User behavior information intelligent analysis method based on knowledge graph

Abstract

The invention relates to the field of artificial intelligence, machine learning and data mining, and discloses a user behavior information intelligent analysis method based on a knowledge graph, and the method comprises the following steps: (1) carrying out the preprocessing of multi-source user behavior data, and generating a materialized behavior sequence; (2) constructing a domain basic knowledge graph; (3) performing incremental expansion on the knowledge graph according to the real-time behavior data to generate a user personalized sub-graph; (4) carrying out dynamic updating and pruning on the personalized subgraph; (5) fusing multi-user sub-graph knowledge through a federal learning framework; and (6) providing an intelligent analysis interface based on the updated knowledge graph. According to the method, real-time semantic modeling of user behaviors is realized through incremental expansion and causal verification, and the analysis precision and timeliness are improved; and in combination with federal fusion and map path reasoning, traceable decision support is provided under privacy protection, and the service credibility is enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence, machine learning and data mining, in particular to a user behavior information intelligent analysis method based on knowledge graph. BACKGROUND

[0002] In the field of user behavior analysis and knowledge graph construction, existing technologies usually face several core challenges. Traditional methods mostly rely on static data processing and shallow feature mining, lacking timely reflection of user dynamic behavior and interest evolution. Due to the high timeliness and individual difference of behavior data, existing graph updating mechanisms are usually difficult to cope with rapidly changing user needs, resulting in low efficiency and lag of recommendation systems. In addition, traditional knowledge graphs usually focus on single data source or fixed structure modeling, and cannot effectively integrate multiple heterogeneous data, nor can they flexibly adjust themselves in changing context. This leads to problems such as outdated information and fragmented knowledge in knowledge graph when dealing with complex user behavior paths, affecting the accuracy of semantic reasoning and the quality of decision-making.

[0003] At the same time, privacy protection is also a major challenge in current technology system. Although data sharing can promote cross-use and in-depth analysis of knowledge, traditional methods often cannot balance privacy protection when implementing user data sharing, and there is a risk of leaking sensitive user information. Therefore, how to effectively integrate data and share knowledge while ensuring user privacy has become a bottleneck for technological development. SUMMARY

[0004] In view of the deficiencies of the prior art, the present application provides a user behavior information intelligent analysis method based on knowledge graph, which solves the problem of how to update user knowledge graph in real time, improve the accuracy and explainability of behavior analysis, and protect user privacy and avoid data leakage in the process of dynamic user behavior modeling in the prior art.

[0005] To achieve the above purpose, the present application realizes the following technical scheme: a user behavior information intelligent analysis method based on knowledge graph, comprising the following steps:

[0006] (1) Preprocess multi-source user behavior data to generate entity behavior sequence;

[0007] (2) Construct a domain basic knowledge graph;

[0008] (3) Incrementally expand the knowledge graph according to real-time behavior data to generate a user personalized subgraph;

[0009] (4) Dynamically update and prune the personalized subgraph;

[0010] (5) fuse multi-user subgraph knowledge through a federated learning framework;

[0011] (6) provide an intelligent analysis interface based on the updated knowledge graph.

[0012] Preferably, the (1) comprises:

[0013] mapping the behavior parameters to a set of entities through an entity linking function;

[0014] aligning and merging the behavior sequences by time windows.

[0015] Preferably, the (2) comprises:

[0016] fusing entities and relationships in external knowledge graphs;

[0017] modeling semantic relationships between entities using knowledge representation learning algorithms.

[0018] Preferably, the (3) comprises:

[0019] calculating the similarity between the behavior sequence embedding and the graph path embedding;

[0020] when the similarity exceeds a preset threshold, adding the new entity to the subgraph.

[0021] Preferably, the (3) further comprises:

[0022] verifying the association strength of the behavior and the entity through a causal reasoning algorithm;

[0023] only keeping entities with causal strength exceeding a threshold.

[0024] Preferably, the (4) comprises:

[0025] updating the local embedding of the subgraph nodes;

[0026] deleting expired entities based on a time decay function.

[0027] Preferably, the dynamic update adopts:

[0028] a local parameter update algorithm based on a graph convolution network;

[0029] an access probability prediction model combined with the time sequence characteristics of user behavior.

[0030] Preferably, the (5) comprises:

[0031] adding differential privacy noise under a federated learning framework;

[0032] aggregating multi-user subgraph features to generate group knowledge patterns.

[0033] Preferably, the (5) further comprises:

[0034] Generalization relationship in mass knowledge is injected into low-connectivity entity;

[0035] Cross-user knowledge sharing is realized through secure multi-party computation.

[0036] Preferably, the (6) comprises:

[0037] Semantic search function based on atlas path similarity;

[0038] Abnormal behavior detection is realized through path deviation degree calculation.

[0039] The application provides a user behavior information intelligent analysis method based on a knowledge graph.

[0040] The application has the following beneficial effects:

[0041] 1. The application can capture the timeliness change of user interest through the incremental expansion and real-time pruning mechanism of the knowledge graph, and overcome the defect that the traditional static atlas cannot adapt to behavior evolution. Based on the behavior-driven dynamic updating strategy, the atlas structure is adjusted in real time according to user interaction, and accurate semantic support is provided for personalized recommendation and intent analysis.

[0042] 2. The application introduces a causal reasoning verification mechanism to distinguish the core interest from accidental noise in user behavior, avoid pollution of the atlas construction caused by misoperation or temporary behavior, and enhance the robustness of the analysis result through causal strength threshold filtering and time decay factor, so as to ensure that the recommendation logic is highly consistent with the real needs of the user.

[0043] 3. The application adopts a federal subgraph fusion technology to complete the missing relationship of the individual behavior atlas based on the premise of protecting user privacy. Through the differential privacy and secure aggregation mechanism, the application realizes the compliant sharing of cross-user knowledge and solves the semantic reasoning limitation caused by insufficient data in the cold start scenario.

[0044] 4. The application realizes semantic retrieval and abnormal detection based on the knowledge graph path, converts abstract user behavior into a visual entity relationship network, provides traceable semantic basis for recommendation, early warning and other decisions through multi-hop relationship reasoning and context perception mechanism, and improves the trust and acceptance of the user to the intelligent service. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The method steps of the application are shown in the figure. DETAILED DESCRIPTION

[0046] With reference to the drawings of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0047] Please refer to the drawings of the present application Figure 1 The embodiment of the present application provides a user behavior information intelligent analysis method based on a knowledge graph, comprising the following steps:

[0048] (1) Preprocessing multi-source user behavior data to generate entity behavior sequences;

[0049] In this embodiment, the multi-source heterogeneous data preprocessing of step (1) is to convert the original user behavior data into structured and entity behavior sequences, providing standardized input for subsequent knowledge graph construction and dynamic updating.

[0050] Specifically, the preprocessing process includes two key stages of entity mapping and time sequence alignment. In the entity mapping stage, for the context parameters in the user behavior log (such as product description, search keywords, price value, etc.), a differentiated processing strategy is adopted: for text type parameters, a pre-trained entity recognition model is used to perform semantic analysis on the text segment, and the semantic entity associated with the behavior is identified through the probability distribution output by the model, for example, extracting "mobile phone" as the core entity from "the latest smart phone"; for numerical parameters, discretization and bucketing processing is performed according to the historical data distribution characteristics, for example, the price value is divided into "high price interval", "medium price interval" and other entity categories with business meaning according to the preset interval, eliminating the influence of numerical fluctuations on entity consistency.

[0051] In the time sequence alignment stage, in order to solve the problem of time sparsity and fragmentation of the original behavior data, a sliding time window mechanism is used to segment and integrate the behavior flow. Specifically, the length of the time window is set, the repeated behaviors of the same user on the same entity (such as multiple clicks on the same product) in the window are combined into a single entry, and the occurrence frequency and time distribution characteristics are recorded. Through this operation, the entity behavior sequence with timestamp is generated, where the behavior type includes operation types such as click, collection, purchase, etc., and the entity identifier corresponds to the standardized semantic unit.

[0052] Further, the entity mapping process enhances semantic consistency by introducing a domain ontology library. For example, for ambiguous entity expressions, semantic disambiguation is performed in combination with contextual features (such as the business module to which the behavior occurrence page belongs). If the behavior occurs in the "electronic product zone", "apple" is mapped to the "technology company" entity; if the behavior occurs in the "fresh supermarket", it is mapped to the "fruit" entity. At the same time, a synonym mapping table is established to map diversified expressions such as "iPhone" and "apple mobile phone" to a standard entity, ensuring the accuracy of entity relationships in subsequent graph construction.

[0053] Preferably, the time alignment process supports dynamic window adjustment. For the difference in behavior density of different business scenarios, the time window length is adaptively adjusted: in high interaction frequency scenarios such as e-commerce promotion, the window is shortened to capture fine-grained time sequence patterns; in low-frequency interaction scenarios such as online education, the window is extended to reduce computational overhead. This mechanism dynamically balances the time resolution and system load by monitoring the data distribution characteristics of the behavior stream in real time, providing a flexible data foundation for subsequent incremental expansion.

[0054] Through the above preprocessing, the original unstructured user behavior data is transformed into structured sequences with clear semantic entity identification and time sequence correlation characteristics, effectively solving the semantic gap and time fragmentation problem in multi-source heterogeneous data fusion, and laying a high-quality data foundation for dynamic construction of knowledge graph and behavior semantic analysis.

[0055] (2) Construct a domain basic knowledge graph;

[0056] In this embodiment, the domain basic knowledge graph construction of step (2) is the core of establishing an initial static knowledge graph framework to provide semantic reference and structural support for subsequent dynamic expansion driven by user behavior.

[0057] Specifically, the construction process includes two key stages of entity fusion and relationship modeling. In the entity fusion stage, the entities in the external knowledge graph (such as industry standard knowledge base or open domain general graph) are semantically matched with the local preprocessed entities through ontology alignment technology. For example, for the local extracted "mobile phone" entity, the semantic similarity calculation is performed with entities such as "smartphone" and "mobile device" in the external graph to eliminate semantic ambiguity caused by expression differences. At the same time, an entity alias library is established to map diversified expressions such as "iPhone" and "apple mobile phone" to a unified standard entity, ensuring the consistency of subsequent relationship reasoning.

[0058] In the relationship modeling stage, a knowledge representation learning algorithm is used to vectorize the semantic relationships between entities. Specifically, a relationship projection matrix is trained through triplets (head entity, relationship, tail entity) so that the head entity vector aligns with the tail entity vector in semantics after projection in the relationship space. For example, for the relationship "mobile phone - belongs to - electronic product", the projection of the "mobile phone" entity vector in the "belongs to" relationship space is optimized to minimize the distance from the "electronic product" entity vector, thereby capturing the implicit semantic association.

[0059] Further, the entity fusion process introduces an artificial verification mechanism to enhance the accuracy of core relationships. For core entities in key business scenarios (such as "goods" and "users" in the e-commerce field), domain experts review the automatic alignment results to correct incorrect mappings caused by semantic ambiguity. For example, automatic alignment may incorrectly associate "apple (fruit)" with "apple (company)", and manual intervention is used to ensure the accuracy of entity classification.

[0060] Preferably, the relationship modeling process supports joint learning of multiple relationship types. For different types of relationships such as "attribute relationships" (e.g. "price range - belongs to - high price"), "behavior relationships" (e.g. "user - clicks - product"), and "semantic relationships" (e.g. "mobile phone - synonymous - smartphone"), differentiated loss functions are designed to ensure that the model can distinguish the semantic strength and directionality of relationship types. For example, impose symmetry constraints on "synonymous" relationships, while emphasizing directional projection for "belongs to" relationships.

[0061] Through the above construction process, a structured and semantically clear domain knowledge graph is formed, providing an extensible semantic framework for subsequent user behavior-driven dynamic expansion. At the same time, by integrating external knowledge, the problem of local data sparsity is solved, enhancing the coverage and reasoning ability of the graph.

[0062] (3) Incrementally expand the knowledge graph according to real-time behavior data to generate user personalized subgraphs;

[0063] In this embodiment, the core of step (3) is to dynamically expand the knowledge graph according to real-time user behavior to generate user personalized subgraphs, capturing real-time changes in user interest and fine-grained semantic associations.

[0064] Specifically, the incremental expansion process includes two key stages: cross-modal alignment verification and causal strength filtering. In the cross-modal alignment verification stage, the semantic consistency between behavioral data and graph entities is verified by fusing the temporal features of the behavioral sequence with the semantic structure features of the knowledge graph. Specifically, a sequence model (such as a bidirectional recurrent neural network) is used to encode the user's behavioral sequence, generating temporal embedding vectors representing the user's short-term interests. Simultaneously, entity paths related to the current behavior are extracted from the knowledge graph, and path semantic embedding vectors are generated using a graph neural network. The similarity between the temporal embeddings and the path embeddings is calculated to determine whether to add a new entity to the user subgraph. If the similarity exceeds a preset threshold, an entity addition operation is triggered, ensuring that the newly added entity is highly semantically related to the user's behavior.

[0065] In the causal strength filtering stage, to address the graph pollution problem caused by noise interference (such as accidental clicks and temporary interests) in behavioral data, a causal inference algorithm is introduced to analyze the strength of causal relationships between behaviors and entities. Specifically, based on conditional independence tests and causal graph models, the causal contribution of behavioral events to entity nodes is calculated, retaining only entity relationships with significant causal strength. For example, for a user's behavior of repeatedly clicking on a product without making a purchase, causal analysis is used to distinguish whether it belongs to accidental exploration or potential interest, thereby deciding whether to include the product entity in the personalized subgraph.

[0066] Furthermore, the cross-modal alignment verification process employs a joint optimization strategy to enhance semantic consistency. By designing an alignment loss function, behavioral sequence embeddings and graph path embeddings are mapped to the same vector space, ensuring that semantically related behaviors and paths are close in distance within the vector space. This joint optimization process synchronously updates the embedding representation during the entity addition stage, ensuring the semantic coherence between new entities and existing graph structures.

[0067] Preferably, the causal strength filtering process is dynamically adjusted in conjunction with temporal context information. To address the time-sensitive characteristics of user behavior (such as short-term interests during holiday promotions), a time decay factor is introduced into the causal analysis to reduce the impact of long-standing historical behavior on the current causal strength calculation. For example, by weighting recent behavior data using an exponential decay function, causal inference becomes more focused on the user's latest interest patterns.

[0068] Through the aforementioned incremental expansion mechanism, the user-personalized subgraph can reflect changes in their behavioral patterns in real time. At the same time, causal filtering effectively suppresses noise interference, providing a highly reliable semantic foundation for subsequent dynamic updates and intelligent analysis.

[0069] (4) Dynamically update and prune personalized subgraphs;

[0070] In this embodiment, the core of the dynamic update and pruning in step (4) is to maintain the timeliness and lightweight nature of the user's personalized subgraph, and to balance the real-time performance and computational efficiency of the graph through local update and intelligent pruning mechanisms.

[0071] Specifically, the dynamic update process employs a local embedding update strategy, adjusting parameters for newly added entities and their neighboring nodes to avoid redundant computation of the global graph. When a new entity is added to the user subgraph, the update signal is propagated within the local neighborhood through a Graph Convolutional Network (GCN), iteratively optimizing only the embedding vectors of affected nodes. For example, when a "smartphone" entity is added, the embedding representations of its associated neighboring nodes such as "electronic products" and "brands" are updated synchronously, while the parameters of unrelated nodes remain unchanged. This mechanism controls the strength of historical information retention through a momentum coefficient, ensuring the stability of the update process.

[0072] During the pruning phase, to address the graph redundancy issue caused by user interest drift, a time-aware access probability prediction model is designed. Based on user behavior history and graph structure characteristics, the model predicts the probability of users accessing subgraph nodes within future time periods. For nodes that have not been accessed for a long time and whose predicted probability is below a threshold, their expiration status is determined using a time decay function, triggering a deletion operation. For example, if a user frequently accessed "sneakers" related nodes in the past, but recently their behavior has shifted to "digital products," then the "sneakers" node will be pruned due to its continuously decreasing access probability, freeing up storage and computing resources.

[0073] Furthermore, the local embedding update process introduces an attention mechanism to enhance semantic relevance. During neighborhood information aggregation, differentiated weights are assigned to different neighboring nodes, with a focus on nodes closely related to the semantics of the newly added entity. For example, when adding the entity "flagship mobile phone," the directly associated "brand" node will receive a higher attention weight, while the indirectly associated "accessories" node will receive a lower weight, thus improving the semantic targeting of the update process.

[0074] Preferably, the pruning process supports multi-dimensional feature fusion. In addition to the time decay factor, the retention priority is comprehensively evaluated by combining the semantic importance of nodes (such as the centrality of nodes in the graph) and business value (such as the promotional status of product nodes). For example, for product nodes with high centrality and in a promotional period, even if the short-term access probability is low, deletion can still be postponed to retain potential association value.

[0075] Through the aforementioned dynamic update and pruning mechanisms, the user subgraph can evolve adaptively, reflecting the latest behavioral patterns in a timely manner while avoiding the accumulation of invalid nodes, thus providing technical support for real-time semantic analysis and efficient resource utilization.

[0076] (5) Integrate multi-user subgraph knowledge through a federated learning framework;

[0077] In this embodiment, the core of the federated subgraph fusion in step (5) is to achieve collaborative enhancement of multi-user subgraph knowledge through a privacy and security mechanism, solve the semantic reasoning limitations caused by the sparsity of individual data, and at the same time meet the data compliance requirements.

[0078] Specifically, the federated fusion process comprises two key stages: secure feature aggregation and missing relationship completion. In the secure feature aggregation stage, each client (user terminal) hashes the structural features of its local subgraph, generating irreversible feature vectors. These feature vectors are then perturbed by adding differential privacy noise (such as Gaussian or Laplace noise) to ensure the untraceability of the original subgraph information. The server aggregates the perturbed features from all clients to generate a global collective knowledge pattern, such as discovering common interest paths within a "digital product enthusiast" group. This process avoids direct exposure of individual user data through encrypted transmission and noise injection, thus meeting privacy protection regulations.

[0079] During the missing relationship completion stage, for sparse entities with low connectivity in the user subgraph (such as niche products or emerging interest nodes), semantically similar entity relationships are retrieved from the global group knowledge pattern and injected. For example, if a user's subgraph contains the entity "foldable screen phone" but lacks related relationships, the common group relationship "foldable screen phone - belongs to - high-end phone" is discovered through global knowledge and dynamically added to the user subgraph to enhance semantic reasoning capabilities.

[0080] Furthermore, the security feature aggregation process supports dynamic noise adjustment. The noise intensity is adaptively adjusted based on the sensitivity level of the user subgraph (e.g., highly sensitive data in healthcare scenarios versus low-sensitivity data in e-commerce scenarios). For example, the maximum possible information leakage of the feature vector is calculated using a sensitivity analysis function, and differential privacy parameters are dynamically configured to achieve a balance between privacy protection strength and knowledge availability.

[0081] Preferably, the missing relation completion process incorporates semantic similarity threshold control. Relation injection is only allowed when the semantic similarity between a candidate relation in the group's knowledge and the existing structure of the user's subgraph exceeds a preset threshold. For example, by calculating the cosine similarity between the embedding vectors of candidate relation paths and user historical behavior paths, low-relevance relations are filtered out to avoid knowledge pollution.

[0082] Through the aforementioned federated fusion mechanism, while protecting user privacy, the semantic completeness of individual subgraphs is enhanced by leveraging collective knowledge, breaking through the limitations of single user behavior data, and providing cross-user collaborative knowledge support for accurate semantic analysis and recommendation.

[0083] (6) Provide intelligent analysis interfaces based on the updated knowledge graph;

[0084] In this embodiment, the core of the intelligent analysis interface in step (6) is to transform the dynamically updated knowledge graph into an operable semantic service, providing interpretable decision support and real-time feedback for user behavior analysis.

[0085] Specifically, the intelligent analysis interface comprises two main functional modules: semantic path retrieval and abnormal behavior detection. In the semantic path retrieval module, the user inputs a natural language query (e.g., "Recommend a mobile phone suitable for business people"), and a pre-trained language model encodes the query text into a semantic vector, which is then matched with the entity path embeddings in the knowledge graph for similarity. For example, the query vector is compared with the cosine similarity of the embedded representations of paths such as "mobile phone-brand-high-end model-business functions" to calculate the highest matching path and its associated entities, forming an interpretable recommendation reason.

[0086] In the abnormal behavior detection module, a normal pattern library is built based on users' historical behavior paths. Potential risks are identified by comparing the semantic deviation between real-time behavior paths and normal patterns. For example, for high-frequency, short-duration clicks in e-commerce scenarios, the path embedding is extracted, and the Euclidean distance to the normal browsing path is calculated. If the deviation exceeds a threshold, an abnormal warning is triggered. This process dynamically updates the normal pattern library to adapt to differences in the behavioral baselines of different user groups, thus improving detection sensitivity.

[0087] Furthermore, the semantic path retrieval module supports multi-hop relationship reasoning. It uses graph neural networks to semantically enhance multi-hop paths in the knowledge graph, capturing long-distance entity associations. For example, starting from "user-click-phone," it infers the user's potential preference for "a certain domestic brand" along the path "phone-brand-manufacturer-country of origin," providing deep semantic evidence for the recommendation system.

[0088] Preferably, the abnormal behavior detection module incorporates a context-aware mechanism. It dynamically adjusts the deviation judgment threshold by combining the context information of the user's current session (such as device type, geographical location, and time period). For example, when a user logs into a new device or accesses the site from a different location, the threshold is temporarily relaxed to reduce false alarms; once the behavior pattern stabilizes, the normal detection intensity is restored.

[0089] Through the aforementioned intelligent analysis interface, the semantic reasoning capabilities of knowledge graphs are transformed into intuitive interactive services, which not only support in-depth understanding and interpretation of user behavior, but also provide a technical foundation for real-time risk prevention and personalized services.

[0090] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for intelligent analysis of user behavior information based on knowledge graphs, characterized in that, Includes the following steps: (1) Preprocess multi-source user behavior data to generate entityized behavior sequences; (2) Construct a domain-based knowledge graph; (3) Incrementally expand the knowledge graph based on real-time behavioral data to generate personalized subgraphs for users; (4) Dynamically update and prune the personalized subgraph; (5) Integrate multi-user subgraph knowledge through a federated learning framework; (6) Provide intelligent analysis interface based on updated knowledge graph.

2. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 1, characterized in that, The (1) includes: The entity linking function maps behavioral parameters to a collection of entities. Align and merge behavioral sequences according to time windows.

3. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 1, characterized in that, The (2) mentioned above includes: Integrate entities and relationships from external knowledge graphs; Use knowledge representation learning algorithms to model semantic relationships between entities.

4. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 1, characterized in that, The third part (3) includes: Calculate the similarity between behavioral sequence embeddings and graph path embeddings; When the similarity exceeds a preset threshold, the new entity is added to the subgraph.

5. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 1, characterized in that, The third part (3) also includes: Verify the strength of the association between behavior and entities using causal reasoning algorithms; Only entities with causal strength exceeding the threshold are retained.

6. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 1, characterized in that, The (4) includes: Perform local embedding updates on subgraph nodes; Delete expired entities based on time decay function.

7. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 6, characterized in that, The dynamic update adopts: Local parameter update algorithm based on graph convolutional networks; An access probability prediction model that incorporates temporal characteristics of user behavior.

8. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 1, characterized in that, The (5) includes: Add differential privacy noise within the federated learning framework; Aggregate multi-user subgraph features to generate group knowledge patterns.

9. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 1, characterized in that, The (5) also includes: Injecting generalization relations from group knowledge into entities with low connectivity; Enables cross-user knowledge sharing through secure multi-party computation.

10. The intelligent analysis method for user behavior information based on knowledge graphs according to claim 1, characterized in that, The (6) includes: Semantic search function based on graph path similarity; Abnormal behavior detection is achieved through path deviation calculation.

Images