Service risk identification method and device, medium and equipment

Abstract

The embodiment of the invention discloses a business risk identification method, and the method comprises the steps: carrying out the vectorization representation of a business log of a to-be-identified business, obtaining a reconstruction vector of the business log through the modes of feature extraction and vector reconstruction, and enabling a reconstruction model to be obtained based on the training of historical business logs, according to the method, the service logs similar to the historical service logs can be accurately reconstructed, and the abnormal service logs have relatively large reconstruction errors, so that after the reconstruction errors are determined based on the obtained reconstruction vectors, whether the service has risks can be further identified based on the reconstruction errors, and risk control is performed based on the identification result.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a business risk identification method, apparatus, storage medium and device. Background Technology

[0002] With the development of internet technology, attack methods targeting business operations are constantly evolving. Current attack methods are characterized by low frequency, varied patterns, and deliberate camouflage, making attack behavior highly intertwined with and difficult to distinguish from normal business activities. On the other hand, normal business operations also include a large number of legitimate but atypical "boundary operations" due to changes in the market environment, customer needs, and diversified business strategies. These complex characteristics make the boundary between high-risk attacks and normal business operations extremely blurred, increasing the difficulty of identifying business risks.

[0003] In this context, existing technologies, which rely on preset fixed rules and static feature thresholds for business risk identification, lack an understanding of business context and dynamic behavioral patterns. This makes them highly susceptible to misclassifying many compliant but "uncommon" normal business operations as risks. Furthermore, novel attacks may be difficult to identify promptly and accurately because their patterns exceed the coverage of predefined rule bases. Clearly, existing technologies are prone to high false positives or high false negatives, resulting in "excessive alarm noise" and "real threats hidden within"—security operations personnel are overwhelmed by the sheer volume of alerts, while truly valuable alerts are drowned out by the noise.

[0004] Based on this, this specification provides a business risk identification method to partially solve the problems existing in the prior art. Summary of the Invention

[0005] This specification provides a business risk identification method, apparatus, storage medium, and electronic device to partially solve the problems existing in the prior art.

[0006] The embodiments in this specification adopt the following technical solutions:

[0007] This specification provides a business risk identification method, the method comprising:

[0008] Obtain the business logs of the business to be identified in the business scenario;

[0009] The business logs are input into a pre-trained word embedding model to obtain the business vectors of the business logs in the business scenario.

[0010] The anomaly detection model is trained to obtain intermediate features of the business vector, and then the intermediate features are reconstructed to obtain the reconstructed vector corresponding to the business vector representation. The word embedding model and the anomaly detection model are trained based on the historical business logs of the business scenario.

[0011] Based on the business vector and the reconstruction vector, the reconstruction error is determined;

[0012] Based on the reconstruction error, the risk identification result of the business to be identified is obtained through the anomaly identification model, and the risk identification result is used for risk control of the business to be identified.

[0013] This specification provides a business risk identification device, the device comprising:

[0014] The acquisition module is used to acquire business logs of the business to be identified in the business scenario;

[0015] The vectorization module is used to input the business logs into a pre-trained word embedding model to obtain the business vectors of the business logs in the business scenario.

[0016] The reconstruction module is used to obtain intermediate features of the business vector through the trained anomaly detection model, and then reconstruct the intermediate features to obtain the reconstructed vector corresponding to the business vector representation. The word embedding model and the anomaly detection model are trained based on the historical business logs of the business scenario.

[0017] An error determination module is used to determine the reconstruction error based on the business vector and the reconstruction vector;

[0018] The identification module is used to obtain the risk identification result of the business to be identified based on the reconstruction error through an anomaly identification model. The risk identification result is used to perform risk control on the business to be identified.

[0019] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned business risk identification method.

[0020] This specification provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the aforementioned business risk identification method.

[0021] The above-described at least one technical solution adopted in the embodiments of this specification can achieve the following beneficial effects:

[0022] This specification discloses a business risk identification method. The method vectorizes the business logs of the business to be identified, and then obtains the reconstructed vectors of the business logs through feature extraction and vector reconstruction. The reconstruction model is trained based on historical business logs. For business logs similar to historical business logs, accurate reconstruction can be performed, while abnormal business logs will have a large reconstruction error. Therefore, after determining the reconstruction error based on the above-obtained reconstruction vector, the existence of risks in the business can be further identified based on the reconstruction error, and risk control can be performed based on the identification results. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0024] Figure 1 A business risk identification flowchart provided as an embodiment of this specification;

[0025] Figure 2 An interactive flowchart for business risk identification provided in the embodiments of this specification;

[0026] Figure 3 A schematic diagram of a business risk identification device provided in the embodiments of this specification;

[0027] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this specification. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0029] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0030] Figure 1 A business risk identification flowchart provided in this specification includes the following steps:

[0031] S100: Obtain the business logs of the business to be identified in the business scenario.

[0032] In the embodiments described in this specification, the following are employed: Figure 1The device used for business risk identification using the method shown can be any electronic device, such as a computer, server, or server cluster consisting of multiple servers. For ease of description, the following explanation uses a server as an example only.

[0033] To address the problem that business risk identification methods based on preset fixed rules and static feature thresholds are unable to cope with flexible and rapidly changing attack methods, and that atypical user behaviors are difficult to distinguish from attack behaviors, leading to false positives and false negatives, this specification embodiment uses business logs as source data for risk identification.

[0034] Specifically, since user behavior characteristics and the characteristics reflected in business logs differ for different businesses, the risk identification method in the embodiments of this specification requires training different models for risk identification for different business scenarios in order to more accurately identify risks and reduce false positives and false negatives. Therefore, for businesses that need to use this method for risk identification, the model needs to be pre-trained, and the trained model is used to perform subsequent steps for risk identification based on the business logs of the business to be identified in that business scenario.

[0035] This server can obtain business logs for services requiring risk identification within a specified business scenario. These services may be those not yet completed; the server retrieves the business logs before the final critical steps of the service are executed for risk identification. Alternatively, it can periodically perform risk identification on completed services to identify new attack methods and implement targeted defenses. Therefore, the embodiments in this specification do not limit the state of the service to be identified. Of course, the business logs can be a portion or all of the log content from the service to be identified. Which portion of the business logs is retrieved can be set as needed, and this specification does not impose any restrictions.

[0036] S102: Input the business log into a pre-trained word embedding model to obtain the business vector of the business log in the business scenario.

[0037] Due to the current atypical user behavior, it is difficult to distinguish between normal user activities and attacker activities. Simply performing semantic analysis based on business logs to identify attack behavior based on semantic understanding significantly increases the difficulty. Therefore, to avoid the situation of continuously increasing processing difficulty caused by solely identifying business risks semantically, this specification's embodiments no longer focus solely on the semantic features corresponding to business logs. Instead, a word embedding model is used to map this high-dimensional, low-density information, such as business logs, into a low-dimensional, high-density vector space. This reduces the interference of atypical behavior business logs on risk identification, directly representing business logs as low-dimensional business vectors. Abnormal business logs are then identified through subsequent reconstruction steps.

[0038] Specifically, the server can obtain a trained word embedding model, such as the Word2Vec model, and use this model to obtain the business vector corresponding to the business log in the vector space. This word embedding model is trained based on historical business logs from the business scenario.

[0039] Specifically, in order to avoid "contamination" of the word embedding model by a general corpus when training the word embedding model, the embodiments of this specification may use a word embedding model that has not been pre-trained with a general corpus.

[0040] First, obtain historical business logs for the business scenario as training samples. Typically, in a business scenario, normal business operations constitute the vast majority, while abnormal and risky business operations are in the minority. Therefore, it's not necessary to distinguish whether historical business operations were abnormal or not. Using abnormal business operations as training samples to train the word embedding model can improve its generality and robustness. Of course, if there are specific requirements for the false negative rate, normal business logs can also be determined from historical business logs and used as training samples. While this will reduce the generality of the hot word embedding model, it will result in higher sensitivity to abnormal business logs. The specific method used to determine training samples can be set as needed; this manual does not impose restrictions.

[0041] Furthermore, the server can construct an initial word embedding model based on preset model structure parameters. These model structure parameters are not the parameters adjusted during model training, but rather refer to the parameters of the model structure itself. For example, the number of nodes in each layer, the number of layers, and the node connection methods. Broadly speaking, it refers to the size and structure of the word embedding model. This step is independent of the preceding step of determining the training samples and can be executed asynchronously, synchronously, or sequentially.

[0042] Then, each training sample is input into the initialized word embedding model to obtain each randomly initialized word vector.

[0043] Then, the word embedding model is adjusted with the optimization objective of ensuring that adjacent words in the training samples are similar in the word vector space.

[0044] As seen from the steps above, the training samples determined by historical business logs are essentially the strings contained in the business logs, and these strings are discrete strings, such as URL paths, parameter keys / values, and header content. To enable the subsequent model to understand the semantics of these discrete symbols, they need to be vectorized first. Therefore, the goal of adjusting the word embedding model is to ensure that adjacent occurrences in the same historical business log within the training samples are close in the expected vector space. This allows the trained word embedding model to extract specific word relationships within the business scenario, such as relationships between internal interface identifiers and parameters.

[0045] Using the trained word embedding model, it can be seen that a business log consisting of discrete strings is mapped to a vector space, the dimension of which is much lower than the dimension of the strings in the business log. For example, this vector space is 800-dimensional, while to realize a basic business log, the text dimension needs to be at least 3000 dimensions. Therefore, the business log input into this word embedding model can be mapped by the model into a dense vector representation, namely the business vector, which condenses the semantic features of the business log.

[0046] It should be noted that before inputting the business logs into the word embedding model, the server can perform preprocessing operations such as cleaning to reduce noise in the business logs. Alternatively, the server can further extract only the important fields from the business logs as the core content of the business logs, input them into the word embedding model, and obtain the corresponding business vectors.

[0047] Regardless of the method used to preprocess the business logs, the same operation must be performed on the training samples when training the word embedding model. Of course, the specific preprocessing operation can be set as needed, and this manual does not impose any restrictions.

[0048] S104: The intermediate features of the business vector are obtained through the trained anomaly detection model, and then the intermediate features are reconstructed to obtain the reconstructed vector corresponding to the business vector representation. The word embedding model and the anomaly detection model are trained based on the historical business logs of the business scenario.

[0049] In the embodiments of this specification, after obtaining the business vector corresponding to the business log, the server can input the business vector into the trained anomaly detection model, which will then reconstruct the business vector to obtain a reconstructed vector. This anomaly detection model is also trained based on historical business logs of this business scenario.

[0050] Specifically, the anomaly detection model can be an encoder-decoder structure or a fully connected neural network, such as an autoencoder. This model compresses the input vector to obtain lower-dimensional intermediate features, then increases the dimensionality of these intermediate features to obtain a reconstructed vector with the same dimension as the input vector. This reconstruction method is adopted because a large amount of historical business logs from normal business operations allow the anomaly detection model to learn how to compress and merge features (obtain intermediate features) from normal logs, and how to reconstruct the original business vector based on these intermediate features. Since the business logs of abnormal business operations are inherently different from those of normal business operations, and the anomaly detection model did not learn how to accurately recover these differences during training, it cannot accurately reconstruct the business vector of abnormal business operations. The difference between the reconstructed vector and the business vector can quickly locate abnormal logs. Of course, due to the aforementioned atypical user behavior, logs identified as abnormal by this anomaly detection model may also be false anomalies. Therefore, further steps are needed for identification to ensure that logs detected as abnormal by the anomaly detection model are only suspicious logs. However, this method can quickly filter out business logs from normal operations, improving the efficiency of the entire risk control system.

[0051] In one or more embodiments of this specification, the anomaly detection model can be trained after the word embedding model has been trained, since the input is a business vector.

[0052] First, obtain the historical business logs of the business scenario, and use the business vectors obtained by the trained word embedding model as training samples for the anomaly detection model.

[0053] Next, for each business vector, the business vector is input into the anomaly detection model to be trained, and the business vector is reduced in dimensionality to obtain the intermediate features of the business vector.

[0054] Then, the intermediate features of the business vector are restored according to the dimensions of the business vector using the anomaly detection model to obtain the reconstructed vector;

[0055] Finally, the function value of the pre-constructed loss function is determined using the reconstructed vector and the business vector, and the model parameters of the detection model are adjusted based on this function value. The difference between the reconstructed vector and the business vector is positively correlated with the function value.

[0056] It should be noted that, since the anomaly detection model is expected to learn how to compress and expand business logs from normal business operations, the training samples can only use the business vectors corresponding to historical business logs from normal business operations. Of course, similar to the previous step, even a small number of business vectors from abnormal business operations will not affect the overall performance of the anomaly detection model. To avoid false positives, only normal business logs from normal business operations can be used as training samples for the anomaly detection model.

[0057] S106: Determine the reconstruction error based on the business vector and the reconstruction vector.

[0058] S108: Based on the reconstruction error, the risk identification result of the business to be identified is obtained through the anomaly identification model, and the risk identification result is used to perform risk control on the business to be identified.

[0059] Based on the description in step S104, the server can determine the reconstruction error based on the error between the business vector and the reconstruction vector. The larger the reconstruction error, the greater the probability that the business corresponding to the business log has a risk. Of course, this specification does not limit how the reconstruction error is determined; it can be determined by calculating the Euclidean distance, or the difference in values ​​in each dimension can be calculated separately as the reconstruction error.

[0060] Finally, based on the reconstruction error, the risk identification result is obtained through the anomaly identification model. The risk identification result is used for risk control of the business to be identified; that is, if the risk identification result determines that there is a risk, risk control is carried out on the business to be identified; otherwise, the business to be identified continues to be executed.

[0061] As mentioned earlier, the input to this anomaly detection model is the reconstruction error. Atypical user behavior can lead to a large reconstruction error, so simply relying on a preset threshold for the reconstruction error to determine whether a service poses a risk is prone to false alarms. Therefore, to avoid this, in this embodiment, the server can determine the risk detection result based on a pre-trained isolated forest model or the histogram distribution of the reconstruction error.

[0062] Specifically, when determining risk identification results using a pre-trained Isolation Forest (IF) model.

[0063] First, the server can obtain a pre-built isolated forest model and select a specified number of trees from it. The isolated forest model is constructed based on the reconstruction errors of historical business logs for a given business scenario. During construction and training, this isolated forest model is built based on the reconstruction errors corresponding to a large number of historical business logs from normal business operations. Therefore, each tree can be considered a tree that partitions a specific type of business within the same business scenario. Dividing each individual tree for reconstruction errors is not meaningful; what is needed is to establish the average path length required for each tree to complete the partitioning of reconstruction errors corresponding to normal business operations. Since the reconstruction errors corresponding to abnormal business operations differ significantly from those corresponding to normal business operations, they can be easily partitioned by the trees in the isolated forest model. In other words, the partitioning path length for abnormal business operations is significantly "shorter." Given that the partitioning path length for abnormal business operations is "shorter" for the vast majority of trees in the isolated forest model, to improve recognition efficiency, the server can select only a subset of trees to determine the partitioning path for the business vectors.

[0064] For example, suppose an isolated forest model contains 100 trees, and 30 of them are selected to input the reconstruction error to determine the partitioning path.

[0065] Secondly, the reconstruction error is determined separately, and the path length used for partitioning is calculated in each selected tree.

[0066] Then, based on the determined path lengths, the anomaly score corresponding to the reconstruction error is determined.

[0067] After dividing the reconstruction error into selected trees, the anomaly score corresponding to the reconstruction error is determined based on the path length in each tree. For example, the calculation result can be determined by the sum of path lengths, the mean of path lengths, or the median of path lengths, etc., and used as the anomaly score.

[0068] Finally, the risk identification results are determined based on the anomaly threshold and anomaly score obtained when training the isolated forest model.

[0069] The anomaly threshold obtained during the training of the isolated forest model is determined after training the isolated forest, statistically analyzing the anomaly score distribution, and then setting the threshold based on this distribution according to a preset ratio. Simply put, the threshold is set based on the values ​​of the vast majority of anomaly scores among the reconstruction errors corresponding to normal business operations. For example, assuming there are 100,000 anomaly scores for reconstruction errors, they generally follow a normal distribution. If 97% of the anomaly scores for reconstruction errors are greater than 100, then 100 is set as the anomaly threshold. If the anomaly score for any reconstruction error is less than 100, it indicates that the corresponding business operation is at risk, meaning the risk identification result is "risk exists."

[0070] In addition, when determining risk identification results based on a pre-constructed histogram-weighted outlier score (HWOS).

[0071] First, the server can obtain a histogram distribution pre-constructed based on the reconstruction error of historical business logs in the business scenario.

[0072] Then, it was determined that the reconstruction error fell into the corresponding region of the histogram distribution.

[0073] Finally, the risk identification result is determined based on the probability density of the area the risk falls into and a preset probability threshold. When using histogram distribution to determine the risk identification result, it mainly relies on the probability density of different regions in the pre-constructed histogram distribution to distinguish between normal and abnormal probability thresholds.

[0074] The process of constructing the histogram distribution involves first obtaining historical business logs for the business scenario and then determining the reconstruction error of each historical business log.

[0075] Then, based on the determined reconstruction errors, a distribution map of the reconstruction errors is constructed.

[0076] Finally, according to the preset segmentation windows, the probability density of each interval in the distribution map is determined, resulting in a histogram. Specifically, the reconstruction error of normal business operations is used to determine the distribution of the reconstruction error in a two-dimensional coordinate system. Then, according to the preset segmentation windows, typically using equal-width binning or equal-frequency binning, the distribution map is divided into multiple windows. For each window, the probability density of the reconstruction error falling into that window is statistically determined, resulting in a histogram. When applying this histogram, the degree to which the reconstruction error falls into a rare interval in that dimension determines whether the business is at risk. That is, when it falls into a low-probability interval, the business is determined to be at risk, meaning the risk identification result is that there is risk.

[0077] Furthermore, in one or more embodiments of this specification, the IF model tends to identify risks through a method of "global" random partitioning, while HWOS assesses risks more from the "local" rarity of reconstruction errors, which can detect requests that are not noticeable overall but have an extremely anomalous feature. Therefore, combining the results of HWOS and the IF model in a weighted manner improves the ability to detect different types of anomalies.

[0078] Specifically, the server can obtain a pre-built isolated forest model and histogram distribution. Then, based on the path length of the reconstruction error in the partial trees of the isolated forest model and the anomaly threshold obtained when training the isolated forest model, a first score is determined; based on the probability density corresponding to the region of the reconstruction error falling into the histogram distribution and a preset probability threshold, a second score is determined.

[0079] Finally, the risk identification result is determined based on the first and second scores. Specifically, this involves weighted fusion to determine a comprehensive score, and then using this comprehensive score and a preset threshold to determine the risk identification result. Both the weighted value and the preset threshold need to be determined during the training process; that is, normal business transactions are used as positive samples, and both the weighted value and the threshold are trained simultaneously through supervised learning. Alternatively, both positive and negative samples can be used to train the weighted value and the threshold. Only the aforementioned IF model and the HWOS construction process use normal business transactions as training samples.

[0080] based on Figure 1 The business risk identification method shown in the figure vectorizes the business logs of the business to be identified, and then obtains the reconstructed vector of the business log through feature extraction and vector reconstruction. The reconstruction model is trained based on historical business logs. For business logs similar to historical business logs, the reconstruction can be accurate, while abnormal business logs will have a large reconstruction error. Therefore, after determining the reconstruction error based on the above-obtained reconstruction vector, the risk of the business can be further identified based on the reconstruction error, and risk control can be carried out based on the identification results.

[0081] Furthermore, in the final step, the characteristics of the IF model and HWOS can be combined to directly determine the risk identification result based on the reconstruction error, allowing the server to comprehensively consider whether there are anomalies in the business logs from three dimensions. To facilitate further understanding of the method provided in this specification, an interactive example corresponding to steps S100 to S108 is provided in the embodiment of this specification, such as... Figure 2 The diagram illustrates how to implement the aforementioned business risk identification process.

[0082] Figure 2 This is a schematic diagram illustrating the interaction of business risk identification provided in the embodiments of this specification. It shows that the components involved in business risk identification include: the business terminal, the risk control server, the word embedding model, the anomaly detection model, the IF model, and HWOS. As described in step S102, the anomaly detection model, the IF model, and HWOS can also be deployed on the risk control server or on other devices.

[0083] S201: The business side intercepts business logs and sends them to the risk control server.

[0084] S202: The risk control server sends business logs to the word embedding model.

[0085] S203: The word embedding model returns the obtained business vector to the risk control server.

[0086] S204: The risk control server sends the business vector to the anomaly detection model.

[0087] S205: The anomaly detection model reconstructs the business vector, obtains the reconstructed vector, and determines the reconstruction error, which is then returned to the risk control server.

[0088] S206: The risk control server sends the reconstruction error to the IF model and HWOS respectively.

[0089] S207: The IF model, based on the reconstruction error, obtains the first score and returns it to the risk control server.

[0090] S208: HWOS obtains a second score based on the reconstruction error and returns it to the risk control server.

[0091] S209: Determine the risk identification result based on the first and second scores. If there is no risk, remain silent and do not disturb the user; return the result to the business end and continue executing the business. If there is a risk, send a risk control alarm to the user and send an alarm to the business end to stop executing the business.

[0092] Furthermore, in the embodiments of this specification, when training the isolated forest model, the server can first obtain historical business logs of the business scenario, determine the reconstruction error of each historical business log, and sample each reconstruction error to obtain several training subsets.

[0093] Next, for each sampled training subset, a tree is recursively constructed based on the reconstruction errors contained in that subset. Therefore, each tree in the Isolation Forest model is built from reconstruction errors of historical business logs that are not entirely identical. This allows the Isolation Forest model to learn as many characteristics as possible about the different reconstruction errors of historical business logs. Since there will inevitably be reconstruction errors from business logs representing atypical user behavior in the past, trees built from multiple reconstruction errors can effectively avoid misjudgments caused by atypical user behavior.

[0094] Based on the constructed trees, an isolated forest model is obtained as an anomaly identification model; and based on the path length used to divide historical business logs according to the isolated forest model, the anomaly score distribution is statistically determined, and the anomaly threshold is determined according to the preset ratio based on the anomaly score distribution.

[0095] Furthermore, as described in step S100, the business logs of the business to be identified can also be completed business processes. Therefore, in addition to investigating and responding promptly to risk control vulnerabilities, risk identification can also accumulate attack data. In this specification, business vectors identified as risky can also be clustered. Since the business logs are vectorized, all identified abnormal business vectors can be clustered in the vector space, such as using K-Means or hierarchical clustering methods. Similar attacks can be merged to generate attack features, that is, commonalities are extracted from each cluster to obtain common malicious attack payload fragments. This allows subsequent operations and maintenance personnel to use common features to update targeted defense plans.

[0096] On the other hand, to avoid issuing multiple warnings due to the same attack, which would reduce the cognitive effectiveness of risk control alerts, clustering can be used to merge multiple alerts from the same attack flow, reducing the number of times users need to view them.

[0097] Specifically, when the server determines the business to be identified for risk control based on the risk identification results, it stores the business vector of the business to be identified.

[0098] Then, the business vector is matched with each business vector stored within the most recent preset time period.

[0099] No alarm notification is sent when any match is successful.

[0100] If no match is found, an alarm notification is sent to alert the user of a new attack risk.

[0101] In other words, if a similar attack occurs within a preset timeframe, an alert will only be issued for the first attack. Subsequent attacks that do not belong to the same attack flow will not receive alerts. Of course, these alerts can be stored in the background for users to view, avoiding overwhelming users with numerous alerts for attacks occurring in the same wave.

[0102] The above is a business risk identification method provided by the embodiments of this specification. Based on the same idea, this specification also provides corresponding devices, storage media and electronic devices.

[0103] Figure 3 This is a schematic diagram of a business risk identification device provided in an embodiment of this specification. The device includes:

[0104] The acquisition module 301 is used to acquire the business logs of the business to be identified in the business scenario;

[0105] Vectorization module 302 is used to input the business log into a pre-trained word embedding model to obtain the business vector of the business log in the business scenario;

[0106] The reconstruction module 303 is used to obtain intermediate features of the business vector through the trained anomaly detection model, and then reconstruct the intermediate features to obtain the reconstructed vector corresponding to the business vector representation. The word embedding model and the anomaly detection model are trained based on the historical business logs of the business scenario.

[0107] Error determination module 304 is used to determine the reconstruction error based on the service vector and the reconstruction vector;

[0108] The identification module 305 is used to obtain the risk identification result of the business to be identified through an anomaly identification model based on the reconstruction error, and the risk identification result is used to perform risk control on the business to be identified.

[0109] Optionally, the identification module 305 is used to acquire a pre-built isolated forest model and select a specified number of trees from the isolated forest model, wherein the isolated forest model is constructed based on the reconstruction error of the historical business logs of the business scenario; determine the reconstruction error respectively, and divide the selected trees into paths of length; determine the anomaly score corresponding to the reconstruction error based on the determined path lengths; and determine the risk identification result based on the anomaly threshold obtained when training the isolated forest model and the anomaly score.

[0110] Optionally, the identification module 305 is used to obtain a histogram distribution pre-constructed based on the reconstruction error of the historical business logs of the business scenario; determine that the reconstruction error falls into the corresponding region of the histogram distribution; and determine the risk identification result based on the probability density of the region into which the error falls and a preset probability threshold.

[0111] Optionally, the anomaly detection model includes an isolated forest model and a histogram distribution;

[0112] The identification module 305 is used to acquire a pre-constructed isolated forest model and histogram distribution; determine a first score based on the path length of the reconstruction error in the partial trees of the isolated forest model and the anomaly threshold obtained when training the isolated forest model; determine a second score based on the probability density corresponding to the region where the reconstruction error falls into the histogram distribution and a preset probability threshold; and determine the risk identification result based on the first score and the second score.

[0113] Optionally, the device further includes:

[0114] Training module 306 is used to acquire historical business logs of the business scenario as training samples; construct an initialized word embedding model according to preset model structure parameters; input each training sample into the initialized word embedding model to obtain each randomly initialized word vector; adjust the word embedding model with the optimization objective of adjacent words in the training samples being similar in the word vector space, the word embedding model is used to map the business logs to the word vector space to obtain the business vectors of the business logs.

[0115] Optionally, the training module 306 is further configured to acquire historical business logs of the business scenario, and obtain business vectors through the trained word embedding model; for each business vector, input the business vector into the anomaly detection model to be trained, reduce the dimensionality of the business vector to obtain intermediate features of the business vector; then, use the anomaly detection model to restore the intermediate features of the business vector according to the dimension of the business vector to obtain a reconstructed vector; the reconstructed vector and the business vector determine the function value of a pre-constructed loss function, and adjust the model parameters of the detection model with the function value, wherein the difference between the reconstructed vector and the business vector is positively correlated with the function value.

[0116] Optionally, the training module 306 is further configured to acquire historical business logs of the business scenario; determine the reconstruction error of each historical business log, and sample each reconstruction error to obtain several training subsets; for each sampled training subset, recursively construct a tree based on the reconstruction error contained in the training subset; obtain an isolated forest model as an anomaly recognition model based on the constructed trees; and statistically determine the anomaly score distribution based on the path length used by the isolated forest model to divide the historical business logs, and determine the anomaly threshold based on the anomaly score distribution according to a preset ratio.

[0117] Optionally, the training module 306 is further configured to acquire historical business logs of the business scenario and determine the reconstruction error of each historical business log; construct a distribution map of reconstruction errors based on the determined reconstruction errors; and determine each interval in the distribution map and the probability density of each interval according to a preset segmentation window to obtain a histogram.

[0118] Optionally, the device further includes:

[0119] The alarm module 307 is used to store the business vector of the business to be identified when it is determined to perform risk control on the business to be identified based on the risk identification result; match the business vector with each business vector stored within the most recent preset time period; when any match is successful, no alarm notification is sent; when no match is successful, an alarm notification is sent, the alarm notification is used to remind the user that there is a new attack risk.

[0120] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can be used to perform the business risk identification method provided above.

[0121] based on Figure 1 The business risk identification method shown in this specification also provides the embodiments. Figure 4 The diagram shows the structure of the electronic device. Figure 4 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile storage, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile storage into memory and then runs it to implement the aforementioned business risk identification method.

[0122] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A business risk identification method, the method comprising: Obtain the business logs of the business to be identified in the business scenario; The business logs are input into a pre-trained word embedding model to obtain the business vectors of the business logs in the business scenario. The anomaly detection model is trained to obtain intermediate features of the business vector, and then the intermediate features are reconstructed to obtain the reconstructed vector corresponding to the business vector representation. The word embedding model and the anomaly detection model are trained based on the historical business logs of the business scenario. Based on the business vector and the reconstruction vector, the reconstruction error is determined; Based on the reconstruction error, the risk identification result of the business to be identified is obtained through the anomaly identification model, and the risk identification result is used for risk control of the business to be identified.

2. The method as described in claim 1, wherein the risk identification result of the service to be identified is obtained through an anomaly identification model based on the reconstruction error, specifically including: Obtain a pre-built isolated forest model and select a specified number of trees from the isolated forest model, wherein the isolated forest model is built based on the reconstruction error of the historical business logs of the business scenario; The reconstruction error is determined separately, and the path length used for partitioning is calculated in each selected tree; Based on the determined path lengths, an anomaly score corresponding to the reconstruction error is determined; The risk identification result is determined based on the anomaly threshold and the anomaly score obtained when training the isolated forest model.

3. The method as described in claim 1, wherein the risk identification result of the service to be identified is obtained through an anomaly identification model based on the reconstruction error, specifically including: Obtain the histogram distribution pre-constructed based on the reconstruction error of historical business logs of the business scenario; It is determined that the reconstruction error falls within the region corresponding to the histogram distribution; The risk identification result is determined based on the probability density of the area into which the risk falls and a preset probability threshold.

4. The method as described in claim 1, wherein the anomaly identification model includes an isolated forest model and a histogram distribution; Based on the reconstruction error, the risk identification result of the service to be identified is obtained through the anomaly identification model, specifically including: Obtain the pre-built isolated forest model and histogram distribution; The first score is determined based on the path length of the partition in the partial trees of the isolated forest model according to the reconstruction error and the anomaly threshold obtained when training the isolated forest model; The second score is determined based on the probability density corresponding to the region where the reconstruction error falls into the histogram distribution and a preset probability threshold. The risk identification result is determined based on the first score and the second score.

5. The method as described in claim 1, wherein the pre-trained word embedding model specifically includes: Obtain historical business logs for the aforementioned business scenario as training samples; Based on the preset model structure parameters, construct an initial word embedding model; Each training sample is input into the initialized word embedding model to obtain each randomly initialized word vector; The word embedding model is adjusted with the optimization objective of adjacent words in the training samples being similar in the word vector space. The word embedding model is used to map the business logs to the word vector space to obtain the business vectors of the business logs.

6. The method as described in claim 1, wherein pre-training the anomaly detection model specifically includes: Obtain historical business logs for the aforementioned business scenario, and generate business vectors through the trained word embedding model; For each business vector, the business vector is input into the anomaly detection model to be trained, and the business vector is reduced in dimensionality to obtain the intermediate features of the business vector. The intermediate features of the business vector are then restored according to the dimensions of the business vector using the anomaly detection model to obtain the reconstructed vector. The reconstructed vector and the business vector are used to determine the function value of a pre-constructed loss function, and the model parameters of the detection model are adjusted based on the function value. The difference between the reconstructed vector and the business vector is positively correlated with the function value.

7. The method as described in claim 2, wherein pre-training the isolated forest model specifically includes: Obtain historical business logs for the aforementioned business scenario; Determine the reconstruction error of each historical business log, and sample each reconstruction error to obtain several training subsets; For each training subset obtained from sampling, a tree is recursively constructed based on the reconstruction error contained in that training subset; Based on the constructed trees, an isolated forest model is obtained as an anomaly detection model; The path length used to divide the historical business logs according to the isolated forest model is used to statistically determine the abnormal score distribution, and an abnormal threshold is determined based on the abnormal score distribution according to a preset ratio.

8. The method as described in claim 3, wherein the histogram distribution is pre-constructed, specifically comprising: Obtain historical business logs for the aforementioned business scenario and determine the reconstruction error of each historical business log. Based on the determined reconstruction errors, a distribution map of the reconstruction errors is constructed; According to the preset segmentation window, the probability density of each interval in the distribution map is determined to obtain the histogram distribution map.

9. The method of claim 1, further comprising: When it is determined to conduct risk control on the business to be identified based on the risk identification results, the business vector of the business to be identified is stored. The service vector is matched with each service vector stored within the most recent preset time period; No alarm notification is sent when any match is successful; If no match is found, an alarm notification is sent to alert the user of a new attack risk.

10. A business risk identification device, the device comprising: The acquisition module is used to acquire business logs of the business to be identified in the business scenario; The vectorization module is used to input the business logs into a pre-trained word embedding model to obtain the business vectors of the business logs in the business scenario. The reconstruction module is used to obtain intermediate features of the business vector through the trained anomaly detection model, and then reconstruct the intermediate features to obtain the reconstructed vector corresponding to the business vector representation. The word embedding model and the anomaly detection model are trained based on the historical business logs of the business scenario. An error determination module is used to determine the reconstruction error based on the business vector and the reconstruction vector; The identification module is used to obtain the risk identification result of the business to be identified based on the reconstruction error through an anomaly identification model. The risk identification result is used to perform risk control on the business to be identified.

11. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1-9.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1-9.

Images