Malicious behavior identification method and device, equipment, storage medium and product

Abstract

The invention discloses a malicious behavior recognition method and device, equipment, a storage medium and a product, and relates to the technical field of data processing, and the malicious behavior recognition method comprises the steps: obtaining behavior data of a user, and constructing a timestamp behavior sequence according to the behavior data; the receptive field range of the user behavior nodes is determined, graph convolution matrixes are determined according to the timestamp behavior sequence and the receptive field range, and the graph convolution matrixes comprise a short-term graph convolution matrix, a middle-term graph convolution matrix and a long-term graph convolution matrix; determining a time perception behavior graph according to the graph convolution matrix and the timestamp behavior sequence; and inputting the time perception behavior graph into a preset malicious behavior recognition model to obtain a malicious behavior recognition result output by the preset malicious behavior recognition model. Compared with an existing mode of extracting a large amount of related data for manual auditing and analysis when a suspicious user with a malicious behavior is found, the mode of the invention can improve the malicious behavior recognition efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a malicious behavior identification method and device, equipment, a storage medium and a product. BACKGROUND

[0002] With the vigorous development of online shopping, various forms of e-commerce malicious behaviors, such as account takeover, fake reviews and malicious transactions, have threatened the property safety of e-commerce platforms and customers. Malicious behaviors on e-commerce platforms can disrupt market order, damage reputation and operating environment. Identifying and combating these behaviors helps maintain the stability and healthy development of the business. E-commerce platforms often accumulate a large amount of time series relationship data, which contains useful information to distinguish between malicious users and good users. Existing malicious behavior detection methods usually simulate the behavior habits of a single user for in-depth analysis and mining. This makes it necessary to extract a large amount of relevant data for manual review and analysis when a suspicious user needs to be focused on, which is time-consuming and labor-intensive. Therefore, how to improve the identification efficiency of user malicious behaviors has become a technical problem to be solved. SUMMARY

[0003] The main purpose of the present application is to provide a malicious behavior identification method, device, equipment, storage medium and product, which aims to solve the technical problem of low identification efficiency of existing user malicious behaviors.

[0004] To achieve the above purpose, the present application provides a malicious behavior identification method, which comprises:

[0005] Obtaining behavior data of a user, and constructing a timestamp behavior sequence according to the behavior data;

[0006] Determining a receptive field range of a user behavior node, and determining a graph convolution matrix according to the timestamp behavior sequence and the receptive field range, wherein the graph convolution matrix comprises a short-term graph convolution matrix, a medium-term graph convolution matrix and a long-term graph convolution matrix;

[0007] Determining a time-aware behavior graph according to the graph convolution matrix and the timestamp behavior sequence;

[0008] Inputting the time-aware behavior graph into a preset malicious behavior identification model to obtain a malicious behavior identification result output by the preset malicious behavior identification model.

[0009] Optionally, the preset malicious behavior identification model comprises a feature aggregation layer, an adjacent interaction layer, a pooling layer, an attention layer and a multilayer perceptron.

[0010] The step of inputting the time-aware behavior graph into the preset malicious behavior identification model to obtain the malicious behavior identification result output by the preset malicious behavior identification model comprises:

[0011] perform feature aggregation on the time-aware behavior graph through the feature aggregation layer and the adjacency interaction layer to obtain an action matrix;

[0012] perform intent recognition on the action matrix based on the pooling layer and the attention layer to obtain an intent vector;

[0013] perform classification on the intent vector according to the multi-layer perception to obtain a malicious behavior recognition result.

[0014] Optionally, the step of performing classification on the intent vector according to the multi-layer perception to obtain a malicious behavior recognition result comprises:

[0015] performing classification on the intent vector according to the multi-layer perception by using the following algorithm to obtain a malicious behavior recognition result:

[0016]

[0017] wherein p is used to represent a malicious risk value in the malicious behavior recognition result, CONCATE() is used to represent a feature fusion function in the preset malicious behavior recognition model, h( 0) , h (1) , h (2) , h (3) is used to represent an intent vector, is used to represent a hyperparameter, and MLP() is used to represent a multi-layer perception.

[0018] Optionally, the step of performing feature aggregation on the time-aware behavior graph through the feature aggregation layer and the adjacency interaction layer to obtain an action matrix comprises:

[0019] perform feature aggregation on the time-aware behavior graph through the feature aggregation layer to obtain a feature aggregation result;

[0020] input the feature aggregation result into the adjacency interaction layer to perform mutual relationship modeling to obtain an action matrix.

[0021] Optionally, the step of constructing a timestamp behavior sequence according to the behavior data comprises:

[0022] determine a user behavior of a user according to the behavior data;

[0023] determine a timestamp and structured information of the user behavior;

[0024] construct a timestamp behavior sequence based on the user behavior, the timestamp, and the structured information.

[0025] Optionally, the step of determining the graph convolution matrix based on the timestamp behavior sequence and the receptive field range includes:

[0026] Determine the timestamp of the user's behavior based on the timestamp behavior sequence;

[0027] The correlation coefficient of the behavior node is determined based on the timestamp of the user behavior and the receptive field range using the following formula:

[0028]

[0029] Among them, A i,j t is used to characterize the correlation coefficient between behavior nodes of user behavior i and user behavior j. i With t j ρ represents the timestamps of user behavior i and user behavior j, respectively; n represents the receptive field range; ρ represents the number of user behaviors.

[0030] Construct a graph convolution matrix based on the association coefficients of the behavioral nodes.

[0031] Furthermore, to achieve the above objectives, this application also proposes a malicious behavior identification device, which includes:

[0032] The acquisition module is used to acquire user behavior data and construct a timestamp behavior sequence based on the behavior data;

[0033] The graph convolution matrix determination module is used to determine the receptive field range of user behavior nodes and determine the graph convolution matrix based on the timestamp behavior sequence and the receptive field range. The graph convolution matrix includes a short-term graph convolution matrix, a medium-term graph convolution matrix, and a long-term graph convolution matrix.

[0034] A time-aware behavior graph determination module is used to determine a time-aware behavior graph based on the graph convolution matrix and the timestamp behavior sequence.

[0035] The identification module is used to input the time-aware behavior graph into a preset malicious behavior identification model to obtain the malicious behavior identification result output by the preset malicious behavior identification model.

[0036] In addition, to achieve the above objectives, this application also proposes a malicious behavior identification device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the malicious behavior identification method as described above.

[0037] In addition, to achieve the above object, the application further provides a storage medium, which is a computer readable storage medium, and a computer program is stored on the storage medium, and the computer program is executed by a processor to implement the steps of the malicious behavior identification method.

[0038] In addition, to achieve the above object, the application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the malicious behavior identification method.

[0039] The application obtains behavior data of a user, constructs a timestamp behavior sequence according to the behavior data, determines a receptive field range of a user behavior node, determines a graph convolution matrix according to the timestamp behavior sequence and the receptive field range, the graph convolution matrix comprising a short-term graph convolution matrix, a medium-term graph convolution matrix and a long-term graph convolution matrix, determines a time-aware behavior graph according to the graph convolution matrix and the timestamp behavior sequence, inputs the time-aware behavior graph into a preset malicious behavior identification model, and obtains a malicious behavior identification result output by the preset malicious behavior identification model. Compared with the prior art of discovering a suspicious user with malicious behavior and extracting a large amount of related data for manual auditing and analysis, the above method of the application can improve the malicious behavior identification efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and serve to explain the principles of the application together with the specification.

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the accompanying drawings needed in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without creative labor.

[0042] Figure 1 A flowchart is provided for the malicious behavior identification method embodiment one of the application;

[0043] Figure 2 A user behavior data diagram is provided for the malicious behavior identification method embodiment one of the application;

[0044] Figure 3 A flowchart is provided for the malicious behavior identification method embodiment two of the application;

[0045] Figure 4 A model structure diagram is provided for the malicious behavior identification method embodiment two of the application;

[0046] Figure 5The malicious behavior identification process schematic diagram provided for the second embodiment of the malicious behavior identification method of the present application is shown in FIG. 1.

[0047] Figure 6 The module structure schematic diagram of the malicious behavior identification device of the embodiment of the present application is shown in FIG. 2.

[0048] Figure 7 The device structure schematic diagram of the hardware running environment involved in the malicious behavior identification method of the embodiment of the present application is shown in FIG. 3.

[0049] The object implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application, and are not used to limit the present application.

[0051] In order to better understand the technical solutions of the present application, the specific embodiments will be described in detail below with reference to the drawings and the accompanying drawings.

[0052] The main solution of the embodiment of the present application is: obtaining the behavior data of the user, constructing the timestamp behavior sequence according to the behavior data; determining the receptive field range of the user behavior node, determining the graph convolution matrix according to the timestamp behavior sequence and the receptive field range, the graph convolution matrix including short-term graph convolution matrix, medium-term graph convolution matrix and long-term graph convolution matrix; determining the time-aware behavior graph according to the graph convolution matrix and the timestamp behavior sequence; inputting the time-aware behavior graph into the preset malicious behavior identification model to obtain the malicious behavior identification result output by the preset malicious behavior identification model. Compared with the existing way of discovering suspicious users with malicious behavior, extracting a large amount of related data for manual auditing and analysis, the above-mentioned way of the present application can improve the malicious behavior identification efficiency.

[0053] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, a malicious behavior identification device, etc. capable of realizing the above functions. The present embodiment and the following embodiments will be described below taking the malicious behavior identification device as an example.

[0054] Based on this, the present embodiment provides a malicious behavior identification method, which is described in detail with reference to Figure 1 , Figure 1 The flowchart of the first embodiment of the malicious behavior identification method of the present application is shown in FIG. 4.

[0055] In the present embodiment, the malicious behavior identification method includes steps S10-S40:

[0056] Step S10, obtaining behavior data of a user, and constructing a time-stamped behavior sequence according to the behavior data;

[0057] It should be noted that the behavior data can include information such as communication relationship, short message, online behavior, APP usage habit, and base station camping situation of the user. Figure 2 , Figure 2 A user behavior data schematic diagram provided for Embodiment One of the malicious behavior identification method of the present application is shown in FIG. 1. The behavior data includes data such as communication behavior, online behavior, and offline behavior of the user. For details, please refer to Figure 2 . The time-stamped behavior sequence constructed according to the behavior data can be a time-stamped behavior sequence V: {v0, v1, v2, …, vn} constructed according to each user behavior in the behavior data, where v0-vn represent user behaviors. n-1} represent user behaviors. n-1 n represents the total number of user behaviors.

[0058] Further, in order to improve the identification efficiency of malicious behavior, the step S10 can include determining user behaviors of the user according to the behavior data.

[0059] determining time stamps and structured information of the user behaviors;

[0060] constructing a time-stamped behavior sequence based on the user behaviors, the time stamps, and the structured information.

[0061] It should be noted that the determination of the user behaviors of the user according to the behavior data can be to extract each behavior of the user from the behavior data. The structured information can include structured information such as attributes and categories of the behaviors, and the time stamp is the time stamp when the behavior occurs. For example, given a user u∈U, U represents all users to be identified for malicious behavior, u is the current user, and each row record x={V, t, x1, x2, …} is obtained, where v∈V represents a behavior with a time stamp, the user has n behaviors, and the behavior data is contained in a time-stamped behavior sequence V={v0, v1, v2, …, vn}, t is a time stamp, x1, x2, … are structured information such as attributes and categories of the behaviors, and for example, device ID and session duration. n-1 i are structured information such as attributes and categories of the behaviors, and for example, device ID and session duration.

[0062] Step S20, determining a receptive field range of a user behavior node, determining a graph convolution matrix according to the time-stamped behavior sequence and the receptive field range, and the graph convolution matrix includes a short-term graph convolution matrix, a medium-term graph convolution matrix, and a long-term graph convolution matrix;

[0063] ​It should be noted that in obtaining the long-term intention of the user, the long-term intention is usually obtained by using more graph convolution layers, so that additional memory and a large amount of training time are required. In order to solve this problem, the embodiment designs three graph convolution matrix receptive fields, which are designed to grow almost exponentially. In this way, fewer layers can be used to ensure feature aggregation between nodes to make it suitable for large-scale malicious behavior detection tasks. Specifically, by controlling the receptive field range of the user behavior node, three different graph convolution matrices of the user's short-term, medium-term and long-term are obtained in the embodiment. The receptive field range of the user behavior node can be customized according to the actual scene, the receptive field of the short-term graph convolution matrix tends to 0, the receptive field of the medium-term graph convolution matrix is a value between 0 and 1, and the receptive field of the long-term graph convolution matrix tends to 1.

[0064] Further, since the time interval is variable, for example, there can be a long interval between two behaviors with timestamps, or two behaviors can be very close in time, so a single graph convolution matrix cannot effectively capture all valuable information of user behavior. In order to avoid this problem, the step S20 can include: determining the timestamp of the user behavior according to the timestamp behavior sequence;

[0065] According to the timestamp of the user behavior and the receptive field range, the behavior node correlation coefficient is determined by the following formula:

[0066]

[0067] Wherein, A i,j is used to represent the behavior node correlation coefficient of user behavior i and user behavior j, t i and t j respectively represent the timestamp of user behavior i and user behavior j, ρ is used to represent the receptive field range, and n is used to represent the number of user behaviors.

[0068] According to the behavior node correlation coefficient, a graph convolution matrix is constructed.

[0069] It should be noted that the timestamp of the user behavior determined according to the timestamp behavior sequence can be the timestamp of each user behavior in the timestamp behavior sequence.

[0070] In the embodiment, the short-term graph convolution matrix of the user can be obtained by controlling ρ to approach 0 (ρ→0). Because when ρ→0, the range of the receptive field will be small, so only the user behavior in a short time can be observed, thereby obtaining the short-term graph convolution matrix of the user.

[0071] Correspondingly, if p approaches 1 (p→1), the range of the receptive field will be large, which is equivalent to being applied to a depth map convolution model, and a large p can be used to capture the long-term intention of the user. Therefore, in the embodiment, the long-term graph convolution matrix of the user can be obtained by controlling p→1.

[0072] In addition, if it is necessary to obtain the medium-term graph convolution matrix of the user, the preset hyperparameter (i.e., the receptive field range p) of the time-aware behavior graph can be controlled to be between 0 and 1, so as to obtain the medium-term graph convolution matrix. The determination of the receptive field range p can be self-defined according to the actual application scenario.

[0073] In a specific implementation, the embodiment can be applied to malicious behavior recognition of a user on an e-commerce platform. The malicious behavior of the user on the e-commerce platform can be various, for example, a gang makes outbound calls, remotely cheats and guides some customers to place orders; for example, a user maliciously attacks, sends a large number of attack requests through DoS, CC and other technical means, occupies limited bandwidth resources, and even makes the entire e-commerce platform lose response; for example, a user performs a sheep-shearing operation, a single operation and the like on the platform through a false account. In order to be able to identify the malicious behavior of the user and the type of the malicious behavior, in the embodiment, the short-term, medium-term and long-term three different graph convolution matrices of the user are input into a preset malicious behavior recognition model trained to perform malicious behavior recognition processing, so as to obtain a malicious behavior recognition result.

[0074] Step S30, determining a time-aware behavior graph according to the graph convolution matrix and the timestamp behavior sequence;

[0075] It should be noted that the determination of the time-aware behavior graph according to the graph convolution matrix and the timestamp behavior sequence can be that the user behavior in the timestamp behavior sequence is taken as a user behavior node, and the behavior node correlation between each user behavior in the graph convolution matrix is taken as an edge between the user behavior nodes, to construct a time-aware behavior graph. The time-aware behavior graph can be represented as G={V, E, A}. V represents an action node, i.e., a user behavior in the timestamp behavior sequence, E is an edge, i.e., a node correlation between user behavior nodes in the graph convolution matrix, and A∈R^(n×n)(0≤A i，j ≤1) is a graph convolution matrix corresponding to the user behavior. n is used to represent the total number of user behaviors in the timestamp behavior sequence. R is used to represent a real number set. Each node v i In the figure, a record is represented, and the edge represents the correlation between two nodes, and each edge <v i ,v j > can represent the time-related weight of v i and v j , and the time-related weight of v i and vj time interval.

[0076] In a specific implementation, each action is represented as a node, and the corresponding attribute is represented as a node feature. For example, the access time of the user accessing the website, the time when the user changes the mobile phone number, combined with the sending and receiving of messages, the calling and called time. The node embedding builds a user behavior graph related to the time and is represented as a node on the timestamp. In this way, the relationship between different behaviors and their underlying structures can be captured, facilitating subsequent feature aggregation.

[0077] In step S40, the time-aware behavior graph is input into a preset malicious behavior recognition model to obtain a malicious behavior recognition result output by the preset malicious behavior recognition model.

[0078] It should be noted that the preset malicious behavior recognition model can be a neural network model pre-trained for identifying malicious behavior of a user. The malicious behavior recognition result can include a risk value of the user, a probability value of being classified as a malicious user, and suspicious behavior corresponding to the user.

[0079] The embodiment obtains behavior data of a user, constructs a timestamp behavior sequence according to the behavior data, determines a receptive field range of a user behavior node, determines a graph convolution matrix according to the timestamp behavior sequence and the receptive field range, the graph convolution matrix including a short-term graph convolution matrix, a medium-term graph convolution matrix, and a long-term graph convolution matrix, determines a time-aware behavior graph according to the graph convolution matrix and the timestamp behavior sequence, inputs the time-aware behavior graph into a preset malicious behavior recognition model to obtain a malicious behavior recognition result output by the preset malicious behavior recognition model. Compared with the existing way of discovering suspicious users with malicious behavior and extracting a large amount of related data for manual auditing and analysis, the above-mentioned way of the embodiment can improve the malicious behavior recognition efficiency.

[0080] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as the above-mentioned first embodiment can be referred to the above introduction, and will not be repeated hereinafter. On this basis, please refer to Figure 3 , Figure 3 is a flowchart provided for the second embodiment of the malicious behavior recognition method of the present application; the preset malicious behavior recognition model includes a feature aggregation layer, an adjacent interaction layer, a pooling layer, an attention layer, and a multi-layer perception machine; and the step S40 further includes steps S401-S403:

[0081] In step S401, the feature aggregation layer and the adjacent interaction layer are used to perform feature aggregation on the time-aware behavior graph to obtain an action matrix.

[0082] It should be noted that Figure 4 ,Figure 4 A schematic diagram of a model structure provided for the second embodiment of the malicious behavior identification method of the present application is shown in FIG. 2. Figure 4 In the formula, Σ represents the feature aggregation layer, and GNIU represents the adjacent interaction layer. Each time-aware behavior graph has an input matrix H (0) , which is a timestamp behavior sequence, and short-term, medium-term, and long-term graph convolution matrices A (1) , A (2) , and A (3) . Figure 4 The time-aware graph convolution matrix in the formula includes the short-term graph convolution matrix, the medium-term graph convolution matrix, and the long-term graph convolution matrix, which are represented as A (1) , A (2) , and A (3) . The feature aggregation of the time-aware behavior graph through the feature aggregation layer and the adjacent interaction layer to obtain an action matrix includes: performing feature aggregation of the time-aware behavior graph through the feature aggregation layer to obtain a feature aggregation result.

[0083] The feature aggregation result is input to the adjacent interaction layer for mutual relationship modeling to obtain an action matrix.

[0084] It should be noted that the feature aggregation of the time-aware behavior graph through the feature aggregation layer to obtain a feature aggregation result can be performed as wherein represents the representation of the behavior node v i at the lth layer, l is an integer from 1 to 3, and N(v i ) represents the i-th user behavior. represents the normalized aggregated coefficient of the behavior node v j to v i at the lth layer, i.e., the behavior node correlation coefficient. Then, feature transformation is performed on the aggregated behavior representation: wherein W ∈ R d×d is a trainable parameter matrix of the lth layer for transformation formula. is the feature aggregation result. To solve the over-smoothing problem caused by information aggregation only relying on time interval information, some common operation behaviors will reduce the usability of the model. Therefore, the information is calibrated through a gated adjacent interaction mechanism, and the feature interaction between nodes is learned. The aggregated neighbor representation sequence, i.e., the feature aggregation result, is fed to the adjacent interaction layer for mutual relationship modeling. Specifically, the input of the feature aggregation result to the adjacent interaction layer for mutual relationship modeling to obtain an action matrix can be filtering out irrelevant information that may interfere with the current action intention and propagating valuable information to the next layer through the following formula:

[0085]

[0086] wherein, for representing behavior nodes in the action matrix, the action matrix comprising H (0) ,H (1) ,H (2) ,H (3) The embodiment adopts layer normalization to normalize each layer feature, thereby avoiding action node feature value deviation caused by adjacent interaction and cumulative negative effects caused by excessive number of stacked layers.

[0087] Step S402: performing intention recognition on the action matrix based on the pooling layer and the attention layer, to obtain an intention vector;

[0088] It should be noted that, in order to generate the intention vector according to the action matrix (H (0) ,H (1) ,H (2) ,H (3) ), a max-pooling readout layer using a max-pooling layer and an attention layer based on an attention mechanism is used. The role of the max-pooling is to keep the most significant intention in the behavior sequence dimension. According to the action matrix (H (0) ,H (1) ,H (2) ,H (3) ), the intention vector is obtained This can extract the most relevant attributes for malicious behavior detection. In addition, the role of the attention mechanism enables it to retain suspicious behavior. Because the behavior embedding node is aggregated from the adjacent node to the next node, for each view, the suspicious behavior-related intention can be represented as:

[0089]

[0090] wherein. W attention ∈R d×d is an attention weight matrix, and the global intention learning is shared, for representing the attention mechanism of the model: for representing the i-th behavior data in H (l) , thus, for each view, the intention vector is

[0091] Step S403: classifying the intention vector according to the multi-layer perception, to obtain a malicious behavior recognition result.

[0092] It should be noted that the step of classifying the intent vector according to the multilayer perceptron to obtain the malicious behavior identification result can be achieved by inputting the intent vector into the multilayer perceptron and obtaining the malicious behavior identification result output by the multilayer perceptron. The malicious behavior identification result includes the user's risk value.

[0093] Furthermore, to obtain a more accurate result for identifying malicious behavior, step S403 may include: classifying the intent vector using the following algorithm based on the multilayer perceptron to obtain the result for identifying malicious behavior:

[0094]

[0095] Where p represents the malicious risk value in the malicious behavior identification result, CONCATE() represents the feature fusion function in the preset malicious behavior identification model, and h (0) ,h (1) ,h (2) ,h (3) Used to represent the intent vector MLP() is used to characterize hyperparameters and is used to characterize multilayer perceptrons.

[0096] It should be noted that the malicious behavior identification results also include the probability that a user is classified as a malicious user and the user's malicious behavior.

[0097] In specific implementation, it can be referred to Figure 5 , Figure 5 This is a schematic diagram of the malicious behavior identification process provided in Embodiment 2 of the malicious behavior identification method of this application; Figure 5 The time-series related database is the database for collecting user behavior data. User behavior data is extracted from this database, constructed into timestamped behavior sequences, and input into the preprocessing module for preprocessing. Preprocessing includes constructing a graph convolution matrix and a time-aware behavior graph. Then, the time-aware behavior graph is input into a multi-view graph neural network, i.e., the preset malicious behavior recognition model. The preset malicious behavior recognition model extracts and identifies malicious behavior based on the time-aware behavior graph, and outputs identification results such as the user's suspicious behavior sequence, the importance of suspicious behavior, malicious risk value, and the probability value of belonging to a malicious user. This embodiment can systematically detect and extract suspicious behavior sequences, providing the most accurate method. For example, the suspicious behavior sequence output by the preset malicious behavior recognition model is: unbind mobile phone number → verify mobile phone number → check new mobile phone number → set new mobile phone number → change account information → change delivery address → place product order. This embodiment can provide suspicious sub-sequences closely related to the final identity.

[0098] The embodiment aggregates features of the time-aware behavior graph through the feature aggregation layer and the adjacent interaction layer to obtain an action matrix; performs intention recognition on the action matrix based on the pooling layer and the attention layer to obtain an intention vector; and classifies the intention vector according to the multi-layer perception machine to obtain a malicious behavior recognition result. Compared with the existing traditional GNN model using a single graph convolution matrix, which is limited to learning a single intention, however, a behavior sequence exhibits different time features, resulting in a huge change in the graph convolution matrix. The embodiment can complementarily alleviate this problem by using different graph convolution matrices. In addition, multi-view can cross deeper layers to hierarchically aggregate adjacent features, thereby capturing local and global intentions.

[0099] It should be noted that the above examples are only used for understanding the present application and do not constitute a limitation on the malicious behavior recognition method of the present application. More forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0100] The present application also provides a malicious behavior recognition device, please refer to Figure 6 , the malicious behavior recognition device comprises:

[0101] The acquisition module 10 is configured to acquire behavior data of a user, and construct a timestamp behavior sequence according to the behavior data.

[0102] The graph convolution matrix determination module 20 is configured to determine a receptive field range of a user behavior node, determine a graph convolution matrix according to the timestamp behavior sequence and the receptive field range, and the graph convolution matrix comprises a short-term graph convolution matrix, a medium-term graph convolution matrix and a long-term graph convolution matrix.

[0103] The time-aware behavior graph determination module 30 is configured to determine a time-aware behavior graph according to the graph convolution matrix and the timestamp behavior sequence.

[0104] The recognition module 40 is configured to input the time-aware behavior graph into a preset malicious behavior recognition model to obtain a malicious behavior recognition result output by the preset malicious behavior recognition model.

[0105] The embodiment obtains behavior data of a user, constructs a timestamp behavior sequence according to the behavior data, determines a receptive field range of a user behavior node, determines a graph convolution matrix according to the timestamp behavior sequence and the receptive field range, the graph convolution matrix including a short-term graph convolution matrix, a medium-term graph convolution matrix and a long-term graph convolution matrix, determines a time-aware behavior graph according to the graph convolution matrix and the timestamp behavior sequence, inputs the time-aware behavior graph into a preset malicious behavior recognition model, and obtains a malicious behavior recognition result output by the preset malicious behavior recognition model. Compared with the existing way of extracting a large amount of related data for manual auditing and analysis when a suspicious user with malicious behavior is found, the above way can improve the malicious behavior recognition efficiency.

[0106] The malicious behavior recognition device provided in the application adopts the malicious behavior recognition method in the above embodiment, and can solve the technical problem of low user malicious behavior recognition efficiency in the prior art. Compared with the prior art, the malicious behavior recognition device provided in the application has the same beneficial effects as the malicious behavior recognition method provided in the above embodiment, and other technical features in the malicious behavior recognition device are the same as the features disclosed in the above embodiment, which will not be described herein.

[0107] The application provides a malicious behavior recognition device, which includes at least one processor and a memory connected with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the malicious behavior recognition method in the above embodiment one.

[0108] Reference will be made to the following description Figure 7 which shows a structural schematic diagram of a malicious behavior recognition device suitable for implementing the embodiments of the application. The malicious behavior recognition device in the embodiments of the application can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 7 The malicious behavior recognition device shown is only an example, and should not bring any limitation to the functions and use range of the embodiments of the application.

[0109] As Figure 7As shown, the malicious behavior recognition device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. Various programs and data required for the operation of the malicious behavior recognition device are also stored in the RAM 1004. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the malicious behavior recognition device to communicate wirelessly or wired with other devices to exchange data. Although the malicious behavior recognition device with various systems is shown in the figure, it should be understood that all the shown systems are not required to be implemented or possessed. More or less systems can be alternatively implemented or possessed.

[0110] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are performed.

[0111] The malicious behavior recognition device provided by the present disclosure adopts the malicious behavior recognition method in the above-mentioned embodiments, and can solve the technical problem of low user malicious behavior recognition efficiency in the prior art. Compared with the prior art, the beneficial effects of the malicious behavior recognition device provided by the present disclosure are the same as those of the malicious behavior recognition method provided by the above-mentioned embodiments, and other technical features in the malicious behavior recognition device are the same as those disclosed in the previous embodiment method, which will not be repeated here.

[0112] It should be understood that portions of the application disclosed can be implemented in hardware, software, firmware, or combinations thereof. In the description of the embodiments above, specific features, structures, materials or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0113] The above description is merely illustrative of the application and is not intended to limit the scope of the application. Any changes and modifications that can be made to the application in accordance with the principles of the application would be readily apparent to those skilled in the art and the present application is therefore not limited to the description and examples contained herein but is only limited by the claims.

[0114] The application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e., a computer program) for performing the malicious behavior identification method in the above-described embodiments.

[0115] The computer readable storage medium provided by the application may, for example, be a U disk, but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more conductive wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted in any suitable medium, including but not limited to electrical wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0116] The above computer readable storage medium can be included in the malicious behavior identification device; or can exist separately and not be assembled into the malicious behavior identification device.

[0117] The above computer readable storage medium carries one or more programs, which, when executed by the malicious behavior identification device, cause the malicious behavior identification device to perform the above malicious behavior identification method.

[0118] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0119] The flow diagrams and the block diagrams in the drawings are meant as methodological and functional description of implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0120] The modules involved in the embodiments of the present application can be implemented in software or hardware. In some cases, the names of the modules do not constitute a limitation on the modules themselves.

[0121] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer programs) for executing the above-mentioned malicious behavior identification method, and can solve the technical problem of low user malicious behavior identification efficiency. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the malicious behavior identification method provided by the above-mentioned embodiments, and will not be described here.

[0122] The application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the malicious behavior identification method as described above.

[0123] The computer program product provided by the application can solve the technical problem of low efficiency of existing user malicious behavior identification. Compared with the prior art, the beneficial effects of the computer program product provided by the application are the same as those of the malicious behavior identification method provided by the above-mentioned embodiments, and are not described here.

[0124] The above only describes some embodiments of the application, and does not limit the patent scope of the application. Any equivalent structural transformation made by using the content of the specification and drawings, or direct / indirect application in other related technical fields under the technical concept of the application is included in the patent protection scope of the application.

Claims

1. A method for identifying malicious behavior, characterized in that, The malicious behavior identification method includes the following steps: Obtain user behavior data and construct a timestamped behavior sequence based on the behavior data; Determine the receptive field range of the user behavior node, and determine the graph convolution matrix based on the timestamp behavior sequence and the receptive field range. The graph convolution matrix includes a short-term graph convolution matrix, a medium-term graph convolution matrix, and a long-term graph convolution matrix. A time-aware behavior graph is determined based on the graph convolution matrix and the timestamp behavior sequence; The time-aware behavior graph is input into a preset malicious behavior recognition model to obtain the malicious behavior recognition result output by the preset malicious behavior recognition model.

2. The malicious behavior identification method as described in claim 1, characterized in that, The preset malicious behavior identification model includes a feature aggregation layer, an adjacency interaction layer, a pooling layer, an attention layer, and a multilayer perceptron. The step of inputting the time-aware behavior graph into a preset malicious behavior recognition model to obtain the malicious behavior recognition result output by the preset malicious behavior recognition model includes: The time-aware behavior graph is subjected to feature aggregation through the feature aggregation layer and the adjacency interaction layer to obtain the action matrix; Intent vectors are obtained by performing intent recognition on the action matrix based on the pooling layer and the attention layer. The intent vector is classified using the multilayer perceptron to obtain the malicious behavior identification result.

3. The malicious behavior identification method as described in claim 2, characterized in that, The step of classifying the intent vector based on the multilayer perceptron to obtain the malicious behavior identification result includes: The intention vector is classified using the multilayer perceptron according to the following algorithm to obtain the malicious behavior identification result: Where p represents the malicious risk value in the malicious behavior identification result, CONCATE() represents the feature fusion function in the preset malicious behavior identification model, and h (0) ,h (1) ,h (2) ,h (3) Used to represent the intent vector MLP() is used to characterize hyperparameters and is used to characterize multilayer perceptrons.

4. The malicious behavior identification method as described in claim 2, characterized in that, The step of performing feature aggregation on the time-aware behavior map through the feature aggregation layer and the adjacency interaction layer to obtain the action matrix includes: The time-aware behavior map is subjected to feature aggregation through the feature aggregation layer to obtain the feature aggregation result; The feature aggregation result is input into the neighboring interaction layer to model the mutual relationship and obtain the action matrix.

5. The malicious behavior identification method according to any one of claims 1-4, characterized in that, The step of constructing a timestamped behavior sequence based on the behavior data includes: Determine the user's behavior based on the behavioral data; Determine the timestamps and structured information of the user's behavior; A timestamp behavior sequence is constructed based on the user behavior, the timestamp, and the structured information.

6. The malicious behavior identification method according to any one of claims 1-4, characterized in that, The step of determining the graph convolution matrix based on the timestamp behavior sequence and the receptive field range includes: Determine the timestamp of the user's behavior based on the timestamp behavior sequence; The correlation coefficient of the behavior node is determined based on the timestamp of the user behavior and the receptive field range using the following formula: Among them, A i,j t is used to characterize the correlation coefficient between behavior nodes of user behavior i and user behavior j. i With t j ρ represents the timestamps of user behavior i and user behavior j, respectively; n represents the receptive field range; ρ represents the number of user behaviors. Construct a graph convolution matrix based on the association coefficients of the behavioral nodes.

7. A malicious behavior identification device, characterized in that, The malicious behavior identification device includes: The acquisition module is used to acquire user behavior data and construct a timestamp behavior sequence based on the behavior data; The graph convolution matrix determination module is used to determine the receptive field range of user behavior nodes and determine the graph convolution matrix based on the timestamp behavior sequence and the receptive field range. The graph convolution matrix includes a short-term graph convolution matrix, a medium-term graph convolution matrix, and a long-term graph convolution matrix. A time-aware behavior graph determination module is used to determine a time-aware behavior graph based on the graph convolution matrix and the timestamp behavior sequence. The identification module is used to input the time-aware behavior graph into a preset malicious behavior identification model to obtain the malicious behavior identification result output by the preset malicious behavior identification model.

8. A malicious behavior detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the malicious behavior identification method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the malicious behavior identification method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the malicious behavior identification method as described in any one of claims 1 to 6.

Images