Account management method and device, electronic equipment and storage medium

Abstract

The invention discloses an account management method and device, electronic equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: dynamically fusing multi-modal data through employing a modal adaptive attention mechanism, detecting abnormity through combining with a time-aware isolated forest algorithm, recognizing cross-user cooperative attacks through employing a user behavior graph model and a community detection algorithm, and improving the network security. And the strength and range of the isolation strategy are dynamically adjusted according to the score instead of depending on a fixed weight fusion feature, so that the problems that in an existing account management method, response to a novel attack is lagged due to the fixed weight fusion feature, and abnormal operation after breaking through initial verification cannot be recognized in time can be solved, and the user experience is improved. The technical effect of improving the overall security protection effect of account management is achieved.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to an account management method and apparatus, electronic device and storage medium. Background Technology

[0002] Account management, as a key component of network security systems, is widely used in fields such as finance, telecommunications, the Internet of Things, and cloud services. Its core objective is to build a dynamic protection mechanism for user access through the collaborative operation of identity verification, behavior monitoring, and risk control.

[0003] Existing account management methods rely on fixed weights to integrate user behavior, device and network characteristics, which leads to a lag in system response to new types of attacks, or the inability to promptly identify abnormal operations after attackers have breached initial verification, thus affecting the overall security protection effect. Summary of the Invention

[0004] This disclosure provides an account management method, apparatus, electronic device, and storage medium. Its main purpose is to address the problem of system sluggish response to new types of attacks, or the inability to promptly identify abnormal operations after attackers have breached initial authentication, thereby affecting the overall security protection effect.

[0005] According to a first aspect of this disclosure, an account management method is provided, comprising:

[0006] Collect multimodal data of the monitored target; wherein, the multimodal data includes at least one of user behavior, device status, and network traffic;

[0007] The multimodal data is dynamically fused using a modality-adaptive attention mechanism to generate a high-dimensional feature vector;

[0008] Anomaly detection is performed on the high-dimensional feature vector based on the time-aware isolated forest algorithm to generate anomaly scores;

[0009] Based on user behavior graph models and community detection algorithms, cross-user collaborative attack behaviors are identified, and community scores are generated.

[0010] Threat scenarios are classified based on the anomaly score and the community score, and the strength and scope of the isolation strategy are dynamically adjusted based on the feature weights of the threat scenarios and the multimodal data.

[0011] Optionally, the multimodal data of the monitored target includes:

[0012] User behavior data collected includes keyboard input frequency, mouse movement trajectory, and click behavior patterns;

[0013] The collected device status data includes device fingerprints, geographical location changes, and consistency of device login history.

[0014] Optionally, the step of dynamically fusing the multimodal data through a modality-adaptive attention mechanism to generate a high-dimensional feature vector further includes:

[0015] When calculating modal weights using the modal adaptive attention mechanism, a noise suppression factor is introduced; wherein, the noise suppression factor is the reciprocal of the variance of the modal features;

[0016] The time-aware isolated forest algorithm is used to calculate the time offset based on the timestamps of the samples, and the path length is adjusted by a time decay function.

[0017] Optionally, the step of identifying cross-user collaborative attack behavior and generating a community score based on user behavior graph models and community detection algorithms further includes:

[0018] When constructing a user behavior graph model, Euclidean distance and time weighting factors are used to calculate the behavioral association weights between users;

[0019] The Louvain community detection algorithm is used to segment the user behavior graph and identify a set of collaborative attack accounts with high community anomaly scores.

[0020] Optionally, the step of classifying threat scenarios based on the anomaly score and the community score, and dynamically adjusting the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data, further includes:

[0021] The risk level is determined based on the anomaly score and the community score, and the control of the monitored target is implemented based on the isolation strategy corresponding to the risk level.

[0022] The risk level of the monitored target is recalculated based on the risk recovery degree of the monitored target, the anomaly score, and the community score.

[0023] Optionally, the step of classifying threat scenarios based on the anomaly score and the community score, and dynamically adjusting the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data, further includes:

[0024] The results of the isolation operation are fed back to the trust score calculation module, and the trust score is dynamically updated based on the user's behavior and recovery status.

[0025] The detection sensitivity of the behavior analysis module and the isolation strength of the isolation strategy module are adjusted based on the updated trust score, forming a closed-loop optimization mechanism.

[0026] According to a second aspect of this disclosure, an account management device is provided, comprising:

[0027] The acquisition unit is used to acquire multimodal data of the monitored target; wherein the multimodal data includes at least one of user behavior, device status, and network traffic;

[0028] The first generation unit is used to dynamically fuse the multimodal data through a modality adaptive attention mechanism to generate a high-dimensional feature vector;

[0029] The detection unit is used to perform anomaly detection on the high-dimensional feature vector based on the time-aware isolated forest algorithm and generate anomaly scores;

[0030] The second generation unit is used to identify cross-user collaborative attack behaviors based on user behavior graph models and community detection algorithms, and generate community scores.

[0031] The execution unit is used to classify threat scenarios based on the anomaly score and the community score, and dynamically adjust the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data.

[0032] Optionally, the acquisition unit is further configured to:

[0033] User behavior data collected includes keyboard input frequency, mouse movement trajectory, and click behavior patterns;

[0034] The collected device status data includes device fingerprints, geographical location changes, and consistency of device login history.

[0035] Optionally, the first generating unit is further configured to:

[0036] When calculating modal weights using the modal adaptive attention mechanism, a noise suppression factor is introduced; wherein, the noise suppression factor is the reciprocal of the variance of the modal features;

[0037] The time-aware isolated forest algorithm is used to calculate the time offset based on the timestamps of the samples, and the path length is adjusted by a time decay function.

[0038] Optionally, the second generating unit is further configured to:

[0039] When constructing a user behavior graph model, Euclidean distance and time weighting factors are used to calculate the behavioral association weights between users;

[0040] The Louvain community detection algorithm is used to segment the user behavior graph and identify a set of collaborative attack accounts with high community anomaly scores.

[0041] Optionally, the execution unit is further configured to:

[0042] The risk level is determined based on the anomaly score and the community score, and the control of the monitored target is implemented based on the isolation strategy corresponding to the risk level.

[0043] The risk level of the monitored target is recalculated based on the risk recovery degree of the monitored target, the anomaly score, and the community score.

[0044] Optionally, the execution unit is further configured to:

[0045] The results of the isolation operation are fed back to the trust score calculation module, and the trust score is dynamically updated based on the user's behavior and recovery status.

[0046] The detection sensitivity of the behavior analysis module and the isolation strength of the isolation strategy module are adjusted based on the updated trust score, forming a closed-loop optimization mechanism.

[0047] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0048] At least one processor; and

[0049] A memory communicatively connected to the at least one processor; wherein,

[0050] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0051] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method described in the first aspect above.

[0052] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0053] The account management method, apparatus, electronic device, and storage medium disclosed herein mainly include the following technical solutions: collecting multimodal data of the monitored target; wherein the multimodal data includes at least one of user behavior, device status, and network traffic; dynamically fusing the multimodal data through a modality adaptive attention mechanism to generate a high-dimensional feature vector; performing anomaly detection on the high-dimensional feature vector based on a time-aware isolated forest algorithm to generate anomaly scores; identifying cross-user collaborative attack behaviors based on a user behavior graph model and a community detection algorithm to generate community scores; classifying threat scenarios according to the anomaly scores and the community scores, and dynamically adjusting the strength and scope of isolation strategies based on the feature weights of the threat scenarios and the multimodal data. Compared with related technologies, the embodiments of this application dynamically fuse multimodal data by adopting a modal adaptive attention mechanism, combining time-aware isolated forest algorithm to detect anomalies, user behavior graph model and community detection algorithm to identify cross-user collaborative attacks, and dynamically adjusting the strength and scope of isolation strategies according to the score, rather than relying on fixed weight fusion features. Therefore, it can solve the problem of delayed response to new attacks and inability to identify abnormal operations after breaking through the initial verification caused by fixed weight fusion features in existing account management methods, and achieve the technical effect of improving the overall security protection effect of account management.

[0054] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0055] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0056] Figure 1 This is a flowchart illustrating an account management method provided in an embodiment of the present disclosure;

[0057] Figure 2 A flowchart illustrating an account management method based on a behavior-driven dynamic isolation strategy provided in this embodiment of the disclosure;

[0058] Figure 3 This is a schematic diagram of the structure of an account management device provided in an embodiment of the present disclosure;

[0059] Figure 4 A schematic block diagram of an example electronic device provided for embodiments of this disclosure. Detailed Implementation

[0060] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0061] The following description, with reference to the accompanying drawings, outlines an account management method, apparatus, electronic device, and storage medium according to embodiments of the present disclosure.

[0062] Figure 1 This is a flowchart illustrating an account management method provided in an embodiment of the present disclosure.

[0063] like Figure 1 As shown, the method includes the following steps:

[0064] Step 101: Collect multimodal data of the monitored target; wherein the multimodal data includes at least one of user behavior, device status, and network traffic;

[0065] Please see Figure 2 , Figure 2 This is a flowchart illustrating an account management method based on a behavior-driven dynamic isolation strategy provided in an embodiment of this disclosure, as shown below. Figure 2 As shown, user behavior data mainly refers to the various operational behaviors of the monitored target in the system. Specifically, it can include keyboard input content and input frequency, mouse movement trajectory and click position, logging into the system, making payment operations, accessing sensitive resources, and a series of other interactive behaviors. This data can directly reflect the monitored target's operating habits, behavioral patterns, and potential operational intentions. For example, frequent abnormal clicks or unusual access paths to sensitive resources may imply security risks.

[0066] Device status data focuses on the relevant characteristic information of the device used by the monitoring target, covering device fingerprint (i.e., the unique identification information of the device, which can be generated by combining hardware configuration, system parameters, etc., to distinguish different devices), the device's current IP address, geographical location information, device type (such as smartphone, laptop, tablet, etc.), and device operating status (such as whether it is rooted, jailbroken, and whether the system version is the latest). It identifies whether the device is a frequently used device of the monitoring target, whether there is any device information tampering or abnormal changes, such as if the device's geographical location changes significantly across regions in a short period of time, which may mean that the device has been stolen or there is a risk of abnormal login.

[0067] Network traffic data primarily includes network data generated when the monitored target communicates with the system. Specifically, this includes the frequency of network requests (e.g., the number of requests initiated per unit time), traffic packet header information (containing key information such as source address, destination address, protocol type, and port number), the location of the accessing IP and whether it belongs to a known list of suspicious IPs, and whether there are high-frequency requests without obvious business logic. This data reflects the stability of network connections and whether communication patterns are abnormal. For example, high-frequency repeated requests from the same IP may indicate malicious attacks or web crawling behavior. By collecting this multimodal data, subsequent modules can perform in-depth analysis based on comprehensive information, laying a data foundation for accurately identifying security threats.

[0068] Step 102: Dynamically fuse the multimodal data through a modality adaptive attention mechanism to generate a high-dimensional feature vector;

[0069] The Adaptive Modality Attention (AMA) mechanism dynamically fuses collected multimodal data to generate high-dimensional feature vectors. Its core lies in solving the problem that traditional feature fusion methods (such as direct concatenation, fixed-weight weighted averaging, etc.) cannot dynamically adjust the fusion strategy according to the real-time importance and noise level of modal features. This improves the accuracy and effectiveness of multimodal data fusion and provides more representative feature inputs for subsequent behavior analysis and anomaly detection.

[0070] Specifically, this mechanism first differentiates the characteristics of different modalities within the multimodal data. User behavior modal data focuses on user operating habits and interaction patterns; for example, in payment scenarios, this could include click frequency, payment amount range selection, and page dwell time. Device status modal data covers the inherent characteristics and real-time status of devices, such as device fingerprints (unique device identifiers generated by combining hardware configurations, system parameters, etc.), whether geographical location has undergone unusual changes, and whether the device type is a commonly used type. Network traffic modal data involves key characteristics of network interactions, such as whether the accessing IP address belongs to a suspicious area, whether the request frequency exceeds the normal business range, and whether there are anomalies in the protocol type and port information in the traffic packet header.

[0071] During the fusion process, the modality adaptive attention mechanism dynamically adjusts its weights by calculating the weights of each modality. The weight calculation comprehensively considers the interaction characteristics and noise levels between modalities: on the one hand, by constructing a query matrix (describing the query features of the modality) and a key matrix (describing the key features of the modality) and introducing a scaling factor (to balance the numerical range in the calculation), the relative importance of different modalities in the current scenario is captured. For example, when a user's logged-in device changes from a familiar device to an unfamiliar device, the weight of the device status modality automatically increases to highlight the impact of this modality's information on the current scenario. On the other hand, a noise suppression factor (based on the reciprocal of the variance of modal features) weakens the influence of high-noise modalities. For example, when the data of a certain modality fluctuates significantly due to acquisition errors or interference, its weight will be reduced accordingly to avoid noise interfering with the fusion results.

[0072] After dynamically calculating the weights of each modality, the modality adaptive attention mechanism weights the features of each modality according to their corresponding weights and generates a high-dimensional feature vector through concatenation. This high-dimensional feature vector integrates key information from multimodal data such as user behavior, device status, and network traffic. It retains the unique features of each modality and reflects the relative importance of different modalities in the current scenario through dynamic weights, thus forming a comprehensive feature representation that can fully reflect the real-time status and behavioral characteristics of the monitored target. This provides a high-quality feature foundation for subsequent anomaly detection, threat analysis, and other processes.

[0073] Step 103: Perform anomaly detection on the high-dimensional feature vector based on the time-aware isolated forest algorithm and generate anomaly scores;

[0074] The Temporal-Aware Isolation Forest (TA-IF) algorithm is used to detect anomalies in high-dimensional feature vectors and generate anomaly scores. Its core is to optimize the traditional isolation forest algorithm by introducing a time factor, so that it can more accurately capture time-related behavioral anomalies, thereby quantifying the behavioral risks of the monitored targets reflected by the high-dimensional feature vectors.

[0075] When processing high-dimensional feature vectors, the Time-Aware Isolation Forest (TA-IF) algorithm retains the core logic of Isolation Forest—identifying anomalies by randomly partitioning the data space and calculating sample path lengths—the shorter the path length, the more likely the sample is to be an outlier. However, addressing the issues of traditional Isolation Forest assuming a static data distribution and neglecting the impact of time intervals on the importance of anomalous behavior, TA-IF introduces a time offset and a time decay function to dynamically adjust the path length. Specifically, the time offset Δt... i Represents the sample X in the high-dimensional feature vector i Timestamp T iThe difference between the current time and the current time reflects the distance between the time when the sample action occurred and the current moment.

[0076] Time decay function:

[0077]

[0078] Here, β is the time decay parameter, which controls the impact of time offset on path length. As the time offset increases, the value of this function decreases, meaning that earlier behaviors will gradually weaken their impact on current anomaly detection, while recent behaviors (small time offsets) will be given higher weight, making the algorithm more sensitive to recent anomalies.

[0079] Specifically, the adjusted path length L ′ (x i The calculation formula is:

[0080] L′(x i )=L(x i )·(1+λ·f(Δt i ))

[0081] Where: L(x) i ): Original path length, representing the number of times a sample is isolated in an isolated forest; Δt i =|T i -T current |For sample x i The time offset; λ is the path adjustment parameter, used to adjust the degree of influence of time correlation on path length.

[0082] With this adjustment, recent behaviors that deviate significantly from historical patterns (such as logging in from a different location and performing large transactions within a short period of time) will have a significantly longer adjusted path length due to their small time offset and large time decay function value, making them more likely to be identified as abnormal.

[0083] After obtaining the adjusted path length, the anomaly score S(x) is obtained. i )for:

[0084]

[0085] Where: c(n) is the normalization factor, which is related to the number of samples n in the isolated forest; Z is the fusion feature matrix, representing the multimodal features of the samples; T i For sample x i Timestamp; Δt i L′(x) represents the time offset, reflecting the impact of time variations on anomaly detection; λ and β are path adjustment parameters used to adjust the impact of temporal correlation on anomaly detection; iThe adjusted path length is used to capture time-related abnormal behaviors.

[0086] The anomaly score is based on the adjusted path length and normalized using a normalization factor c(n) related to the sample size. The resulting anomaly score quantifies the risk level of the monitored target's operation corresponding to the high-dimensional feature vector. For example, if the high-dimensional feature vector of a monitored target shows login behavior from two different national IP addresses within 5 minutes, accompanied by large-amount transfers that are inconsistent with historical patterns, the algorithm amplifies the impact of this recent anomaly by using time offset and time decay functions. This significantly increases the adjusted path length, thereby calculating a higher anomaly score to reflect the high-risk level of the operation and provide crucial risk quantification for the formulation of subsequent isolation strategies.

[0087] Step 104: Identify cross-user collaborative attack behaviors based on the user behavior graph model and community detection algorithm, and generate a community score;

[0088] User behavior graph models are the foundation for characterizing the behavioral relationships between users. This model is represented by a graph G = (V, E), where the set of nodes V consists of feature vectors of each monitored target. These feature vectors are derived from high-dimensional feature vectors fused by a modality adaptive attention mechanism, containing comprehensive features of multimodal information such as user behavior, device status, and network traffic, and can comprehensively reflect the behavioral characteristics and risk attributes of users. The set of edges E is used to characterize the behavioral relationships between different user nodes, such as whether users share the same IP address, whether they perform similar abnormal operations within a similar time period (such as transferring money to the same target account at the same time), and whether there are cross-correlation of device information. These relationships are key clues for identifying coordinated attacks.

[0089] To accurately measure the strength of behavioral correlations between users, the calculation of edge weights needs to comprehensively consider differences in user characteristics and temporal correlations. Specifically, the edge weight w ij The formula is used to calculate the distance, which includes the Euclidean distance ||Z| between user feature vectors. i -Z j || 2 The Euclidean distance is used to measure the similarity of user behavior patterns—the smaller the distance, the closer the two users' behavior patterns are and the stronger the correlation; the time difference Δt is also introduced. ij =|T i -T j | (i.e., the difference between the timestamps of the two users' operations), the influence of time factors on the strength of association is adjusted by the time weighting factor θ. For example, similar operations within a similar time period will be given higher weights, thereby highlighting the correlation of short-term collaborative behavior; at the same time, the Gaussian kernel parameter σ is used to balance the influence of feature distance on weights, avoiding weight calculation deviations caused by differences in feature value ranges.

[0090] After constructing the user behavior graph, community detection algorithms (such as the Louvain algorithm) are used to divide the nodes in the graph into communities. This algorithm optimizes the modularity function to aggregate user nodes with closely related behaviors into the same community, thereby identifying potential coordinated attack groups. During the community detection process, the anomaly score of each user node (i.e., the anomaly score generated by the time-aware isolated forest algorithm) is combined to calculate the community anomaly score S. community This score combines the degree of anomaly among all users in the community with the strength of connections between them, and can quantitatively reflect the risk level of coordinated attacks across the entire community—the higher the anomaly score of users in the community and the stronger the connections between users, the higher the community anomaly score S. community The higher the score, the greater the likelihood of a coordinated attack within the community. For example, in a payment scenario, if multiple accounts share the same suspicious IP address and transfer funds to an unknown account within a short period, their corresponding user nodes will be grouped into the same community due to their highly correlated behavior. The community anomaly score S, calculated using a community detection algorithm, will determine the community's anomaly score. community This will significantly increase the risk level of the coordinated attack, thus providing a basis for decision-making regarding subsequent batch isolation strategies.

[0091] Step 105: Classify threat scenarios based on the anomaly score and the community score, and dynamically adjust the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data.

[0092] First, threat scenario classification should be based on anomaly scores and community scores, with risk levels clearly defined through quantitative thresholds. Anomaly scores measure the risk level of single-user operations, while community scores assess the risk level of multi-user collaborative attacks. In some embodiments, the specific classification criteria are as follows: When the anomaly score is less than 0.5, it is considered a mild risk. In this case, the monitored target may only exhibit minor deviations from normal behavior, but it does not constitute a substantial threat, such as occasional logins at unusual times without any abnormal operations. When the anomaly score is between 0.5 and 0.8 (inclusive), it is considered a moderate risk, indicating that the monitored target's behavior pattern shows significant anomalies, such as frequent device switching accompanied by unusual sensitive operations, or interactions that deviate significantly from historical behavior. When the anomaly score S(xi) is not lower than 0.8, or the community score is not lower than 0.8, it is considered a high risk, meaning there is a serious risk of severe single-user abnormal behavior or significant cross-user collaborative attacks, such as multiple logins from different locations within a short period and attempts to transfer large sums of money, or multiple accounts sharing a suspicious IP and simultaneously performing malicious operations.

[0093] Secondly, the feature weights of multimodal data are an important reference for dynamically adjusting isolation strategies. These weights are calculated by a modality-adaptive attention mechanism and reflect the importance of different modalities of data, such as user behavior, device status, and network traffic, in the current context. For example, if the weight of the device status modality (W2) is high, it indicates that device information (such as login from unfamiliar devices or abnormal changes in geographical location) is the main cause of the current risk, and the isolation strategy should prioritize the device level. If the weight of the network traffic modality (W3) is high, it indicates that network characteristics (such as suspicious IP access or high-frequency abnormal requests) are the core of the risk, and network-level isolation should be implemented as a key focus.

[0094] After determining the threat scenario and feature weights, the strength and scope of the isolation strategy will be dynamically adapted. For mild risks, the isolation strength is low and the scope is narrow. Measures such as restricting high-risk functions (e.g., temporarily prohibiting transfers and withdrawals) or sending verification requests (e.g., SMS verification, email verification) can be taken. At the same time, based on feature weights, priority should be given to monitoring high-weight modalities. For example, if the user behavior modality has a high weight, the focus should be on monitoring whether subsequent operations return to normal. For medium risks, the isolation strength needs to be appropriately increased, and the scope expanded to some functions or devices. For example, freezing the payment function of the account, blocking access from abnormal devices and requiring high-level verification (e.g., facial recognition, hardware key verification). In this case, if the device modality has a dominant weight, the login permissions of suspicious devices should be blocked first. For high risks, high-intensity and wide-ranging isolation is required, including freezing all accounts and associated devices, restricting access to specific network areas (e.g., suspicious IP segments, subnets), or batch isolating a list of high-risk accounts involved in coordinated attacks. If the network modality has a high weight, priority should be given to restricting shared suspicious network areas to cut off the attack propagation path.

[0095] Furthermore, the strength of the isolation strategy can be optimized in real time through a dynamic adjustment formula. The new isolation strength (Inew) is calculated based on the initial isolation strength (Iold), the anomaly score (S(xi)), the risk recovery degree of user behavior (C(t)), and feature weights. This ensures that the isolation measures can be flexibly increased or decreased as the risk changes. When the monitoring target is verified and the behavior returns to normal, the isolation strength is gradually reduced. If the behavior continues to be abnormal, the isolation is further strengthened, thereby achieving a precise match between risk and measures.

[0096] In some embodiments, the multimodal data of the monitored target includes:

[0097] User behavior data collected includes keyboard input frequency, mouse movement trajectory, and click behavior patterns;

[0098] The collected device status data includes device fingerprints, geographical location changes, and consistency of device login history.

[0099] When users perform operations within the system (such as logging in, making payments, accessing sensitive resources, etc.), the data collector of the Real-Time Behavior Monitoring Module (RBMM) is responsible for capturing the following data: User behavior: such as keyboard input, mouse movement, and clicks. Device characteristics: such as device fingerprint, IP address, and geographical location. Network traffic: such as request frequency and packet header information.

[0100] The data collector transmits the collected data to the preprocessor for cleaning and formatting to ensure data integrity and consistency.

[0101] The cleaned and standardized data is transmitted to downstream modules through a data buffer to support subsequent real-time analysis. The data also includes contextual features (such as time, geographical location, and device status), serving as an important reference for dynamically adjusting trust scores and isolation strategies.

[0102] In some embodiments, the step of dynamically fusing the multimodal data through a modality-adaptive attention mechanism to generate a high-dimensional feature vector further includes:

[0103] When calculating modal weights using the modal adaptive attention mechanism, a noise suppression factor is introduced; wherein, the noise suppression factor is the reciprocal of the variance of the modal features;

[0104] The time-aware isolated forest algorithm is used to calculate the time offset based on the timestamps of the samples, and the path length is adjusted by a time decay function.

[0105] Multimodal Feature Fusion: User behavior, device characteristics, and network traffic data are input into a feature fusion processor to generate high-dimensional feature vectors. Anomaly Detection: Anomaly detectors analyze the high-dimensional feature vectors to identify potential abnormal behaviors. Collaborative Threat Detection: Through cross-user behavior pattern analysis (as shown in the figure), group threats are identified to determine if cluster attacks exist.

[0106] The module output includes: Abnormal behavior reports: for the threat intelligence module to update; Isolation commands: for the isolation policy module to execute; Trust score update requests: feedback to the trust score module.

[0107] This application proposes an Adaptive Modality Attention (AMA) mechanism to dynamically adjust modality weights and reduce the influence of noisy modalities.

[0108] Adaptive attention mechanism: modal weights w i The calculation formula is as follows:

[0109]

[0110] Among them: Q i =X iW Q : Query matrix, describing the query characteristics of modality i; K i =X i W K : Key matrix, describing the key features of mode i; Scaling factor, used to balance the range of values ​​in calculations; The noise suppression factor weakens the influence of high-noise modes by using the inverse of the mode characteristic variance; γ: adjustment parameter, which controls the influence of the noise factor on the weight adjustment.

[0111] Using modal weights W i The modal features are then concatenated after weighting to generate a fused feature matrix Z:

[0112] Z = concat(W1V1, W2V2, W3V3)

[0113] Where: V i =X i W V : Value matrix, describing the actual eigenvalues ​​of mode i; X i : The characteristic matrix of mode i, representing n i bar sample 3D features; W q W k W V : The weight matrix of query, key, and value, used to calculate the interaction of modal features.

[0114] Here's an example of how the algorithm can be used. Suppose an online payment platform is detecting user payment risks. The following settings could be configured: Behavioral Modality X1: User's click frequency and payment habits; Device Modality X2: Whether the device type and geographical location have changed; Network Modality X3: Whether the access IP is suspicious or makes frequent requests.

[0115] If the system detects a change in the user's login device (e.g., from a familiar device to an unfamiliar device), the weight W2 of the device modality will increase, emphasizing the importance of device information; conversely, if the click behavior is significantly abnormal, the system will increase the weight of the behavior modality W1. The fusion feature Z will integrate all modal information and provide it to subsequent detection modules.

[0116] In some embodiments, this application improves upon the existing isolated forest algorithm by proposing a Temporal-Aware Isolation Forest (TA-IF), which captures time-related anomalies by dynamically adjusting path length.

[0117] Path length adjustment: based on time offset Δt i Dynamically adjust path length L ′ (x i ):

[0118] L′(x i )=L(x i )·(1+λ·f(Δt i ))

[0119] Where: L(x) i ): Original path length, representing the number of times a sample is isolated in an isolated forest; Δt i =|T i -T current |:Sample x i Time offset; Time decay function: β: Time decay parameter, used to control the effect of time offset on path length.

[0120] Anomaly score calculation: Anomaly score is calculated using the adjusted path length.

[0121]

[0122] Where: c(n): normalization factor, related to the number of samples n in the isolated forest; Z: fusion feature matrix, representing the multimodal features of the samples; T i Sample x i Timestamp; Δt i : Time offset, reflecting the impact of time changes on anomaly detection; λ, β: Path adjustment parameters used to adjust the impact of temporal correlation on anomaly detection; L′(x i ): Adjusted path length, capturing time-related abnormal behavior.

[0123] Here's an example of how the algorithm works: Suppose a user account logs into two different IP addresses in different countries within a short period of time and attempts to make large transfers simultaneously.

[0124] Input: Time offset Δt i = 5 minutes (two login intervals); path adjustment parameter λ = 0.8, time decay parameter β = 0.1.

[0125] Adjust path length: The system detects multiple logins from different locations within a short period and dynamically adjusts the path length L. ′ (x i ), making the abnormal score S(x) i )improve.

[0126] Result: If S(x) i If the value exceeds 0.8 (exceeding the risk threshold), the system will trigger a risk response, such as freezing the account or sending a verification request.

[0127] In some embodiments, the process of identifying cross-user collaborative attack behavior based on user behavior graph models and community detection algorithms, and generating community scores, further includes:

[0128] When constructing a user behavior graph model, Euclidean distance and time weighting factors are used to calculate the behavioral association weights between users;

[0129] The Louvain community detection algorithm is used to segment the user behavior graph and identify a set of collaborative attack accounts with high community anomaly scores.

[0130] This application proposes a cross-user collaborative threat detection (CTD) model, which identifies distributed attacks through graph analysis.

[0131] User behavior graph modeling: Construct a user behavior graph G = (V, E), where: V: a set of nodes, representing the user feature vector Z. i E: Edge set, representing the behavioral relationships between users.

[0132] Edge weight calculation:

[0133]

[0134] Where: ||Z i -Z j || i : Euclidean distance between user features; σ: Gaussian kernel parameter, controlling the influence of feature distance on weights; Δt ij =|T i -T j |: Time difference between users; θ: Time weighting factor, which adjusts the impact of time difference on user association weight.

[0135] Anomaly community detection: Using the Louvain algorithm to divide user behavior graphs into communities.

[0136]

[0137] Where: S(v): Anomaly score for each node (user) in the community; G = (V, E): User behavior graph, capturing behavioral relationships between users; w ij : The behavioral association weights of users i and j; S community Community anomaly score reflects the intensity of coordinated attacks.

[0138] An example of algorithm usage is as follows: In a payment platform, multiple accounts share the same IP address and simultaneously transfer funds to the same target account. V represents suspicious account characteristics, and E represents the association of shared IP addresses between accounts. The system captures coordinated behavior between accounts through a time-weighted mechanism. By identifying suspicious account communities using the Louvain algorithm, the system marks these accounts as having a coordinated attack risk and takes unified measures to freeze them.

[0139] In some embodiments, classifying threat scenarios based on the anomaly score and the community score, and dynamically adjusting the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data, further includes:

[0140] The risk level is determined based on the anomaly score and the community score, and the control of the monitored target is implemented based on the isolation strategy corresponding to the risk level.

[0141] The risk level of the monitored target is recalculated based on the risk recovery degree of the monitored target, the anomaly score, and the community score.

[0142] The isolation strategy execution module uses multimodal feature fusion results, anomaly scores, and collaborative threat detection results as inputs to formulate and execute isolation strategies in real time, ensuring a balance between system security and business continuity.

[0143] Multimodal feature fusion output: Fusion feature matrix Z: A high-dimensional matrix that integrates user behavior, device status and network traffic features, providing operational context for isolation strategies (such as prioritizing isolation measures that consider high-weight modalities).

[0144] Abnormal behavior detection output: Abnormal score S(x) i ): Quantifies the risk level of user actions to match appropriate isolation strength and scope.

[0145] Collaborative threat detection output: Anomaly community score S community : Quantify the risk level of coordinated attacks;

[0146] The input for threat scenario analysis is: Single account anomaly score S(x) i Collaborative attack community rating S community and a list of high-risk accounts

[0147] Mild risk (S(x) i <0.5): If the account exhibits minor abnormal behavior but does not pose a threat.

[0148] Moderate risk (0.5 <= S(x) i <0.8): If the account behavior deviates significantly from the historical pattern or the device is frequently switched.

[0149] High risk S(x) i )>=0.8 or S community >=0.8): If there is a coordinated attack or abnormal high-value operation.

[0150] Based on threat level and modality feature weights, an isolation strategy is adaptively selected and the isolation strength is dynamically adjusted.

[0151] Risk level (by S(x) i ) and S community Sure).

[0152] The fused feature matrix Z provides operational context (such as device priority, network priority isolation).

[0153] Examples of risk management strategies: restricting high-risk account functions (such as withdrawals and transfers) and sending verification requests (such as SMS verification).

[0154] Examples of medium-risk strategies include freezing some account functions (such as payments), blocking access from abnormal devices, and requiring high-level verification.

[0155] High-risk strategies: Freeze all accounts and devices, restrict network area access (such as specific IP addresses or subnets), and implement batch isolation. The accounts in the list.

[0156] Dynamically adjust formula, isolation strength I new Adjustments:

[0157] I new =I old +α·S(x i )-β·C(t)

[0158] Where: S(x i ): Anomaly score; C(t): Risk recovery degree of user behavior during quarantine; α,β: Moderating factor, controlling the impact of score and recovery on quarantine intensity; I old ,I new The initial and adjusted strength of the isolation strategy determines the scope of the isolation operation.

[0159] Here's an example of how the algorithm works: Suppose a payment platform detects an abnormal rating S(x) for user A. A ) = 0.7, and its device frequently switches locations and attempts high-value payment operations: the system will S(x) = 0.7. A A value of 0.7 indicates a moderate risk level.

[0160] The fusion feature matrix Z shows that device modality has a higher weight, and device isolation strategies are given priority: freezing some functions of the account (such as prohibiting payment operations), blocking access from suspicious devices, requiring users to complete high-level verification, and upgrading the isolation strength to a complete account freeze if the user fails the verification.

[0161] In some embodiments, the method further includes policy execution and logging, which involves implementing isolation operations according to the selected policy and recording the results. Specifically, this includes recording the time, scope, triggering conditions, and execution results of each isolation operation for subsequent auditing and optimization.

[0162] Here's an example of how the algorithm works: In a payment platform, a multi-account coordinated attack was detected, resulting in a community rating of S. community =0.85: System batch freeze The account in the system will be blocked from transferring funds.

[0163] The fused feature matrix Z indicates that the network modality weight is high, and the system prioritizes restricting network areas (such as IP ranges) shared by attack accounts.

[0164] By monitoring user behavior in real time during quarantine, the quarantine period can be dynamically adjusted or lifted based on the degree of risk recovery.

[0165] Once a user completes verification and their behavior returns to normal, the isolation will be gradually lifted; if the behavior continues to be abnormal, the isolation measures will be further strengthened.

[0166] Specifically, the isolation intensity will be dynamically reduced based on the degree of risk recovery C(t): mild lifting: gradually restore account functions (e.g., restore query permissions first); full lifting: remove all restrictions after the audit is completed; a complete record of the operation recovery will be used for subsequent analysis.

[0167] Here's an example of how the algorithm works: an account completes all verifications and resumes normal behavior during quarantine. This includes the system gradually lifting the quarantine, starting with restoring account query permissions. Alternatively, based on the risk recovery level C(t) of the user's behavior, the account freeze may be completely lifted.

[0168] In some embodiments, classifying threat scenarios based on the anomaly score and the community score, and dynamically adjusting the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data, further includes:

[0169] The results of the isolation operation are fed back to the trust score calculation module, and the trust score is dynamically updated based on the user's behavior and recovery status.

[0170] The detection sensitivity of the behavior analysis module and the isolation strength of the isolation strategy module are adjusted based on the updated trust score, forming a closed-loop optimization mechanism.

[0171] The main function of the trust score calculation module is to dynamically update the user's trust score T(x) and feed it back to the behavior analysis module, while also supporting policy adjustments in the isolation module. This module integrates multi-source information, such as behavioral characteristics, anomaly scores, isolation effectiveness, and threat intelligence, to quantify the user's overall risk status in real time and form a closed-loop feedback loop.

[0172] Input is received from various modules of the system, and multi-source information is integrated as the basis for trust score calculation.

[0173] Anomaly score S(x) i ): Used to assess the risk of a single action.

[0174] Community anomaly score S community This reflects the risk associated with a user's role in a coordinated attack.

[0175] The fused feature matrix Z provides contextual features (such as behavioral patterns, device information, network features, etc.) for trust scoring.

[0176] Isolation effect feedback I feedback : Indicates the risk change in user behavior after isolation (such as the recovery of user behavior during isolation, C(t)).

[0177] Threat Intelligence W threat Used to dynamically adjust scoring rules (e.g., weighted deduction of points for known malicious IPs).

[0178] The system weights and integrates the above inputs to form the basic inputs for the dynamic scoring model:

[0179] X input ={S(x i ), S community Z, I feedback W threat}

[0180] Based on the input data, the trust score T(x) is calculated using a dynamic weighted model.

[0181] Scoring model formula:

[0182] T(x) = T0 - α·S(x) i )-β·S community -γ·W threat +δ·C(t)

[0183] Where: T0: User's basic trust score (e.g., historical behavior score). S(x) i ): Single account anomaly score. S community Community anomaly rating. W threat : Threat intelligence score related to the user (e.g., whether it comes from a known malicious IP). C(t): Behavioral recovery score during quarantine, indicating whether the user's behavior has returned to normal. α,β,γ,δ: Score adjustment parameters used to control the weight of each factor on the trust score.

[0184] Dynamic weighted adjustment: The system dynamically adjusts the scoring weights based on the user's operation type and scenario: if S community If the risk of a coordinated attack is high, increase β. If user behavior returns to normal after isolation, increase δ and slowly restore the trust score.

[0185] Trust scores T(x) are typically set to a range of [0, 100], and are categorized into the following levels: High Trust (80-100): User behavior is safe. Medium Trust (50-79): Potential risks exist, requiring continuous monitoring. Low Trust (<50): High-risk user, triggering further isolation or verification.

[0186] The calculated trust score T(x) is fed back to the relevant modules in real time, forming a closed-loop collaboration.

[0187] Trust scoring influences the dynamic detection criteria of the behavior analysis module.

[0188] For low-trust users: the behavior analysis module increases the sensitivity of anomaly detection (e.g., by lowering the threshold for abnormal behavior).

[0189] For users with high trust: the behavior analysis module can appropriately relax the detection criteria (e.g., reduce interference from noisy behaviors).

[0190] Trust scores are used to adjust the strength of isolation:

[0191] I new =I old +α·S(x i )-β·C(t)+γ·(T(x)-T0)

[0192] Among them, low-trust users: isolation strength I new Increase. Trust restored users: Isolation intensity gradually reduced.

[0193] Trust scores provide a risk metric for accounts, used to update threat intelligence data. For example, accounts with trust scores below a certain threshold can be flagged as suspicious, triggering further analysis by the intelligence system.

[0194] Records dynamic changes in trust scores, supporting long-term analysis and system optimization.

[0195] The system stores each trust score calculation result in the user profile, forming a long-term record. The trend of trust score changes is used to analyze long-term characteristics of user behavior (such as slow threats and latent attacks).

[0196] The system periodically analyzes the accuracy of the trust scoring calculation model and optimizes the scoring weights (such as adjusting α, β, γ, δ) based on changes in user behavior data.

[0197] Corresponding to the account management method described above, this invention also proposes an account management device. Since the device embodiments of this invention correspond to the method embodiments described above, details not disclosed in the device embodiments can be referred to in the method embodiments described above, and will not be repeated here.

[0198] Figure 3This is a schematic diagram of the structure of an account management device provided in an embodiment of this disclosure, as shown below. Figure 3 As shown, it includes:

[0199] The acquisition unit 21 is used to acquire multimodal data of the monitored target; wherein, the multimodal data includes at least one of user behavior, device status, and network traffic;

[0200] The first generation unit 22 is used to dynamically fuse the multimodal data through a modality adaptive attention mechanism to generate a high-dimensional feature vector;

[0201] Detection unit 23 is used to perform anomaly detection on the high-dimensional feature vector based on the time-aware isolated forest algorithm and generate anomaly score;

[0202] The second generation unit 24 is used to identify cross-user collaborative attack behavior based on the user behavior graph model and community detection algorithm, and generate community scores.

[0203] The execution unit 25 is used to classify threat scenarios according to the anomaly score and the community score, and dynamically adjust the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data.

[0204] Furthermore, in one possible implementation of this disclosure, the acquisition unit 21 is further configured to:

[0205] User behavior data collected includes keyboard input frequency, mouse movement trajectory, and click behavior patterns;

[0206] The collected device status data includes device fingerprints, geographical location changes, and consistency of device login history.

[0207] Furthermore, in one possible implementation of this disclosure embodiment, the first generating unit 22 is further configured to:

[0208] When calculating modal weights using the modal adaptive attention mechanism, a noise suppression factor is introduced; wherein, the noise suppression factor is the reciprocal of the variance of the modal features;

[0209] The time-aware isolated forest algorithm is used to calculate the time offset based on the timestamps of the samples, and the path length is adjusted by a time decay function.

[0210] Furthermore, in one possible implementation of this embodiment, the second generating unit 24 is further configured to:

[0211] When constructing a user behavior graph model, Euclidean distance and time weighting factors are used to calculate the behavioral association weights between users;

[0212] The Louvain community detection algorithm is used to segment the user behavior graph and identify a set of collaborative attack accounts with high community anomaly scores.

[0213] Furthermore, in one possible implementation of this disclosure embodiment, the execution unit 25 is further configured to:

[0214] The risk level is determined based on the anomaly score and the community score, and the control of the monitored target is implemented based on the isolation strategy corresponding to the risk level.

[0215] The risk level of the monitored target is recalculated based on the risk recovery degree of the monitored target, the anomaly score, and the community score.

[0216] Furthermore, in one possible implementation of this disclosure embodiment, the execution unit 25 is further configured to:

[0217] The results of the isolation operation are fed back to the trust score calculation module, and the trust score is dynamically updated based on the user's behavior and recovery status.

[0218] The detection sensitivity of the behavior analysis module and the isolation strength of the isolation strategy module are adjusted based on the updated trust score, forming a closed-loop optimization mechanism.

[0219] It should be noted that the foregoing explanation of the method embodiments also applies to the apparatus of the embodiments of this disclosure, and the principle is the same. Therefore, the embodiments of this disclosure are not limited thereto.

[0220] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0221] Figure 4 A schematic block diagram of an example electronic device 300 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0222] like Figure 4As shown, device 300 includes a computing unit 301, which can perform various appropriate actions and processes based on a computer program stored in ROM (Read-Only Memory) 302 or a computer program loaded from storage unit 308 into RAM (Random Access Memory) 303. RAM 303 can also store various programs and data required for the operation of device 300. The computing unit 301, ROM 302, and RAM 303 are interconnected via bus 304. I / O (Input / Output) interface 305 is also connected to bus 304.

[0223] Multiple components in device 300 are connected to I / O interface 305, including: input unit 306, such as keyboard, mouse, etc.; output unit 307, such as various types of monitors, speakers, etc.; storage unit 308, such as disk, optical disk, etc.; and communication unit 309, such as network card, modem, wireless transceiver, etc. Communication unit 309 allows device 300 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0224] The computing unit 301 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphics Processing Units), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the various methods and processes described above, such as account management methods. For example, in some embodiments, the account management method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of the methods described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the aforementioned account management method by any other suitable means (e.g., by means of firmware).

[0225] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System-on-Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0226] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0227] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0228] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0229] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.

[0230] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0231] It's important to note that artificial intelligence (AI) is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.

[0232] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0233] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. An account management method, characterized in that, include: Collect multimodal data of the monitored target; wherein, the multimodal data includes at least one of user behavior, device status, and network traffic; The multimodal data is dynamically fused using a modality-adaptive attention mechanism to generate a high-dimensional feature vector; Anomaly detection is performed on the high-dimensional feature vector based on the time-aware isolated forest algorithm to generate anomaly scores; Based on user behavior graph models and community detection algorithms, cross-user collaborative attack behaviors are identified, and community scores are generated. Threat scenarios are classified based on the anomaly score and the community score, and the strength and scope of the isolation strategy are dynamically adjusted based on the feature weights of the threat scenarios and the multimodal data.

2. The method according to claim 1, characterized in that, The multimodal data collected from the monitored targets includes: User behavior data collected includes keyboard input frequency, mouse movement trajectory, and click behavior patterns; The collected device status data includes device fingerprints, geographical location changes, and consistency of device login history.

3. The method according to claim 1, characterized in that, The step of dynamically fusing the multimodal data through a modality-adaptive attention mechanism to generate a high-dimensional feature vector further includes: When calculating modal weights using the modal adaptive attention mechanism, a noise suppression factor is introduced; wherein, the noise suppression factor is the reciprocal of the variance of the modal features; The time-aware isolated forest algorithm is used to calculate the time offset based on the timestamps of the samples, and the path length is adjusted by a time decay function.

4. The method according to claim 1, characterized in that, The method for identifying cross-user collaborative attack behavior and generating community scores based on user behavior graph models and community detection algorithms also includes: When constructing a user behavior graph model, Euclidean distance and time weighting factors are used to calculate the behavioral association weights between users; The Louvain community detection algorithm is used to segment the user behavior graph and identify a set of collaborative attack accounts with high community anomaly scores.

5. The method according to claim 1, characterized in that, The step of classifying threat scenarios based on the anomaly score and the community score, and dynamically adjusting the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data, further includes: The risk level is determined based on the anomaly score and the community score, and the control of the monitored target is implemented based on the isolation strategy corresponding to the risk level. The risk level of the monitored target is recalculated based on the risk recovery degree of the monitored target, the anomaly score, and the community score.

6. The method according to claim 1, characterized in that, The step of classifying threat scenarios based on the anomaly score and the community score, and dynamically adjusting the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data, further includes: The results of the isolation operation are fed back to the trust score calculation module, and the trust score is dynamically updated based on the user's behavior and recovery status. The detection sensitivity of the behavior analysis module and the isolation strength of the isolation strategy module are adjusted based on the updated trust score, forming a closed-loop optimization mechanism.

7. An account management device, characterized in that, include: The acquisition unit is used to acquire multimodal data of the monitored target; wherein the multimodal data includes at least one of user behavior, device status, and network traffic; The first generation unit is used to dynamically fuse the multimodal data through a modality adaptive attention mechanism to generate a high-dimensional feature vector; The detection unit is used to perform anomaly detection on the high-dimensional feature vector based on the time-aware isolated forest algorithm and generate anomaly scores; The second generation unit is used to identify cross-user collaborative attack behaviors based on user behavior graph models and community detection algorithms, and generate community scores. The execution unit is used to classify threat scenarios based on the anomaly score and the community score, and dynamically adjust the strength and scope of the isolation strategy based on the feature weights of the threat scenarios and the multimodal data.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-6.

Images