot array is topologically connected, and the behavior risk graph is constructed.

[0049] In the application embodiment, when the unit space-time calculation based on the space-time correlation matrix is performed, the time bucketing method and the logical position grouping method are adopted. The behavior events are divided into continuous time buckets with a fixed granularity, and the events are grouped according to function modules, session environments or access entrances. The number of events in each time bucket and logical position intersection unit is accumulated, and is converted into the event density of each unit time and each unit logical position. The density is used as the space-time density factor. Through this process, the space-time density factor is determined.

[0050] Next, the risk trend of a single behavior event is predicted based on the behavior risk probability. In this process, first, a behavior risk probability sequence varying with time is established for each behavior event. The probability value of the latest time period is assigned a weight of one, the probability value of the previous time period is assigned a weight of one-half, the probability value of the second previous time period is assigned a weight of one-fourth, and so on. The sum of all weighted results is divided by the total weight to obtain the predicted risk probability value of the event. Then, the predicted risk probability value is compared with the current behavior risk probability, and the difference between the two is calculated. The difference is used as the basis for space-time weighting, and a set of deterministic weight coefficients is generated by combining the time interval and the space position of the event, and the weight coefficients are obtained.

[0051] Subsequently, individual behavior events are mapped to graph nodes and mapped to a space-time coordinate system according to a space-time density factor. In this process, the method of coordinate mapping is adopted, the time period number is taken as the time coordinate, the number of functional modules, conversation environments or access entrances is taken as the space coordinate, the order of events in the conversation is taken as the sequence coordinate, and each event is mapped to a unique position in the three-dimensional coordinate. At the same time, two attributes, behavior risk probability and space-time density factor, are attached to the position, and all event nodes are arranged in the space-time coordinate system to form a risk distribution lattice.

[0052] Finally, a plurality of weight coefficients are mapped to node edges and the risk distribution lattice is topologically connected. In this process, according to the corresponding relationship of events recorded in the space-time correlation matrix, event pairs that meet the preset conditions are selected as connection edges. The preset conditions include that the spatial correlation strength between events is greater than 0.5, the time interval between events does not exceed two time buckets, and the logical position codes of the two events belong to the same category. Only event pairs that meet all three conditions are considered to have effective contact and are allowed to establish edges in the risk distribution lattice. After the connection is established, the weight coefficients generated in the previous step are assigned to these edges. Specifically, when the risk trend difference of two events is positive, the weight coefficients of the two events are averaged after being added. When the risk trend difference of one event is positive and that of the other is negative, the absolute value of the weight coefficients of the two events is taken after being subtracted. When the risk trend difference of two events is negative, the weight coefficient of the two events is taken as the minimum value. Through this process, each edge has a clear numerical weight. All nodes and edges together form the overall structure, and finally form a behavior risk graph containing space-time density factor, behavior risk probability and weight coefficient.

[0053] Step S300: traversing the behavior risk graph activates a dynamic alarm mechanism to generate a hierarchical alarm instruction, encrypts the hierarchical alarm instruction, sends the encrypted alarm message to a receiving terminal, and generates alarm response feedback data.

[0054] In the embodiments of the present application, the behavior risk graph is first traversed, the real-time risk values of a plurality of nodes are calculated by breadth-first search, and compared with a plurality of risk threshold values, and a plurality of risk nodes are extracted. Subsequently, the plurality of risk nodes are reversely mapped to the risk graph, the node association path is extracted, and a plurality of risk levels are set according to the path relationship. Then, based on the plurality of risk levels, risk propagation analysis is performed to determine the risk propagation range, and a risk assessment result is generated through multi-dimensional alarm evaluation, and finally the hierarchical division is completed and the hierarchical alarm instruction is output.

[0055] The generated hierarchical alarm instruction is then subjected to multi-layer encryption processing to form initial encrypted information, and is segmented into a message header segment encrypted data, a message content segment encrypted data and a message verification segment encrypted data according to a standardized alarm message format, and the three types of data are then structuredly connected to construct an encrypted alarm message. Finally, the terminal is screened according to the hierarchical alarm instruction, the receiving terminal is determined, and the encrypted alarm message is sent, and after decryption and analysis at the receiving terminal, alarm response feedback data is generated.

[0056] Further, the method provided by the application embodiment further comprises:

[0057] The breadth-first search is performed on the behavior risk graph to calculate real-time risk values of multiple nodes, multi-level risk threshold values are set, the real-time risk values of the multiple nodes are compared with the multi-level risk threshold values, and multi-level risk nodes are extracted. The multi-level risk nodes are reversely mapped to the risk graph to extract multiple node association paths, multiple risk levels are set according to the multiple node association paths, risk propagation analysis is performed based on the multiple risk levels, a risk propagation range is determined, multi-dimensional alarm evaluation is performed according to the risk propagation range, and a risk evaluation result is generated. The risk evaluation result is divided into multiple levels, and the hierarchical alarm instruction is generated.

[0058] In the application embodiment, when the behavior risk graph is traversed, the breadth-first search method is used to access each node and its adjacent nodes in turn, and in the access process, the behavior risk probability of the node is used as a basis value, and the weight of the adjacent edge is combined for weighted summation, so as to obtain the real-time risk value of each node. Through the process, multiple node real-time risk values are obtained.

[0059] Next, a preset multi-level risk threshold value is introduced, the real-time risk values are compared with the threshold values one by one through a fixed threshold table, for example, 0.3, 0.6 and 0.9, the multi-level risk nodes meeting the conditions are screened out, and the nodes are grouped according to the threshold intervals, so as to form a set of first-level, second-level and third-level risk nodes.

[0060] The multi-level risk nodes are then reversely mapped to the risk graph and a plurality of node-associated paths are extracted. In this process, each multi-level risk node is taken as a starting point, a breadth-first search path enumeration is adopted, and the maximum number of hops is set to three, while the path is required to not contain repeated nodes to ensure a simple path. The maximum number of hops refers to the upper limit of the number of edges contained in the path from the starting node to the target node, i.e., the maximum length of the path. When another multi-level risk node is reached, a candidate path is recorded, and the edge weights of all edges on the path are accumulated to obtain a path score. To control the size, only the path with a higher score is retained for the same pair of starting and ending points, and a fixed number of candidate paths, for example, 50, are retained for each starting point, and then all the candidate paths of the starting points are combined. The determination of the path risk level follows the rule of first looking at the highest risk node level covered, and then looking at the path score. If the path covers a three-level multi-level risk node, it is marked as a three-level path. Otherwise, if it covers a two-level multi-level risk node, it is marked as a two-level path. Otherwise, it is marked as a one-level path. In the same level, the paths are sorted in descending order of path score and a certain number of representative paths are retained. Through this process, a plurality of node-associated paths with risk level labels and sorted after screening are obtained.

[0061] Next, risk propagation analysis is performed based on the plurality of risk levels, taking the two-level and three-level risk nodes as the propagation sources, and using an iterative propagation method to expand the risk influence range. In each round of propagation, the risk influence amount of the propagation source is distributed to the adjacent nodes according to the edge weight proportion, and the risk values of the adjacent nodes are accumulated. When the number of hops reaches three or the newly added accumulated risk value is less than 0.01, the propagation is stopped. Through this process, all nodes affected by the risk and their corresponding accumulated risk values are obtained, forming the risk propagation range. Then, multi-dimensional alarm evaluation is performed according to the risk propagation range. First, three evaluation indexes are selected, including the number of nodes in the propagation range, the average real-time risk value of the nodes in the propagation range, and the highest risk level involved in the propagation range. The three indexes are standardized to map data of different dimensions to a unified interval, and then weighted summation is performed according to the pre-allocated weights, for example, the node number weight is 0.4, the average real-time risk value weight is 0.4, and the highest risk level weight is 0.2. After calculation, a single numerical value is obtained as the risk evaluation result of the propagation range.

[0062] Finally, according to the risk evaluation result, multi-level division is performed and a hierarchical alarm instruction is generated. The risk evaluation result is mapped to a one-level hierarchical alarm instruction in the interval greater than or equal to 0.3 and less than 0.6, a two-level hierarchical alarm instruction in the interval greater than or equal to 0.6 and less than 0.9, and a three-level hierarchical alarm instruction in the interval greater than or equal to 0.9.

[0063] Further, the method provided by the application embodiment further comprises:

[0064] The hierarchical alarm instruction is subjected to multi-layer encryption processing to generate initial encryption information; a standardized alarm message format is defined, and the initial encryption information is subjected to segmentation processing according to the standardized alarm message format to generate multi-segment encryption data, the multi-segment encryption data including message header segment encryption data, message content segment encryption data and message verification segment encryption data; the message header segment encryption data, the message content segment encryption data and the message verification segment encryption data are subjected to structured connection to construct an encrypted alarm message; the receiving terminal is determined according to the hierarchical alarm instruction; and the encrypted alarm message is sent to the receiving terminal for tracking to obtain the alarm response feedback data.

[0065] In the application embodiment, when the hierarchical alarm instruction is subjected to multi-layer encryption processing, the hierarchical alarm instruction is first parsed to obtain its instruction structure, and a hierarchical encryption architecture is set based on the instruction structure. Under the architecture, a first encryption layer, a second encryption layer and a third signature layer are sequentially constructed. The hierarchical alarm instruction is subjected to symmetric encryption through the first encryption layer to generate content ciphertext. The symmetric encryption key used is subjected to asymmetric encryption through the second encryption layer to generate key ciphertext. Finally, the content ciphertext and the key ciphertext are verified through the third signature layer, thereby completing the multi-layer encryption processing and constructing the initial encryption information.

[0066] Subsequently, when the standardized alarm message format is defined and the initial encryption information is segmented into multi-segment encryption data, a fixed field segmentation method is adopted. The initial encryption information is divided into message header segment encryption data, message content segment encryption data and message verification segment encryption data, wherein the message header segment encryption data includes a version number and a timestamp, the message content segment encryption data carries the content ciphertext, and the message verification segment encryption data carries the key ciphertext and signature data. Through the division process, the multi-segment encryption data is obtained.

[0067] Subsequently, when the message header segment encryption data, the message content segment encryption data and the message verification segment encryption data are subjected to structured connection, a sequential splicing method is adopted. The message header segment encryption data, the message content segment encryption data and the message verification segment encryption data are sequentially arranged in the order of message header segment encryption data-message content segment encryption data-message verification segment encryption data, and an integrity check field is added at the end to finally obtain the encrypted alarm message.

[0068] Next, when the terminal is selected according to the hierarchical alarm instruction, an access control list-based method is adopted. The target terminal identifier included in the hierarchical alarm instruction is read and compared with the access control list, and only the terminal that meets the permission condition is selected as the receiving terminal. Through this screening, the final receiving terminal is obtained.

[0069] Finally, the encrypted alarm message is sent to the receiving terminal and tracked, and an encryption transmission method based on the TLS protocol is adopted. The encrypted alarm message is transmitted securely and completely through TLS during transmission, and the receiving terminal decrypts and verifies the message after receiving it, and returns the processing result as alarm response feedback data.

[0070] Further, the method provided by the application embodiment further comprises:

[0071] analyzing the hierarchical alarm instruction to obtain an instruction structure, setting a hierarchical encryption architecture according to the instruction structure, and performing multi-layer encryption processing on the hierarchical alarm instruction through the hierarchical encryption architecture: S1: constructing a first encryption layer, a second encryption layer, and a third signature layer; S2: performing symmetric encryption on the hierarchical alarm instruction through the first encryption layer to generate content ciphertext; S3: performing asymmetric encryption on the symmetric encryption key through the second encryption layer to generate key ciphertext; and S4: verifying the content ciphertext and the key ciphertext through the third signature layer to construct the initial encryption information.

[0072] In the application embodiment, when the hierarchical alarm instruction is analyzed, the field order and the hierarchical relationship of the hierarchical alarm instruction are first read, the instruction content, the parameter domain, and the execution condition are identified, and it is verified whether the mandatory fields exist and the values are valid, and accordingly the instruction structure is formed. Next, the hierarchy and the field mapping of the hierarchical encryption architecture are set according to the instruction structure.

[0073] In the preparation stage of the multi-layer encryption processing of the hierarchical alarm instruction through the hierarchical encryption architecture, a sequential configuration method is adopted. The first encryption layer, the second encryption layer, and the third signature layer are sequentially created, and the content field, the key configuration, and the signature required identifier in the instruction structure are respectively bound to the corresponding positions of the three layers, the one-to-one correspondence between the layers and the data fields is completed, and thus the first encryption layer, the second encryption layer, and the third signature layer that can be directly executed are obtained.

[0074] When the hierarchical alarm instruction is encrypted in the first encryption layer, a symmetric encryption method is adopted. The content part of the hierarchical alarm instruction is input into the symmetric encryption process, the same symmetric key is used to complete the encryption, the ciphertext data equal in length to the original content is output, and the necessary initial vector or encryption parameter is recorded. The content ciphertext used for subsequent transmission and verification is obtained through the process.

[0075] In the second encryption layer, the asymmetric encryption method is used to protect the key. The symmetric key is encrypted with the public key of the receiver to generate a key ciphertext that can only be decrypted by the private key of the receiver, and the identification corresponding to the public key is retained for the receiver to select the correct decryption credentials. Through this process, the key ciphertext is obtained to match the content ciphertext.

[0076] In the third signature layer, the digital signature method is used to complete the integrity and source verification. The digital signature is generated with the content ciphertext and the key ciphertext as input, and the public key identification or certificate information for verification is attached, so that the receiver can verify the validity of the signature and the data has not been tampered with. Under the premise that the signature is generated and can be verified, the content ciphertext, the key ciphertext and the signature are combined in a specified order to build the initial encrypted information.

[0077] Step S400: Incremental learning is performed according to the alarm response feedback data, the learning result is mapped to the behavior risk graph for updating, and a hierarchical alarm optimization instruction is generated.

[0078] In the embodiment of the application, first, incremental learning is performed according to the alarm response feedback data to obtain a learning result. Then, the learning result is integrated and the alarm response feedback data is traversed to realize dynamic identification of dangerous behavior information. Subsequently, the dangerous behavior information is mapped to the behavior risk graph, and the original behavior risk probability is recalculated to obtain a behavior risk optimization probability. Then, based on the risk optimization probability, the nodes of the graph are traversed for risk analysis to obtain node risk value change parameters, and based on the node risk value change parameters, the weights of the edges in the graph are updated to obtain new edge connection update weights. Finally, the node risk value change parameters and the edge connection update weights are combined to update the topology of the behavior risk graph, and a corresponding hierarchical alarm optimization instruction is generated.

[0079] Further, in the method provided by the application, incremental learning is performed according to the alarm response feedback data, the learning result is mapped to the behavior risk graph for updating, and a hierarchical alarm optimization instruction is generated, which further includes:

[0080] The alarm response feedback data is used as a training sample for incremental learning to obtain a learning result. The learning result is integrated and the alarm response feedback data is traversed for dynamic identification to determine dangerous behavior information. The dangerous behavior information is mapped to the behavior risk graph to recalculate the behavior risk probability to obtain a behavior risk optimization probability. Based on the behavior risk optimization probability, the nodes of the graph are traversed for risk analysis to obtain node risk value change parameters. According to the node risk value change parameters, the weights of the edges of the nodes are updated to obtain edge connection update weights. According to the node risk value change parameters and the edge connection update weights, the topology of the behavior risk graph is updated to generate a hierarchical alarm optimization instruction.

[0081] In the embodiment of the present application, when the alarm response feedback data is used as a training sample for incremental learning, the batch incremental update method is used to incorporate the alarm response feedback data into the existing sample in the order of arrival, calculate the error between the current parameters and the feedback label for each data, and make a small correction to the parameters by a certain step. After the correction is completed, it is immediately used for the calculation of the next data, until the processing of the current batch of data is completed, and the learning result is obtained.

[0082] Subsequently, when the integrated learning result is used to traverse the alarm response feedback data for dynamic identification, first, the features of a single data are linearly standardized to fall within a unified value interval. Then, according to the learning result, the corresponding weight is loaded, the standardized features and the weight are multiplied and accumulated item by item, and the risk value of the data is calculated. The risk value is used in the dynamic identification stage, which represents the risk level of the feedback event. Then, the risk value is compared with the preset multi-level threshold value, and the corresponding risk level is output, and the dangerous behavior information is formed by combining the event identification and time elements.

[0083] After the dangerous behavior information is mapped to the behavior risk graph and the behavior risk probability is recalculated, the node matching and probability recalculation method is used. According to the event identification, the dangerous behavior information is mapped to the related node in the graph, and the existing behavior risk probability of the node is numerically corrected according to the actual result in the feedback. The correct alarm is raised, the false alarm is lowered, and the missed alarm is raised to the threshold value. The replacement and write-back are completed, and the optimized behavior risk probability is obtained.

[0084] Next, when the behavior risk optimization probability is used to traverse the graph nodes for risk analysis, the difference measurement method is used. The probability values before and after optimization of each graph node are read, the numerical difference between the two values is calculated, and the increasing or decreasing direction is recorded to form a standardized change. For example, node A is adjusted from 0.55 to 0.68, which is recorded as an increase of 0.13. According to this, a comparable change record is generated for all nodes, and the node risk value change parameter is obtained.

[0085] Next, when the node risk value change parameter is used to update the weight of the node edge, the linear weighted update method is used. For each edge, the risk value change parameters of the two end nodes are averaged to obtain the correction amount of the edge, the correction amount is added to the original edge weight in a fixed proportion, and the results exceeding the value range are truncated. For example, the two end nodes change by 0.10 and 0.04, respectively, the average correction amount is 0.07, and the updated weight of the edge connection is obtained after the proportional addition and write-back.

[0086] Finally, in the topological update of the behavior risk graph according to the change of the node risk value parameter and the update of the weight of the edge connection, a threshold update and connection adjustment method is adopted, edges below the lower threshold are deleted, connections of node pairs exceeding the upper threshold and meeting the adjacent constraint are established or strengthened, and the risk distribution and level mapping are recalculated based on the updated node probability and edge weight to form an executable alarm strategy, and finally a hierarchical alarm optimization instruction is generated.

[0087] In the embodiments of the present application, the above-mentioned technical effects are achieved.

[0088] The present application obtains multi-modal user behavior data stream of an Internet platform in real time through a data acquisition interface for multi-modal fusion analysis, extracts user behavior joint features, performs dangerous behavior analysis based on the user behavior joint features, calculates behavior risk probability for spatio-temporal context association, constructs a behavior risk graph, traverses the behavior risk graph to activate a dynamic alarm mechanism to generate a hierarchical alarm instruction, encrypts the hierarchical alarm instruction, sends the encrypted alarm message to a receiving terminal, generates alarm response feedback data, performs incremental learning according to the alarm response feedback data, updates the behavior risk graph according to the learning result, and generates a hierarchical alarm optimization instruction. The present application solves the technical problems of inaccurate dangerous behavior monitoring and untimely early warning in the prior art, and achieves the technical effects of improving the accuracy and real-time performance of dangerous behavior recognition through multi-modal fusion analysis and dynamic hierarchical alarm.

[0089] In the embodiments of the present application, the above-mentioned technical effects are achieved. Figure 2 As shown in the above-mentioned embodiments, the present application provides a dangerous behavior monitoring and alarm device for an Internet platform, and the device and method embodiments in the present application are based on the same inventive concept. The device comprises:

[0090] The feature extraction module 11 is configured to obtain multi-modal user behavior data stream of an Internet platform in real time through a data acquisition interface for multi-modal fusion analysis, extract user behavior joint features, and perform dangerous behavior analysis based on the user behavior joint features. The dangerous behavior analysis module 12 is configured to calculate behavior risk probability for spatio-temporal context association, and construct a behavior risk graph. The feedback data generation module 13 is configured to traverse the behavior risk graph to activate a dynamic alarm mechanism to generate a hierarchical alarm instruction, encrypt the hierarchical alarm instruction, send the encrypted alarm message to a receiving terminal, and generate alarm response feedback data. The instruction generation module 14 is configured to perform incremental learning according to the alarm response feedback data, update the behavior risk graph according to the learning result, and generate a hierarchical alarm optimization instruction.

[0091] Further, the device is also configured to implement the following functions:

[0092] perform feature analysis based on the multi-modal user behavior data stream to obtain multi-modal feature parameters; perform attention weighting calculation on the multi-modal feature parameters to obtain a plurality of attention weights; fuse the multi-modal feature parameters according to the plurality of attention weights to obtain initial fusion features; perform dimension unification processing on the initial fusion features to obtain main feature parameters for normalization mapping, and construct the user behavior joint features.

[0093] Further, the apparatus is further configured to implement the following functions:

[0094] retrieve a historical dangerous behavior log of an Internet platform to construct a dangerous behavior feature library; search and match the dangerous behavior feature library by taking the user behavior joint features as indexes to generate a matching result, wherein the matching result includes a data matching degree; perform risk calculation on a single behavior event of the user behavior joint features according to the data matching degree to obtain a plurality of behavior risk probability values; perform spatio-temporal context analysis based on the user behavior joint features to construct a spatio-temporal feature vector; perform spatio-temporal correlation calculation on the plurality of behavior risk probability values and the spatio-temporal feature vector to obtain a spatio-temporal risk distribution map, wherein the spatio-temporal risk distribution map includes a behavior risk probability; and perform spatio-temporal weighting according to the behavior risk probability to construct the behavior risk graph.

[0095] Further, the apparatus is further configured to implement the following functions:

[0096] construct a three-dimensional spatio-temporal cubic space based on the spatio-temporal feature vector; map the plurality of behavior risk probability values to the three-dimensional spatio-temporal cubic space for spatial distance calculation to obtain a spatial correlation strength; identify a single behavior event in reverse according to the spatial correlation strength in combination with the plurality of behavior risk probability values to construct a spatio-temporal correlation matrix; perform risk analysis according to the spatio-temporal correlation matrix to determine a behavior risk probability; and perform risk distribution analysis on a single behavior event according to the spatio-temporal correlation matrix based on the behavior risk probability to construct the spatio-temporal risk distribution map.

[0097] Further, the apparatus is further configured to implement the following functions:

[0098] perform unit spatio-temporal calculation based on the spatio-temporal correlation matrix to determine a spatio-temporal density factor; perform risk trend prediction on a single behavior event based on the behavior risk probability, generate a plurality of weight coefficients according to a prediction result for spatio-temporal weighting of the single behavior event; map the single behavior event to a graph node according to the spatio-temporal density factor and map the graph node to a spatio-temporal coordinate system to generate a risk distribution dot array; map the plurality of weight coefficients to node edges to topologically connect the risk distribution dot array, and construct the behavior risk graph.

[0099] Further, the device is also used to realize the following functions:

[0100] The breadth-first search is performed on the behavior risk graph, real-time risk values of multiple nodes are calculated, multiple-level risk threshold values are set, the multiple-level risk threshold values are compared with the real-time risk values of the multiple nodes, multiple-level risk nodes are extracted, the multiple-level risk nodes are reversely mapped to the risk graph to extract multiple node-associated paths, multiple risk levels are set according to the multiple node-associated paths, risk propagation analysis is performed based on the multiple risk levels, a risk propagation range is determined, multi-dimensional alarm evaluation is performed according to the risk propagation range, and a risk evaluation result is generated; the risk evaluation result is divided into multiple levels, and the hierarchical alarm instruction is generated.

[0101] Further, the device is also used to realize the following functions:

[0102] The hierarchical alarm instruction is subjected to multi-layer encryption processing to generate initial encryption information, a standardized alarm message format is defined, the initial encryption information is subjected to segmentation processing according to the standardized alarm message format to generate multiple segments of encryption data, the multiple segments of encryption data include message header segment encryption data, message content segment encryption data, and message verification segment encryption data, the message header segment encryption data, the message content segment encryption data, and the message verification segment encryption data are subjected to structured connection to construct an encrypted alarm message, terminal screening is performed according to the hierarchical alarm instruction to determine a receiving terminal, and the encrypted alarm message is sent to the receiving terminal for tracking to obtain alarm response feedback data.

[0103] Further, the device is also used to realize the following functions:

[0104] Based on the hierarchical alarm instruction, an instruction structure is obtained, a hierarchical encryption architecture is set according to the instruction structure, the hierarchical alarm instruction is subjected to multi-layer encryption processing through the hierarchical encryption architecture: S1: a first encryption layer, a second encryption layer, and a third signature layer are constructed; S2: the hierarchical alarm instruction is subjected to symmetric encryption through the first encryption layer to generate content ciphertext; S3: the symmetric encryption key is subjected to asymmetric encryption through the second encryption layer to generate key ciphertext; and S4: the content ciphertext and the key ciphertext are verified through the third signature layer to construct the initial encryption information.

[0105] Further, the device is also used to realize the following functions:

[0106] The alarm response feedback data is taken as a training sample for incremental learning to obtain a learning result; the learning result is integrated to traverse the alarm response feedback data for dynamic identification to determine dangerous behavior information; the dangerous behavior information is mapped to the behavior risk graph to recalculate the behavior risk probability to obtain an optimized behavior risk probability; the behavior risk optimized probability is used to traverse the graph nodes for risk analysis to obtain a node risk value change parameter; the node risk value change parameter is used to update the weight of the node edge to obtain an edge connection update weight; the node risk value change parameter and the edge connection update weight are used to update the topology of the behavior risk graph to generate a hierarchical alarm optimization instruction.

[0107] It should be noted that the above sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. The above describes a specific embodiment of the present application. The processes depicted in the drawings do not necessarily require the specific order and continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are also possible or can be advantageous.

[0108] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0109] The present application is only an exemplary description of the present application, and should be considered as covering any and all modifications, changes, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art can make various modifications and changes to the present application without departing from the scope of the present application. Thus, if these modifications and changes of the present application belong to the scope of the present application and its equivalents, the present application intends to include these modifications and changes.

Claims

1. A method for monitoring and alarming dangerous behaviors on an internet platform, characterized in that, The method includes: The system acquires multimodal user behavior data streams from internet platforms in real time through data acquisition interfaces, performs multimodal fusion analysis, and extracts joint features of user behavior. Based on the joint features of user behavior, dangerous behavior analysis is performed, the probability of behavioral risk is calculated, spatiotemporal context is correlated, and a behavioral risk map is constructed. The behavior risk map is traversed to activate the dynamic alarm mechanism to generate a hierarchical alarm command. The hierarchical alarm command is encrypted and the encrypted alarm message is sent to the receiving terminal to generate alarm response feedback data. Incremental learning is performed based on the alarm response feedback data, and the learning results are mapped to the behavioral risk map for updating, generating hierarchical alarm optimization instructions. This includes acquiring multimodal user behavior data streams from internet platforms in real time through data acquisition interfaces, performing multimodal fusion analysis, and extracting joint features of user behavior. The methods include: Feature analysis is performed based on the multimodal user behavior data stream to obtain multimodal feature parameters; The multimodal feature parameters are then subjected to attention-weighted calculation to obtain multiple attention weights; The multimodal feature parameters are fused according to the multiple attention weights to obtain initial fused features; The initial fused features are processed to unify dimensions, and the main feature parameters are normalized and mapped to construct the joint user behavior features. The method for analyzing dangerous behaviors based on the joint features of user behavior, calculating the probability of behavioral risks, performing spatiotemporal context correlation, and constructing a behavioral risk map includes: Retrieve historical dangerous behavior logs from internet platforms to build a database of dangerous behavior characteristics; The user behavior joint features are used as an index to search and match the dangerous behavior feature database, generating matching results, which include data matching degree; Based on the data matching degree, risk calculation is performed on a single behavioral event of the joint features of user behavior to obtain multiple behavioral risk probability values; Spatiotemporal context analysis is performed based on the joint features of user behavior to construct a spatiotemporal feature vector; The multiple behavioral risk probability values ​​are spatiotemporally correlated with the spatiotemporal feature vector to obtain a spatiotemporal risk distribution map, which includes behavioral risk probabilities. The behavioral risk map is constructed by spatiotemporal weighting based on the behavioral risk probabilities. The method includes incremental learning based on the alarm response feedback data, updating the learning results by mapping them to the behavioral risk map, and generating tiered alarm optimization instructions. The alarm response feedback data is used as training samples for incremental learning to obtain the learning results. The learning results are integrated and the alarm response feedback data is traversed for dynamic identification to determine dangerous behavior information; The dangerous behavior information is mapped to the behavior risk map, and the behavior risk probability is recalculated to obtain the optimized behavior risk probability. Risk analysis is performed on the nodes of the behavior risk optimization probability traversal graph to obtain the node risk value change parameters. The node edges are weighted according to the node risk value change parameter to obtain the edge connection update weight; The behavioral risk graph is updated topologically according to the node risk value change parameters and the edge connection update weights to generate hierarchical alarm optimization instructions.

2. The method for monitoring and alarming dangerous behaviors on an internet platform as described in claim 1, characterized in that, The method involves performing spatiotemporal correlation calculations between the multiple behavioral risk probability values ​​and the spatiotemporal feature vectors to obtain a spatiotemporal risk distribution map, wherein the spatiotemporal risk distribution map contains behavioral risk probabilities. A three-dimensional spatiotemporal cube space is constructed based on the aforementioned spatiotemporal feature vectors; The multiple behavioral risk probability values ​​are mapped to the three-dimensional spatiotemporal cube space for spatial distance calculation to obtain the spatial correlation strength. Based on the spatial correlation strength and the multiple behavioral risk probability values, individual behavioral events are identified in reverse to construct a spatiotemporal correlation matrix; Risk analysis is performed based on the aforementioned spatiotemporal correlation matrix to determine the probability of behavioral risk. Based on the behavioral risk probability, risk distribution analysis is performed on a single behavioral event according to the spatiotemporal correlation matrix to construct the spatiotemporal risk distribution map.

3. The method for monitoring and alarming dangerous behaviors on an internet platform as described in claim 2, characterized in that, The behavioral risk map is constructed by spatiotemporally weighting the behavioral risk probabilities, and the method includes: Based on the spatiotemporal correlation matrix, perform unit spatiotemporal calculations to determine the spatiotemporal density factor; Based on the aforementioned behavioral risk probability, risk trend prediction is performed on a single behavioral event. Based on the prediction results, the single behavioral event is spatiotemporally weighted to generate multiple weight coefficients. According to the spatiotemporal density factor, a single behavioral event is mapped as a graph node and then mapped to the spatiotemporal coordinate system to generate a risk distribution matrix. The multiple weight coefficients are mapped to node edges, and the risk distribution matrix is ​​topologically connected to construct the behavioral risk graph.

4. The method for monitoring and alarming dangerous behaviors on an internet platform as described in claim 1, characterized in that, The method involves traversing the behavioral risk map to activate a dynamic alarm mechanism, generating tiered alarm commands, encrypting the tiered alarm commands, sending the encrypted alarm messages to the receiving terminal, and generating alarm response feedback data. The behavior risk graph is traversed using a breadth-first search to calculate the real-time risk values ​​of multiple nodes. Set multi-level risk thresholds, compare the real-time risk values ​​of the multiple nodes with the multi-level risk thresholds, and extract multi-level risk nodes; The multi-level risk nodes are reverse-mapped to the risk graph to extract multiple node association paths, and multiple risk levels are set according to the multiple node association paths; Based on the multiple risk levels, risk propagation analysis is performed to determine the scope of risk propagation. Multi-dimensional alarm assessment is then conducted according to the scope of risk propagation to generate risk assessment results. Based on the risk assessment results, the risk is divided into multiple levels, and the graded alarm instructions are generated.

5. The method for monitoring and alarming dangerous behaviors on an internet platform as described in claim 1, characterized in that, The method involves encrypting the tiered alarm command, sending the encrypted alarm message to the receiving terminal, and generating alarm response feedback data. The hierarchical alarm command is subjected to multi-layer encryption processing to generate initial encrypted information; Define a standardized alarm message format, and process the initial encrypted information into segments according to the standardized alarm message format to generate multiple segments of encrypted data. The multiple segments of encrypted data include encrypted data of message header segment, encrypted data of message content segment, and encrypted data of message verification segment. The encrypted header data, the encrypted content data, and the encrypted verification data are structurally concatenated to construct an encrypted alarm message; The receiving terminal is determined by screening the terminals according to the aforementioned graded alarm instructions; The encrypted alarm message is sent to the receiving terminal for tracking, and the alarm response feedback data is obtained.

6. The method for monitoring and alarming dangerous behaviors on an internet platform as described in claim 5, characterized in that, The method for performing multi-layer encryption on the tiered alarm command to generate initial encrypted information includes: Based on the hierarchical alarm command, the command structure is obtained by parsing, and a hierarchical encryption architecture is set according to the command structure. The hierarchical encryption architecture is used to perform multi-layered encryption processing on the hierarchical alarm command: S1: Construct the first encryption layer, the second encryption layer, and the third signature layer; S2: The hierarchical alarm command is symmetrically encrypted using the first encryption layer to generate ciphertext. S3: The symmetric encryption key is asymmetrically encrypted using the second encryption layer to generate the key ciphertext; S4: Verify the ciphertext of the content and the ciphertext of the key through the third signature layer to construct the initial encrypted information.

7. A dangerous behavior monitoring and alarm device for internet platforms, characterized in that, The device is used to perform the dangerous behavior monitoring and alarm method for an Internet platform as described in any one of claims 1-6, the device comprising: The feature extraction module is used to acquire multimodal user behavior data streams from the Internet platform in real time through the data acquisition interface, perform multimodal fusion analysis, and extract joint features of user behavior. The dangerous behavior analysis module is used to perform dangerous behavior analysis based on the joint features of user behavior, calculate the probability of behavior risk, perform spatiotemporal context association, and construct a behavior risk map. The feedback data generation module is used to traverse the behavioral risk map, activate the dynamic alarm mechanism to generate hierarchical alarm instructions, encrypt the hierarchical alarm instructions, send the encrypted alarm messages to the receiving terminal, and generate alarm response feedback data. The instruction generation module is used to perform incremental learning based on the alarm response feedback data, update the learning results by mapping them to the behavioral risk map, and generate hierarchical alarm optimization instructions.

Images