Microanomaly detection and early risk early warning system for communication behavior chain

Abstract

The invention relates to the technical field of communication network security, in particular to a micro-anomaly detection and early risk early warning system for a communication behavior chain, which comprises a communication event acquisition unit used for acquiring discrete API (Application Program Interface) call events from a communication interface, the API call events comprising user identity, time, network address, request type and response state information, and meanwhile, the collected API calling event is transmitted to the behavior chain construction unit. API calling events are analyzed and cleaned in real time through the communication event acquisition unit, and the behavior chain construction unit is combined to aggregate the events in a dynamic time window by taking a user identity as a core to form an exclusive behavior chain, so that a black production is prevented from avoiding detection by replacing an IP (Internet Protocol); the base line learning unit learns historical behavior features by adopting a time sequence model such as LSTM and incrementally updates a normal behavior base line to adapt to user behavior changes, and the micro-anomaly detection unit accurately recognizes tiny deviation through comparison of a multi-dimensional feature vector and a normal feature space and reduces false alarms.

Description

Technical Field

[0001] This invention relates to the field of communication network security technology, specifically to a micro-anomaly detection and early risk warning system for communication behavior chains. Background Technology

[0002] The main security threats currently facing international communication aggregation platforms include: API key theft, SMSBombing, fraudulent charges, fraudulent marketing SMS messages, and fake registrations. Traditional risk control methods are mostly based on single rules (such as single IP frequency restrictions) or post-event batch analysis, which have the following problems: 1. Delay: Rules are often only formulated after an attack has occurred, making early warning impossible.

[0003] 2. High false alarm rate: Simple rules can easily harm normal users, affecting customer experience.

[0004] 3. Easy to circumvent: Black market operators can easily bypass single-dimensional rules by dispersing IPs and changing accounts.

[0005] Therefore, there is an urgent need for a seamless risk control solution that can detect risks in advance from subtle behaviors without affecting the normal user experience. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a micro-anomaly detection and early risk warning system for communication behavior chains, which solves the problems of delayed risk control, high false alarm rate, and susceptibility to circumvention by black market operators when used in comparison with existing technologies.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a micro-anomaly detection and early risk warning system for communication behavior chains, comprising: The communication event acquisition unit is used to acquire discrete API call events from the communication interface. The API call events include user identity, time, network address, request type and response status information. At the same time, the acquired API call events are transmitted to the behavior chain construction unit. The behavior chain construction unit is used to aggregate API call events transmitted by the communication event acquisition unit. It connects discrete API call events into a continuous communication behavior chain through preset association logic. The communication behavior chain is used to represent the operation sequence of a specific user within a predetermined time window. The baseline learning unit is used to acquire the historical communication behavior chain generated by the behavior chain building unit. By applying a machine learning model to learn the micro-patterns of the historical communication behavior chain, a historical baseline of the normal behavior pattern of the communication behavior chain is established and continuously updated. The micro-anomaly detection unit is used to acquire the current communication behavior chain generated by the behavior chain construction unit, and simultaneously acquire the historical baseline of normal behavior patterns established by the baseline learning unit. By comparing the micro-pattern of the current communication behavior chain with the historical baseline, a machine learning model is used to detect whether there are any minor deviations. The detection method is as follows: Obtain the feature vector of the current communication behavior chain and input it into the pre-trained machine learning model; Determine the feature space of normal behavior patterns based on historical baselines; Calculate the distance metric between the feature vector and the feature space; The distance metric is compared with a preset anomaly threshold. If it is greater than the threshold, it is identified as an abnormal communication behavior chain and an anomaly identifier is generated. The risk warning unit is used to acquire the anomaly identifiers generated by the micro-anomaly detection unit and issue risk warning signals based on the anomaly identifiers.

[0008] Furthermore, the communication event acquisition unit is further used for: The API requests received by the communication interface are parsed in real time to extract the core data of the API call events; The extracted API call events are cleaned to remove redundant or incorrectly formatted events, and the cleaned events are uniquely identified before being transmitted to the behavior chain construction unit.

[0009] Furthermore, the specific method by which the behavior chain construction unit concatenates the API call events to form a communication behavior chain is as follows: Using the user identity information as a key dimension, API call events belonging to the same user are serialized and aggregated within a preset time window to form a user-specific behavior chain; The length of the communication behavior chain is dynamically set according to the needs of different risk scenarios.

[0010] Furthermore, the specific method by which the baseline learning unit establishes and continuously updates the historical baseline of normal behavioral patterns is as follows: Extract behavioral features such as call frequency, call order, parameter distribution, and geographic location distribution from historical communication behavior chains; Behavioral features are input into a machine learning model for training to build a feature model of normal behavioral patterns. Based on newly added normal communication behavior chain data, the feature model is incrementally learned to adaptively update the historical baseline.

[0011] Furthermore, the specific method by which the micro-anomaly detection unit detects the micro-patterns of the current communication behavior chain is as follows: Perform feature transformation on the current communication behavior chain to obtain a behavior feature vector; The behavioral feature vectors are input into the machine learning model trained in the baseline learning unit; Machine learning models calculate anomaly scores for behavioral feature vectors that deviate from normal behavioral patterns; The abnormal score is compared with a preset abnormal threshold. If it is higher than the threshold, it is determined that there is a slight deviation.

[0012] Furthermore, the specific method by which the risk warning unit generates and issues risk warning signals is as follows: Based on the analysis results of the anomaly indicators, the risk level is classified into warning, alert, or blocking level; Risk warning signals are sent to pre-defined recipients via notification channels, including email, SMS, or message queues. The warning signals include a summary of the abnormal event, the entities involved, and suggested actions.

[0013] Furthermore, the communication behavior chain is used to identify at least one of the following security threat patterns: API key theft mode is characterized by high-frequency API calls after logging in from a different location or using atypical IP addresses; SMS bombing mode is characterized by sending SMS requests to a large number of unrelated mobile phone numbers in a short period of time; Fraudulent marketing tactics involve sending large numbers of text messages with similar content to new or inactive user groups.

[0014] Furthermore, the machine learning model employs a time series analysis model, which includes a recurrent neural network (RNN), a long short-term memory network (LSTM), or a gated recurrent unit (GRU). The model is used to learn the temporal dependencies and sequence patterns of events in the communication behavior chain, thereby accurately identifying minute deviations.

[0015] Furthermore, the system also includes: The risk handling unit is used to receive risk warning signals and perform automated handling or manual intervention according to the risk level. Handling operations include temporarily restricting access or blocking suspicious users. The model optimization unit is used to feed the actual processing results and user feedback as training data to the baseline learning unit in order to iteratively optimize the detection accuracy of the machine learning model.

[0016] Furthermore, the system further includes: The data storage unit is used to store API call events collected by the communication event acquisition unit, communication behavior chains generated by the behavior chain construction unit, and historical baselines of normal behavior patterns established by the baseline learning unit. The system is deployed on cloud communication, CPaaS, or API aggregation platforms and integrated with the platform's API gateway to achieve seamless risk control.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention utilizes a communication event acquisition unit to analyze and clean API call events in real time. Combined with a behavior chain construction unit, it aggregates events within a dynamic time window, using user identity as the core, to form a unique behavior chain, preventing malicious actors from evading detection by changing IP addresses. A baseline learning unit uses time-series models such as LSTM to learn historical behavioral features and incrementally updates the normal behavior baseline, adapting to changes in user behavior. A micro-anomaly detection unit accurately identifies minor deviations by comparing multi-dimensional feature vectors with the normal feature space, reducing false alarms. A risk warning unit provides graded warnings based on the degree of anomaly and notifies users through multiple channels. A risk handling unit combines automated operations with manual intervention for rapid response. The system is deployed on cloud communication platforms and integrated with API gateways for seamless risk control. A model optimization unit iteratively optimizes detection accuracy based on handling results and user feedback, effectively preventing threats such as API key theft, SMS bombing, and fraudulent marketing, balancing risk control effectiveness with user experience. Attached Figure Description

[0018] Figure 1 This is a system structure diagram of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Please see Figure 1 This invention provides a micro-anomaly detection and early risk warning system for communication behavior chains, comprising: The communication event acquisition unit is used to acquire discrete API call events from the communication interface. The API call events include user identity, time, network address, request type and response status information. At the same time, the acquired API call events are transmitted to the behavior chain construction unit. The behavior chain construction unit is used to aggregate API call events transmitted by the communication event acquisition unit. It connects discrete API call events into a continuous communication behavior chain through preset association logic. The communication behavior chain is used to represent the operation sequence of a specific user within a predetermined time window. The baseline learning unit is used to acquire the historical communication behavior chain generated by the behavior chain building unit. By applying a machine learning model to learn the micro-patterns of the historical communication behavior chain, a historical baseline of the normal behavior pattern of the communication behavior chain is established and continuously updated. The micro-anomaly detection unit is used to acquire the current communication behavior chain generated by the behavior chain construction unit, and simultaneously acquire the historical baseline of normal behavior patterns established by the baseline learning unit. By comparing the micro-pattern of the current communication behavior chain with the historical baseline, a machine learning model is used to detect whether there are any minor deviations. The detection method is as follows: Obtain the feature vector of the current communication behavior chain and input it into the pre-trained machine learning model; Determine the feature space of normal behavior patterns based on historical baselines; Calculate the distance metric between the feature vector and the feature space; The distance metric is compared with a preset anomaly threshold. If it is greater than the threshold, it is identified as an abnormal communication behavior chain and an anomaly identifier is generated. The risk warning unit is used to acquire the anomaly identifiers generated by the micro-anomaly detection unit and issue risk warning signals based on the anomaly identifiers.

[0021] Specifically, this implementation addresses the problems of "lag, high false alarm rate, and easy avoidance" in traditional risk control in the background technology. It achieves real-time, accurate, and multi-dimensional seamless risk control through the collaboration of various units, as detailed below: The communication event collection unit collects discrete API call events from the API gateway interface of the cloud communication platform (such as the SMS sending API and user login API interface of the CPaaS platform). The collected information must completely cover user identity, time, network address, request type and response status: user identity uses a unique user identifier (e.g., user ID "U20240501001" or bound mobile phone number "138xxxx5678"), time is uniformly UTC timestamp (e.g., "1714567890", accurate to the second), network address includes source IP (e.g., "113.200.56.78") and target API server IP (e.g., "47.98.123.45"), request type is defined according to business scenario (e.g., "USER_LOGIN", "SMS_SEND", "API_KEY_VERIFY"), and response status follows HTTP standard status codes (e.g., "200" indicates success, "401" indicates insufficient permissions, and "403" indicates access forbidden). The data acquisition process utilizes a real-time stream processing framework (such as Flink) to achieve millisecond-level data transmission, ensuring data timeliness and laying the foundation for subsequent real-time detection.

[0022] The behavior chain construction unit uses "user identity + preset time window" as the core association logic to aggregate the collected API call events. The preset time window is dynamically adjusted according to the risk scenario (e.g., login verification scenario is highly risky and sensitive, so it is set to 10 minutes; ordinary information query scenario is set to 30 minutes). Taking user ID "U20240501001" as an example, within the 10-minute time window (UTC time 1714567890-1714568490), the user's API call events are chained in ascending order of timestamps to form a continuous communication behavior chain: [(user_id:U20240501001, timestamp:1714567890, ip:113.200.56.78, request_type:USER_LOGIN, response_status:200), (user_id:U20240501001, timestamp:1714567920, ip:113.200.56.78, (request_type:SMS_SEND,response_status:200), (user_id:U20240501001, timestamp:1714568000, ip:113.200.56.78, request_type:SMS_SEND, response_status:200)). This behavioral chain fully represents the user's short-term action sequence, solving the problem of "easily evaded" traditional single-event analysis—even if the black market changes its IP, the correlation of multiple events of the same user can still be traced.

[0023] The baseline learning unit acquires historical communication behavior chains from the past 6 months (normal behavior chains with no risk labels need to be filtered out), and learns micro-patterns through a Long Short-Term Memory (LSTM) network to establish a historical baseline. First, the core features of the historical behavior chains are extracted: call frequency (the number of API calls per user per hour, denoted as...). ), and the order of calls (encoding the request type according to business logic, for example, "USER_LOGIN→SMS_SEND" is encoded as "1→2", denoted as ), parameter distribution (such as the proportion of the mobile phone numbers receiving SMS messages by their geographical location, denoted as Geographical distribution (city distribution corresponding to source IP, denoted as...) These features are normalized (to avoid the influence of dimensional differences on the model), for example, the frequency normalization formula is: ; in, This represents the minimum call frequency within the historical normal behavior chain. The maximum value, This represents the normalized call frequency (value range [0,1]). Other features are normalized using the same logic to form the feature vector. The input is used to train the LSTM model. The model employs the Adam optimizer (learning rate 0.001) and iterates for 100 epochs, ultimately outputting the feature space of the normal behavior pattern (containing the feature mean vector). Covariance Matrix This refers to the historical baseline. Simultaneously, the system adds new normal behavior chain data monthly, using mini-batch gradient descent to incrementally learn the model, ensuring the baseline is adaptively updated as user behavior changes, thus avoiding false alarms caused by changes in normal user behavior.

[0024] After acquiring the current communication behavior chain, the micro-anomaly detection unit first extracts and normalizes features according to the same logic as baseline learning to obtain the current feature vector. The Mahalanobis distance is used to measure the deviation of the current feature vector from the normal feature space (Mahalanobis distance can eliminate the influence of correlation between features and has higher detection accuracy than Euclidean distance). The calculation formula is as follows: ; in, For vector transpose, It is the inverse of the covariance matrix. Deviation distance. Preset anomaly threshold. Determined using the 3σ principle based on historical normal data ( , The mean Mahalanobis distance of historical normal data. (where the standard deviation is) If so, it is identified as an abnormal communication behavior chain and an anomaly identifier is generated (including the abnormal user ID, abnormal time, and deviation characteristics). For example, the Mahalanobis distance of a user's current behavior chain. threshold The system determines that it is abnormal, and the process takes only 50 milliseconds, solving the problem of "lag" in traditional risk control.

[0025] After receiving the anomaly flag, the risk warning unit determines the risk level based on the deviation distance. Risk level classification: For early warning (e.g.) ), For alarms (e.g.) ), To block (e.g.) Different alert levels correspond to different notification channels and content: Early warning signals are pushed to the risk control platform via a message queue, containing a summary of the abnormal event (e.g., "2024-05-20 15:30, user U20240501001's SMS_SEND frequency is slightly higher than the baseline"), the entities involved (user ID, source IP), and a suggestion to "continuously monitor"; alarm signals are sent to risk control specialists via SMS, suggesting "temporarily limiting the number of SMS messages sent by this user within one hour"; blocking signals are synchronized with the risk control and technical teams via email, suggesting "freezing the user's account for 24 hours." The entire alert process requires no user intervention, achieving seamless risk control. Simultaneously, the tiered handling balances risk control and user experience, addressing the problem of "high false alarm rate" in traditional risk control.

[0026] In this embodiment, the communication event acquisition unit is further used for: The API requests received by the communication interface are parsed in real time to extract the core data of the API call events; The extracted API call events are cleaned to remove redundant or incorrectly formatted events, and the cleaned events are uniquely identified before being transmitted to the behavior chain construction unit.

[0027] Specifically, in addition to basic data acquisition functions, the communication event acquisition unit ensures data quality through real-time analysis and data cleaning, as detailed below: The real-time parsing process utilizes the Flink real-time stream processing framework, connecting to the API gateway's data stream interface to parse the HTTP headers and message bodies of API requests to extract core data. For example, when parsing an "SMS_SEND" API request, it extracts the user identity (e.g., "U20240501002") from the "X-User-ID" field in the HTTP header, the timestamp (e.g., "1714569000") from the "send_time" field in the message body, the source IP (e.g., "120.35.78.90") from the "client_ip" field, the request type ("SMS_SEND") from the "request_type" field, and the response status ("200") from the "response_code" field. The parsing process sets field validation rules (e.g., user IDs must conform to the "U + 8-digit number" format, and timestamps must be within ±30 seconds of the current time). Requests that do not meet the rules are temporarily stored in an exception data queue to prevent invalid data from entering subsequent processes.

[0028] The data cleaning process is divided into redundancy removal and format correction: Redundancy removal targets duplicate events (such as duplicate API calls with the same user ID, timestamp, and request type). A hash value is calculated for the key fields (user_id + timestamp + request_type) of the event using a hash algorithm (such as MD5). If the hash value already exists in the temporary cache (Redis), it is determined to be a duplicate event and deleted. Format error correction targets missing fields (such as missing source IP) or abnormal formats (such as timestamps as the string "2024-05-20"). Missing fields are marked as "NULL" and recorded in the log. Fields with abnormal formats are corrected using format conversion tools (such as converting string timestamps to UTC timestamps). Each cleaned event is assigned a unique identifier using a UUID (format: "EVENT-" + UUID, e.g., "EVENT-61a2b3c4-d5e6-78f9-0a1b-2c3d4e5f6g7h"), and transmitted to the behavior chain building unit via a Kafka message queue to ensure data uniqueness and integrity, providing high-quality input for subsequent behavior chain building.

[0029] In this embodiment, the behavior chain construction unit concatenates the API call events to form a communication behavior chain in the following specific way: Using the user identity information as a key dimension, API call events belonging to the same user are serialized and aggregated within a preset time window to form a user-specific behavior chain; The length of the communication behavior chain is dynamically set according to the needs of different risk scenarios.

[0030] Specifically, the behavior chain construction unit takes user identity as the core dimension and forms a user-specific behavior chain through serialization and aggregation, as follows: First, the key aggregation dimension is determined to be user identity information (such as user ID "U20240501003"). The preset time window is dynamically set according to the risk scenario: for example, the SMS bombing scenario requires a rapid response, so the time window is set to 3 minutes; the account theft scenario requires coverage of the complete login process, so the time window is set to 15 minutes. Taking the SMS bombing scenario as an example, the system obtains all API call events of user "U20240501003" within a 3-minute time window (UTC 1714570000-1714570180), sorts them in ascending order of timestamp, removes request types unrelated to SMS sending (such as "USER_INFO_QUERY"), and retains only "SMS_SEND" requests, forming a serialized aggregation result: [(timestamp:1714570020, ip:117.156.89.10,request_type:SMS_SEND, response_status:200, phone:139xxxx1234), (timestamp:1714570050, ip:117.156.89.10, request_type:SMS_SEND, The response_status:200,phone:136xxxx5678, (timestamp:1714570100, ip:117.156.89.10, request_type:SMS_SEND, response_status:200, phone:135xxxx9012)] is the user's exclusive behavior chain.

[0031] The length of the behavior chain is dynamically adjusted according to the needs of the risk scenario: in high-risk scenarios (such as API key theft), the length needs to be shortened for rapid detection, for example, set to 5 (meaning a behavior chain can be built after 5 consecutive API calls); in low-risk scenarios (such as ordinary information queries), the length can be extended to reduce the amount of computation, for example, set to 10. For example, in the API key theft scenario, if user "U20240501004" calls the "API_KEY_VERIFY" interface 6 times in 5 minutes, the system immediately builds a behavior chain of length 6 and triggers detection. Compared with the traditional "waiting for batch data" method, the detection response speed is improved by 80%, effectively preventing high-frequency attacks after key theft.

[0032] In this embodiment, the baseline learning unit establishes and continuously updates the historical baseline of normal behavior patterns in the following specific way: Extract behavioral features such as call frequency, call order, parameter distribution, and geographic location distribution from historical communication behavior chains; Behavioral features are input into a machine learning model for training to build a feature model of normal behavioral patterns. Based on newly added normal communication behavior chain data, the feature model is incrementally learned to adaptively update the historical baseline.

[0033] Specifically, the baseline learning unit constructs and updates the historical baseline of normal behavior patterns through feature extraction, model training, and incremental learning, as follows: The feature extraction stage extracts four core behavioral features from the historical communication behavior chain: call frequency (number of API calls per user per hour). For example, the historical average of user "U20240501005" (Times / hour), call order (the request type is encoded according to business logic, for example, "USER_LOGIN→API_KEY_VERIFY→SMS_SEND" is encoded as "1→2→3", denoted as...) ), parameter distribution (such as the proportion of the receiving mobile phone numbers in terms of their geographical location; for example, in the mobile phone numbers receiving SMS messages for user "U20240501005", 70% are from Beijing and 20% are from Shanghai, denoted as ). Geographical distribution (city distribution corresponding to the source IP, for example, if 90% of the user's source IPs are from Beijing and 10% are from other cities, denoted as ). After extraction, the features are normalized (e.g., call frequency is normalized to [0,1]) to ensure that the dimensions of each feature are consistent.

[0034] The model training uses an LSTM model with 4 nodes in the input layer (corresponding to four feature classes), 2 hidden layers (32 nodes each, with tanh activation function), and 1 output layer (outputting the predicted feature value of normal behavior). The training data consists of 100,000 feature vectors representing normal behavior chains from the past 6 months, and the mean squared error is used as the loss function. ; in, The number of training samples, The feature values ​​predicted by the model. These are the actual feature values. The model is trained for 100 iterations, with a batch size of 64 per iteration, and the final output is the feature space (mean vector) of the normal behavior pattern. Covariance Matrix ), which is the initial historical baseline.

[0035] The incremental learning process adds approximately 20,000 normal behavior chains from the past month each month. This eliminates the need to retrain the model; instead, it updates the model parameters (such as the weight matrix and bias vector of the LSTM) using mini-batch gradient descent (batch size 32, learning rate 0.0005) and simultaneously updates the feature space. and For example, if user "U20240501005" increases their monthly API call frequency from 8 times / hour to 15 times / hour due to a job change without risk, after incremental learning, the average call frequency in the historical baseline will be updated from 8 to 15, avoiding false alarms caused by changes in normal user behavior and ensuring that the baseline always matches the user's latest behavior habits.

[0036] In this embodiment, the micro-anomaly detection unit detects the micro-patterns of the current communication behavior chain in the following specific way: Perform feature transformation on the current communication behavior chain to obtain a behavior feature vector; The behavioral feature vectors are input into the machine learning model trained in the baseline learning unit; Machine learning models calculate anomaly scores for behavioral feature vectors that deviate from normal behavioral patterns; The abnormal score is compared with a preset abnormal threshold. If it is higher than the threshold, it is determined that there is a slight deviation.

[0037] Specifically, the micro-anomaly detection unit accurately identifies minute deviations in the current behavioral chain through feature transformation, anomaly score calculation, and threshold comparison, as follows: The feature transformation stage extracts four types of features—call frequency, call order, parameter distribution, and geographic location—from the current communication behavior chain based on the baseline-learned feature extraction logic, and then performs normalization processing. For example, in the behavior chain of the current user "U20240501006," the call frequency... times / hour (historical normal) , After normalization (Outside the range [0,1], marked as a potential anomaly); the call order is "USER_LOGIN→SMS_SEND" (the historical normal order is "USER_LOGIN→API_KEY_VERIFY→SMS_SEND"), after encoding In the parameter distribution, unfamiliar phone numbers account for 80% (historically, normal numbers account for ≤20%), after normalization. The geographical location is Shenzhen (historically it was Beijing), after normalization. This ultimately forms the current feature vector. .

[0038] The abnormal score calculation process will The LSTM model, trained with a baseline, is input, and the model outputs anomaly scores based on the degree of deviation between the current features and the normal feature space. (Values ​​range [0,10], the higher the score, the greater the deviation). The core calculation logic of outlier scores is based on Mahalanobis distance (in weight 1). ), and mapped to [0,10] via the sigmoid function: ; in, For the sigmoid function, This is the Mahalanobis distance.

[0039] The threshold comparison process presets an abnormal threshold. (Determined through the 3σ principle of historical normal data, for example) If the current abnormal score If so, it is determined that there is a slight deviation; if If the score is abnormal, it is considered normal. For example, the abnormal score of user "U20240501006" is considered normal. The system determines that there is an anomaly in its behavior chain and generates an anomaly flag; if another user... If the result is positive, it is considered normal. This process uses multi-feature fusion detection to identify minor deviations such as "slight deviation of a single feature but abnormal superposition of multiple features" (e.g., slightly higher call frequency + slightly higher proportion of unfamiliar phone numbers), avoiding missed detections by traditional single rules.

[0040] In this embodiment, the risk warning unit generates and issues a risk warning signal in the following specific way: Based on the analysis results of the anomaly indicators, the risk level is classified into warning, alert, or blocking level; Risk warning signals are sent to pre-defined recipients via notification channels, including email, SMS, or message queues. The warning signals include a summary of the abnormal event, the entities involved, and suggested actions.

[0041] Specifically, the risk warning unit achieves accurate and efficient risk warnings through risk level classification, multi-channel notification, and standardized warning content, as detailed below: Risk level classification is based on the anomaly score of the micro-anomaly detection unit. With threshold Relationship: For early warning (e.g.) , This indicates a slight deviation in behavior, with a low risk. For alarm ( This indicates a significant deviation in behavior and a moderate risk. To block ( This indicates a serious deviation from the expected course of action and an extremely high risk.

[0042] Notification channels are matched according to risk level: early warning signals are pushed to the enterprise risk control management platform via message queues (such as RabbitMQ) and displayed in real time on the risk control dashboard without immediate manual processing; alarm signals are sent to the preset risk control specialist mobile phone numbers (such as "138xxxx9012" "139xxxx3456") via SMS gateway, and a pop-up reminder is triggered on the risk control platform at the same time; blocking signals are sent to the risk control team and technical team email addresses (such as "risk@company.com" "tech@company.com") via SMTP protocol, and a group notification is sent simultaneously on the enterprise instant messaging tool (such as DingTalk).

[0043] The warning signal content includes standardized fields: an abnormal event summary (e.g., "2024-05-20 16:45, user U20240501007 has high frequency SMS_SEND behavior, abnormal score 6.5"), involved entities (user ID, source IP, abnormal time period, associated mobile phone number), risk level (e.g., "alarm"), and suggested handling actions (e.g., "temporarily restrict the number of SMS messages sent by this user within 2 hours ≤ 5"). For example, the warning signal for the blocking level is as follows: "On May 20, 2024, at 17:00, user U20240501008's source IP changed from Beijing to Guangzhou, and the API_KEY_VERIFY interface was called 20 times within 10 minutes, with an anomaly score of 8.3, risk level: blocking; involved entities: U20240501008, IP: 203.192.11.12, time period: 1714575600-1714576200; recommended action: freeze the user account for 24 hours, and verify the security of the API key." Standardized warning content and multi-channel notifications ensure that relevant personnel quickly grasp risk information and take action, improving risk response efficiency.

[0044] In this embodiment, the communication behavior chain is used to identify at least one of the following security threat patterns: API key theft mode is characterized by high-frequency API calls after logging in from a different location or using atypical IP addresses; SMS bombing mode is characterized by sending SMS requests to a large number of unrelated mobile phone numbers in a short period of time; Fraudulent marketing tactics involve sending large numbers of text messages with similar content to new or inactive user groups.

[0045] Specifically, the communication behavior chain accurately identifies three types of threats—API key theft, SMS bombing, and fraudulent marketing—by matching the characteristic patterns of different security threats, as follows: The identification of API key theft patterns is based on the characteristics of "login from a different location + high-frequency key verification". For example, in the historical behavior chain of user "U20240501009", the source IP is always Hangzhou (location code "HZ"), and the "API_KEY_VERIFY" interface is called ≤5 times per month; in the current behavior chain, the source IP changes to Chengdu (location code "CD", with a difference of >90% from the historical baseline), and the "API_KEY_VERIFY" interface is called 18 times within 15 minutes (more than 3 times the historical baseline). The behavior chain meets the theft characteristics of "atypical IP address + high-frequency API calls after login from a different location", and the system judges it as an API key theft pattern.

[0046] The identification of SMS bombing patterns is based on the characteristics of "short time + high frequency of sending to multiple numbers". For example, in the historical behavior chain of user "U20240501010", a maximum of 3 SMS messages were sent within 5 minutes, and the receiving mobile phone numbers were mostly user-related numbers (such as the mobile phone numbers of relatives and friends); in the current behavior chain, 22 "SMS_SEND" requests were sent within 5 minutes, and the receiving mobile phone numbers included 20 unrelated unknown numbers such as 138xxxx1111 and 139xxxx2222 (unknown numbers accounted for 100%), which meets the characteristics of "SMS sending requests to a large number of unrelated mobile phone numbers in a short period of time", and the system judges it as an SMS bombing pattern.

[0047] The identification of fraudulent marketing patterns is based on the characteristics of "homogenized content + targeted sending to new / inactive users". For example, in the historical behavior chain of user "U20240501011", ≤10 marketing SMS messages are sent per month, the content of which is mostly personalized recommendations, and the proportion of new / inactive users among the recipients is ≤10%; in the current behavior chain, 150 "promotional activity" SMS messages with identical content are sent within 1 hour, and 85% of the recipients are new users in the past 24 hours (who have not interacted with the user), which meets the characteristics of "mass sending homogenized SMS messages to new or inactive user groups", and the system judges it as a fraudulent marketing pattern.

[0048] In this embodiment, the machine learning model adopts a time series analysis model, which includes a recurrent neural network (RNN), a long short-term memory network (LSTM), or a gated recurrent unit (GRU). The model is used to learn the time dependence and sequence pattern of events in the communication behavior chain, thereby accurately identifying minute deviations.

[0049] Specifically, this system uses LSTM (Long Short-Term Memory) network as the time series analysis model. By learning the time dependency and sequence pattern of communication behavior chains, it improves the accuracy of identifying minute deviations, as follows: The LSTM model structure consists of an input layer, two hidden layers, and an output layer. The input layer has four nodes (corresponding to four types of features: call frequency, call order, parameter distribution, and geographic location). Each hidden layer has 32 nodes, uses the tanh activation function, and includes three types of gating units: forget gate, input gate, and output gate, used to remember the temporal dependencies of the behavior chain (such as the fixed time interval of "calling key verification within 5 seconds after login"). The output layer has one node and outputs the anomaly score (mapped to [0,10]).

[0050] The computational logic of the LSTM gating unit is as follows: 1. Forget Gate (determines how many historical cell states are preserved): ; 2. Input gate (determines how much new information is updated to the cell state): ; 3. Cell state update (fusion of history and new information): ; 4. Output gate (determines how many cell states are output to the hidden state): ; in, It is a sigmoid activation function (output [0,1]). This is element-wise multiplication. The weight matrix has a dimension of 32×(32+4)=32×36. It is a bias vector (32×1 dimension). The hidden state from the previous time step (32×1 dimension). Input the features (4×1 dimension) for the current time step. The current cell state (32×1 dimension).

[0051] The model was trained using the Adam optimizer (learning rate 0.001, β1=0.9, β2=0.999) for 100 iterations with a batch size of 64 per iteration. By learning the sequence patterns of behavioral chains (such as the normal order of "login → key verification → SMS sending"), it can accurately identify minor deviations (such as "sending an SMS directly after logging in, skipping key verification"). Compared to traditional RNN models, LSTM solves the gradient vanishing problem in long sequences and can still maintain more than 90% dependency recognition accuracy for behavioral chain sequences of more than 10 steps.

[0052] In this embodiment, the system further includes: The risk handling unit is used to receive risk warning signals and perform automated handling or manual intervention according to the risk level. Handling operations include temporarily restricting access or blocking suspicious users. The model optimization unit is used to feed the actual processing results and user feedback as training data to the baseline learning unit in order to iteratively optimize the detection accuracy of the machine learning model.

[0053] Specifically, the risk management unit achieves a combination of automated processing and manual intervention, while the model optimization unit improves detection accuracy through feedback data iteration, as detailed below: After receiving a risk warning signal, the risk management unit performs the corresponding operation based on the risk level: Warning level ( ): Automatically adds users to the "key monitoring list". The system updates the user's behavior chain every 5 minutes to track behavior changes in real time without manual intervention; Alarm level ( ): Automatically execute "temporary access restriction" operations, such as restricting users to send a maximum of 10 SMS messages and call API interfaces ≤20 times within 2 hours. At the same time, generate a manual verification work order (including details of the abnormal behavior chain) and push it to the risk control specialist's to-do list. The specialist must complete the verification and provide feedback on the results within 1 hour. Blocking level ( ): Automatically execute the "block suspicious users" operation, freeze user accounts for 24 hours, prohibit all API calls, and notify the technical team via email and instant messaging tools. The technical team must investigate whether there is account theft, malicious attack, or other similar situations within 30 minutes.

[0054] The model optimization unit collects actual processing results and user feedback (such as manual verification of "false alarms" or "positive alarms"), labels this data as new training samples, and feeds it back to the baseline learning unit. For example, if a user is judged to be at the alarm level, and manual verification finds that their high-frequency calls are due to temporary work needs (false alarm), then the user's current behavior chain is labeled as a "normal sample"; if verification confirms SMS bombing (positive alarm), then it is labeled as an "abnormal sample". Each quarter, the newly added labeled samples (approximately 5000) are added to the training set of the baseline learning unit, and the detection accuracy is optimized by fine-tuning the LSTM model parameters (learning rate 0.0005, 20 iterations).

[0055] In this embodiment, the system further includes: The data storage unit is used to store API call events collected by the communication event acquisition unit, communication behavior chains generated by the behavior chain construction unit, and historical baselines of normal behavior patterns established by the baseline learning unit. The system is deployed on cloud communication, CPaaS, or API aggregation platforms and integrated with the platform's API gateway to achieve seamless risk control.

[0056] Specifically, the data storage unit adopts a distributed storage architecture to ensure data security and efficient access, and the system deployment achieves seamless risk control, as detailed below: Data storage units select appropriate storage solutions based on data type: API call events: HBase column storage database is used (suitable for high-frequency writes and random reads). The stored fields include user_id, timestamp, ip, request_type, response_status, request_body, and event_id (unique identifier). The data is partitioned by user_id. When querying, historical events can be quickly located by user_id. The write performance of a single node can reach 100,000 records / second. Communication Behavior Chain: It adopts MongoDB document database (suitable for storing unstructured sequence data). Each behavior chain is stored in JSON format, including user_id, time_window, chain (behavior sequence array), and create_time (creation time). It supports queries by user_id and time_window, and the query response time is ≤100 milliseconds. Historical baseline of normal behavior patterns: The mean vector of the feature space is stored in a Redis cache database (suitable for high-frequency reads). Covariance Matrix Meanwhile, a MySQL relational database is used to store the LSTM model parameters (weight matrix, bias vector), and the Redis cache hit rate is ≥95%, ensuring that baseline data is read quickly when detecting micro-anomalies.

[0057] The system is deployed on a CPaaS (Communication Platform as a Service) platform and is deeply integrated with the platform's API gateway. The API gateway intercepts all API requests entering and leaving the platform (such as SMS sending and user login requests) and transmits them to the communication event collection unit in real time through an internal interface. The entire process requires no additional user action (such as entering verification codes or waiting for approval), resulting in a seamless user experience. For example, when a user sends an SMS on the CPaaS platform, the system background simultaneously completes API call event collection, behavior chain construction, and anomaly detection. If the result is normal, the SMS is sent normally (within ≤1 second); if an anomaly is detected, the system automatically performs restriction operations, and the user only receives a "Current sending frequency is too high, please try again later" message. This seamless risk control process has no impact on user operational efficiency. In addition, the system supports horizontal scaling. By adding HBase and MongoDB nodes, it can handle over 100,000 API calls per second, meeting the business needs of large-scale CPaaS platforms.

[0058] In summary, this invention uses a communication event acquisition unit to analyze and clean API call events in real time, and a behavior chain construction unit to aggregate events within a dynamic time window based on user identity to form a unique behavior chain, preventing black market operators from evading detection by changing IP addresses. A baseline learning unit uses time series models such as LSTM to learn historical behavioral features and incrementally updates the normal behavior baseline to adapt to changes in user behavior. A micro-anomaly detection unit accurately identifies minor deviations by comparing multi-dimensional feature vectors with the normal feature space, reducing false alarms. A risk warning unit provides graded warnings based on the degree of anomaly and notifies users through multiple channels. A risk handling unit combines automated operations with manual intervention for rapid response. Furthermore, the system is deployed on cloud communication platforms and integrated with API gateways to achieve seamless risk control. A model optimization unit can iteratively optimize detection accuracy based on handling results and user feedback, effectively preventing threats such as API key theft, SMS bombing, and fraudulent marketing, balancing risk control effectiveness with user experience.

[0059] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0060] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A micro-anomaly detection and early risk warning system for communication behavior chains, characterized in that, include: The communication event acquisition unit is used to acquire discrete API call events from the communication interface. The API call events include user identity, time, network address, request type and response status information. At the same time, the acquired API call events are transmitted to the behavior chain construction unit. The behavior chain construction unit is used to aggregate API call events transmitted by the communication event acquisition unit. It connects discrete API call events into a continuous communication behavior chain through preset association logic. The communication behavior chain is used to represent the operation sequence of a specific user within a predetermined time window. The baseline learning unit is used to acquire the historical communication behavior chain generated by the behavior chain building unit. By applying a machine learning model to learn the micro-patterns of the historical communication behavior chain, a historical baseline of the normal behavior pattern of the communication behavior chain is established and continuously updated. The micro-anomaly detection unit is used to acquire the current communication behavior chain generated by the behavior chain construction unit, and simultaneously acquire the historical baseline of normal behavior patterns established by the baseline learning unit. By comparing the micro-pattern of the current communication behavior chain with the historical baseline, a machine learning model is used to detect whether there are any minor deviations. The detection method is as follows: Obtain the feature vector of the current communication behavior chain and input it into the pre-trained machine learning model; Determine the feature space of normal behavior patterns based on historical baselines; Calculate the distance metric between the feature vector and the feature space; The distance metric is compared with a preset anomaly threshold. If it is greater than the threshold, it is identified as an abnormal communication behavior chain and an anomaly identifier is generated. The risk warning unit is used to acquire the anomaly identifiers generated by the micro-anomaly detection unit and issue risk warning signals based on the anomaly identifiers.

2. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The communication event acquisition unit is further used for: The API requests received by the communication interface are parsed in real time to extract the core data of the API call events; The extracted API call events are cleaned to remove redundant or incorrectly formatted events, and the cleaned events are uniquely identified before being transmitted to the behavior chain construction unit.

3. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The specific method by which the behavior chain construction unit concatenates the API call events to form a communication behavior chain is as follows: Using the user identity information as a key dimension, API call events belonging to the same user are serialized and aggregated within a preset time window to form a user-specific behavior chain; The length of the communication behavior chain is dynamically set according to the needs of different risk scenarios.

4. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The specific method by which the baseline learning unit establishes and continuously updates the historical baseline of normal behavioral patterns is as follows: Extract behavioral features such as call frequency, call order, parameter distribution, and geographic location distribution from historical communication behavior chains; Behavioral features are input into a machine learning model for training to build a feature model of normal behavioral patterns. Based on newly added normal communication behavior chain data, the feature model is incrementally learned to adaptively update the historical baseline.

5. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The specific method by which the micro-anomaly detection unit detects the micro-patterns of the current communication behavior chain is as follows: Perform feature transformation on the current communication behavior chain to obtain a behavior feature vector; The behavioral feature vectors are input into the machine learning model trained in the baseline learning unit; Machine learning models calculate anomaly scores for behavioral feature vectors that deviate from normal behavioral patterns; The abnormal score is compared with a preset abnormal threshold. If it is higher than the threshold, it is determined that there is a slight deviation.

6. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The specific method by which the risk warning unit generates and issues risk warning signals is as follows: Based on the analysis results of the anomaly indicators, the risk level is classified into warning, alert, or blocking level; Risk warning signals are sent to pre-defined recipients through notification channels, including email, SMS, or message queues. The warning signals include a summary of the abnormal event, the entities involved, and suggested actions.

7. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The communication behavior chain is used to identify at least one of the following security threat patterns: API key theft mode is characterized by high-frequency API calls after logging in from a different location or using atypical IP addresses; SMS bombing mode is characterized by sending SMS requests to a large number of unrelated mobile phone numbers in a short period of time; Fraudulent marketing tactics involve sending large numbers of text messages with similar content to new or inactive user groups.

8. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The machine learning model employs a time series analysis model, which includes recurrent neural networks (RNNs), long short-term memory networks (LSTMs), or gated recurrent units (GRUs). The model is used to learn the temporal dependencies and sequence patterns of events in the communication behavior chain, thereby accurately identifying minute deviations.

9. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The system also includes: The risk handling unit is used to receive risk warning signals and perform automated handling or manual intervention according to the risk level. Handling operations include temporarily restricting access or blocking suspicious users. The model optimization unit is used to feed the actual processing results and user feedback as training data to the baseline learning unit in order to iteratively optimize the detection accuracy of the machine learning model.

10. The micro-anomaly detection and early risk warning system for communication behavior chains according to claim 1, characterized in that, The system further includes: The data storage unit is used to store API call events collected by the communication event acquisition unit, communication behavior chains generated by the behavior chain construction unit, and historical baselines of normal behavior patterns established by the baseline learning unit. The system is deployed on cloud communication, CPaaS, or API aggregation platforms and integrated with the platform's API gateway to achieve seamless risk control.

Images