Abnormal user detection method and system based on behavior sequence

Abstract

The invention discloses an abnormal user detection method and system based on a behavior sequence, and the method comprises the steps: extracting a basic feature and a hidden feature of each user, forming a feature vector, and taking the feature vector as a data point; clustering the feature vectors of the users through a clustering algorithm, selecting data points which are neither core points nor are covered by neighborhoods of any core points as noise points, and taking users corresponding to the noise points as preliminarily identified risk users; forming behavior sequence features by the preliminarily identified behavior sequence of the risk user, the behavior time entropy and the current file processing depth score data; and inputting the behavior sequence features into a pre-trained abnormal behavior sequence discovery model, and outputting an abnormal user detection result. According to the method, ant moving type leaked hidden intentions (such as splitting and splicing, business camouflage and the like) are converted into quantifiable indexes, and deep hidden behaviors are detected.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an abnormal user detection method and system based on behavioral sequences. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] In the field of cybersecurity, existing technologies for addressing core data breaches caused by insiders primarily revolve around user behavior monitoring, data access control, and anomaly detection. The harm caused by core data breaches is significant, including the leakage of trade secrets leading to decreased corporate competitiveness, the leakage of customer privacy resulting in legal risks and reputational damage, and the loss of core technical data leading to wasted R&D investment. Insiders, possessing legitimate access rights, make their theft and leakage activities more covert and destructive, especially the "ant-moving" style of leakage, which often circumvents single threshold triggers by transmitting multiple small, dispersed data. This often results in irreparable damage by the time the breach is discovered.

[0004] In existing technologies, common technical methods used to address data breaches include: (1) Static prevention and control, such as role-based access control (RBAC), data encryption and desensitization, and reducing the risk of leakage by limiting the scope of user permissions; however, this method still cannot avoid data leakage problems caused by authorized personnel.

[0005] (2) Anomaly identification based on preset rules, such as setting a threshold for the amount of data transmitted in a single transaction or setting a time limit for accessing sensitive files; however, for "ant-like" leaks, the threshold is often circumvented by dispersing operations, resulting in a high rate of missed detection.

[0006] (3) User behavior baseline modeling based on machine learning, such as: constructing normal patterns by analyzing historical behavior and identifying operations that deviate from the baseline; however, this approach focuses more on the degree of abnormality of a single behavior and lacks analysis of the correlation of behavior sequences, making it difficult to identify behaviors that are leaked due to the accumulation of multiple small operations, such as: downloading the same type of sensitive file fragments for several consecutive days, or sending data out through different channels at different times.

[0007] In addition, the existing solution is not good at distinguishing between normal business behavior and malicious leakage behavior, and the detection effectiveness is easily reduced due to frequent alarms. In particular, the false alarm rate increases significantly when internal personnel use legitimate business processes to cover up leakage behavior.

[0008] These shortcomings make it difficult for existing technologies to accurately identify "ant-like" leaks that are highly concealed and span a long period of time, and they cannot meet the needs for early warning and accurate location of internal personnel's theft and leakage of secrets. Summary of the Invention

[0009] To address the aforementioned issues, and considering that data leaks characterized by "ant-like" data breaches often involve small-batch, continuous manipulation of sensitive files and periodic, covert, long-term data outflows, this invention proposes an abnormal user detection method and system based on behavioral sequences. This method initially identifies risky users by analyzing the abnormal accumulation of sensitive data, and then precisely locates abnormal users by combining the temporal correlation analysis of behavioral sequences.

[0010] In some implementations, the following technical solutions are adopted: An abnormal user detection method based on behavioral sequences includes: Acquire and preprocess user file operation data within a historical time period; The basic and latent features of each user are extracted separately to form a feature vector, which is then treated as a data point. The latent features include file fragment correlation, behavior time entropy, and file processing depth deviation. The feature vectors of each user are clustered using a clustering algorithm. Data points that are neither core points nor covered by the neighborhood of any core point are selected as noise points. The users corresponding to the noise points are identified as risk users in the preliminary identification. The behavioral sequence features are composed of the behavioral sequence, behavioral temporal entropy, and current file processing depth score data of the initially identified risky users. The behavioral sequence features are then input into a pre-trained abnormal behavior sequence detection model, which outputs abnormal user detection results.

[0011] As a further embodiment, the basic features include: the number of files downloaded by the user's IP address each day, the number of times files were downloaded, the total size of downloaded files, the number of files uploaded, the number of times files were uploaded, the total size of uploaded files, the number of files operated on locally, the number of times files were operated on locally, the total size of files operated on locally, and the sequence of file operation actions performed by the user each day in chronological order.

[0012] As a further solution, the file fragment correlation feature is used to quantify the content correlation between different file fragments operated by the same user. The specific calculation process is as follows: For each file, extract local segment fingerprints from the header, middle, and tail. Calculate the cosine similarity of segment fingerprints between files operated by the same user within a set time period. Count the number of file pairs with similarity greater than a set value within the period, divide by the total number of files operated on in the same period, and obtain the file segment association characteristics.

[0013] As a further solution, the behavioral temporal entropy feature is used to quantify the disorder of the time distribution of user-sensitive file operations. The specific calculation process is as follows: Divide the time window, count the percentage of sensitive file operations in each window to form a percentage distribution; calculate the information entropy of the percentage distribution to obtain the behavioral time entropy feature.

[0014] As a further solution, the file processing depth deviation is used to quantify the user's processing depth of sensitive files, and the specific calculation process is as follows: For each sensitive file's complete operation chain, a quantitative scoring standard is set according to the file's usage level. All sensitive files operated by a single user within a set time period are statistically analyzed, and the processing depth score for each file is calculated. The average score is taken as the user's average processing depth score, and the difference between the user's average processing depth score and the benchmark data is calculated as the processing depth deviation.

[0015] As a further solution, a clustering algorithm is used to cluster the feature vectors of each user, specifically: A density-based clustering algorithm is used to cluster the feature vectors of each user; the specific process is as follows: Set the neighborhood radius and the minimum number of neighborhood points. Randomly select an unvisited data point p and calculate the number of points contained within the neighborhood radius centered on p. If the number is greater than the minimum number of neighborhood points, then take point P as the core point, create a new cluster, and add all points in its neighborhood to the current cluster. For each newly added point, if it is a core point, continue to expand its neighborhood; repeat this process until it can no longer be expanded. Repeat the above process until all data points have been accessed.

[0016] As a further solution, the abnormal behavior sequence discovery model uses a long short-term memory network model to deeply mine temporal dependencies and focus on key hidden abnormal nodes through an attention layer.

[0017] In other embodiments, the following technical solutions are adopted: An abnormal user detection system based on behavioral sequences includes: The data acquisition module is configured to: acquire and preprocess user file operation-related behavior data within a historical time period; The feature extraction module is configured to extract the basic features and latent features of each user, form a feature vector, and treat it as a data point; the latent features include file fragment correlation, behavior time entropy, and file processing depth deviation. The risk user preliminary identification module is configured to: cluster the feature vectors of each user using a clustering algorithm, select data points that are neither core points nor covered by the neighborhood of any core point as noise points, and the users corresponding to the noise points are identified as risk users in the preliminary identification. The abnormal user localization module is configured to: combine the behavioral sequence, behavioral time entropy, and current file processing depth score data of the initially identified risky users into behavioral sequence features; input the behavioral sequence features into the pre-trained abnormal behavior sequence discovery model, and output the abnormal user detection results.

[0018] In other embodiments, the following technical solutions are adopted: A terminal device includes a processor and a memory, the processor being used to implement instructions; the memory being used to store multiple instructions adapted to be loaded by the processor and executed by the above-described abnormal user detection method based on behavior sequences.

[0019] In other embodiments, the following technical solutions are adopted: A computer-readable storage medium storing a plurality of instructions adapted for loading and execution by a processor of a terminal device of the above-described abnormal user detection method based on behavioral sequences.

[0020] Compared with the prior art, the beneficial effects of the present invention are: (1) This invention transforms the hidden intentions of "ant moving house" type leakage (such as splitting and splicing, business disguise, etc.) into quantifiable indicators to realize the detection of deep hidden behaviors; the behavior of "splitting sensitive files into small fragments" can be accurately identified by file fragment correlation, solving the problem that traditional methods cannot associate scattered files; the periodic pattern of "fixed time period operation" can be captured by behavior time entropy, avoiding missed detection due to single-step operation meeting the threshold; the file processing depth deviation can distinguish between "normal use" and "disguised transmission", reducing the misjudgment of "download and send directly".

[0021] (2) This invention enhances the progressive detection efficiency of “group screening-individual location” by combining clustering algorithm and neural network algorithm; In the initial risk user identification stage, the DBSCAN algorithm performs clustering based on the combined vector of basic features and latent features. With its density-sensitive characteristics, it automatically discovers risk groups with abnormal surface operations and abnormal latent intentions. It does not require a preset abnormal threshold and can flexibly capture complex abnormal patterns such as high-frequency low-volume operations, high correlation, and low time entropy.

[0022] In the precise location of abnormal users, the LSTM algorithm is used to input structured sequences of behavior types and latent features, which can deeply mine temporal dependencies (such as a complete abnormal chain from high-relevance download to low-depth processing, low-temporal entropy processing, and then to outward transmission), accurately distinguishing between accidental abnormalities and malicious behavior. The attention layer focuses on key latent abnormal nodes (such as operations with low file processing depth or low temporal entropy).

[0023] The combination of the two algorithms forms a progressive detection logic from screening for group anomalies to tracing the source of individual behaviors. The DBSCAN algorithm quickly narrows down the risk range and reduces the computational complexity of subsequent analysis; the LSTM algorithm performs in-depth time-series analysis within the focused range and accurately locates anomalies within that range. The synergy of the two algorithms not only ensures detection efficiency but also improves the depth and breadth of anomaly identification, ultimately significantly reducing the false positive and false negative rates. This enables the system to discover potential threat users more promptly and accurately, providing more reliable technical support for scenarios such as network security protection and data compliance management, and significantly enhancing the system's ability to perceive and respond to abnormal behavior.

[0024] Other features and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0025] Figure 1 This is a flowchart of the abnormal user detection method based on behavior sequence in an embodiment of the present invention. Detailed Implementation

[0026] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0027] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0028] Example 1 In one or more embodiments, an abnormal user detection method based on behavioral sequences is disclosed, combined with Figure 1 Specifically, it includes the following process: S101: Obtain and preprocess user file operation data within a historical time period (e.g., within 30 days).

[0029] In this embodiment, user terminal operation behavior and network access behavior are obtained based on user terminal behavior probes and network probes; such as: uploading files, downloading files, editing files, saving files as, opening files, compressing files, printing files, and burning files.

[0030] The user file operation-related data mentioned above was cleaned and standardized with the following fields: user IP, operation type, operation time, file name, file size, file type, and whether it is a sensitive file.

[0031] S102: Extract the basic features and latent features of each user respectively, form a feature vector, and treat it as a data point; the latent features include file fragment correlation degree, behavior time entropy, and file processing depth deviation degree.

[0032] Based on the user's file operation-related behavior data obtained in step S101, basic features and latent features are extracted respectively; among them, the basic features mainly include the following types: Feature 1: Number of files downloaded per user IP per day.

[0033] Feature 2: Number of files downloaded per user IP per day.

[0034] Feature 3: Total file size downloaded by user IP per day.

[0035] Feature 4: Number of files uploaded by user IP per day.

[0036] Feature 5: Number of files uploaded per user IP per day.

[0037] Feature 6: Total file size uploaded by user IP per day.

[0038] Feature 7: Number of files operated locally by user IP per day.

[0039] Feature 8: Number of times a user's IP address performs local file operations per day.

[0040] Feature 9: Total size of files operated locally by user IP per day.

[0041] Feature 10: Collect daily user actions on files and sort them chronologically to form an action sequence, such as file download, copy, and external transfer.

[0042] Features 1-9 all use "user IP" as the dimension and "day" as the time unit, focusing on three core indicators: the number, frequency, and size of file operations. They cover three key file behaviors: "download, upload, and local operation" (local operation includes file editing, saving as, compression, etc.). The core purpose is to capture the sensitive data collection characteristics of users in "small batches and continuous" manner, providing quantitative data support for the subsequent DBSCAN algorithm to identify risky users.

[0043] The core purpose of Feature 10 is to capture the long-term data outflow characteristics of users that are "periodic and hidden", so as to provide "temporal behavior chain" support for the subsequent LSTM algorithm to mine the correlation between behaviors and accurately locate abnormal users.

[0044] Latent traits mainly include the following types: Feature 11: File fragment correlation (reflecting the intent of "split file concatenation") One of the typical covert strategies of ant-moving-style data leaks is to split a complete sensitive file into multiple small fragments (such as splitting a 100MB core document into 20 5MB fragments), and download or distribute them at different times and through different channels. The operation of a single fragment (such as downloading a 5MB file) meets the normal threshold, and traditional detection methods that only count "file quantity and size" cannot identify the relationship that "fragments belong to the same complete file".

[0045] The core function of file fragment correlation is to transform the "indirectly observable intention to split and splice" into a quantifiable correlation index by quantifying the "content correlation between different file fragments operated by the same user". This accurately captures the hidden anomaly of "dispersed operations but targeting the same sensitive file", fills the gap in the original technology's ability to identify splitting and leaking behavior, and reduces the missed detection rate of such hidden leaks.

[0046] The calculation steps are as follows: (1) Fragment fingerprint extraction: Extract three key local fragment fingerprints for each file: a 100-byte hash value at the beginning of the file, a random 200-byte hash value in the middle, and a 100-byte hash value at the end of the file; (2) Cross-time matching: Calculate the cosine similarity of fragment fingerprints between files operated by the same user, with a period of 1 day; the specific calculation formula is as follows: ; in, Let i be the fingerprint hash value of the i-th segment of file 1. Let be the fingerprint hash value of the i-th segment of file 2, where i = 1, 2, 3; the similarity value ranges from 0 to 1, and the closer the value is to 1, the stronger the correlation between the segments of the two files.

[0047] (3) Relationship quantification: The number of file pairs with "similarity ≥ 85%" within the statistical period is divided by the total number of files operated in the same period to obtain the file fragment relationship degree (value 0-1).

[0048] Feature 12: Behavioral temporal entropy (reflects the pattern of "periodic operation") One of the typical covert strategies of "ant-moving" style data leakage is to deliberately choose fixed time windows for operation (such as 10 minutes before the end of the workday every day, or Friday afternoon). The single-step operation meets the normal threshold, but the operation time distribution is highly concentrated (not random); while normal users' operation time on sensitive files is mostly scattered during working hours (random distribution).

[0049] The core function of behavioral temporal entropy is to quantify the "disorder of user sensitive file operation time distribution" and transform "unobservable temporal regularity" into a quantifiable entropy value indicator, thereby accurately distinguishing between "normal random operation" and "abnormal periodic operation". This makes up for the shortcomings of the original technology, which only counts the number or size of operations and cannot capture hidden anomalies in the time dimension, and reduces the false negative rate of "dispersed leakage in fixed time periods".

[0050] The specific calculation steps are as follows: (1) Time window division: Divide one day into 24 one-hour windows; (2) Frequency statistics: Calculate the percentage of sensitive file operations within each window, forming a distribution P=[p1, p2, ..., p24] ( ).

[0051] (3) Entropy calculation: The behavioral time entropy is quantified by the information entropy formula (the lower the entropy, the more concentrated the operation), as follows: ; in, This represents the percentage of sensitive file operations within the k-th window. This represents the amount of information contained in the number of sensitive file operations within the k-th window. Feature 13: File processing depth deviation (reflecting "transfer only, not use" spoofing behavior) File processing depth deviation is designed to address the difficulty in identifying disguised behaviors in ant-like data leaks. Its purpose is to accurately distinguish between "normal use after download" and "disguised transmission after download," thereby improving the accuracy of abnormal user detection. A typical disguise strategy involves only performing "download, compression, and outward transmission" operations on sensitive files, without any actual use (such as opening, editing, or annotating). Single-step operations (such as downloading and outward transmission) conform to normal business thresholds, but the chain of operations without usage steps conceals the intent to leak information.

[0052] The core function of file processing depth deviation is to quantify the "depth of user processing of sensitive files" and compare it with the normal business benchmark within the department. This transforms the "unobservable disguised transmission intent" into a quantifiable deviation indicator, accurately identifies abnormal behavior of "transmission without use," and reduces the false alarm rate and false negative rate caused by "legitimate operations covering up malicious intent."

[0053] The specific calculation steps are as follows: (1) Define the processing depth scoring rules: For each sensitive file's complete operation chain, a quantitative scoring standard is set based on the "file usage degree." For example, the document's explicit rules are as follows: Maximum usage (normal behavior): Download → Open → Edit → Save, Rating = 100; Moderate usage (browsing behavior): Download → Open → No editing (viewing only), rating = 50; Minimum Usage (Fake Transfer): Download → Direct Compression or External Distribution (No Opening, No Editing), Rating = 0.

[0054] (2) Calculate the average processing depth per user: To analyze a user's handling of all sensitive files within the past 30 days, a processing depth score is calculated for each file, and the average score is taken as the user's "average processing depth score." The formula is as follows: ; Where m is the total number of sensitive files processed by the user during the same period.

[0055] (3) Calculate the depth deviation. Based on "Departmental Average Processing Depth Score" (This refers to the departmental baseline data, which is the average data calculated based on all user data in the department.) Using this as a reference, the difference between user performance and normal business performance is quantified through a formula, as clearly stated in the document: ; The value of the processing depth deviation ranges from 0% to 100%. The higher the value, the shallower the user's file processing depth, the greater the difference from the department's normal level, and the stronger the suspicion of spoofed transmission; the lower the value, the closer it is to normal business behavior.

[0056] This embodiment extracts the aforementioned latent features, transforming unobservable abnormal intentions into quantifiable feature indicators, thus filling the gap in existing technologies for detecting latent abnormal behaviors.

[0057] S103: Cluster the feature vectors of each user using a clustering algorithm, select data points that are neither core points nor covered by the neighborhood of any core point as noise points, and the users corresponding to the noise points are identified as risk users in the preliminary identification.

[0058] For abnormal users who collect and leak sensitive data in a piecemeal fashion, it is essential to first collect sensitive files and perform frequent file operations. In order to avoid detection, they often only collect a portion of the data each time, and operate over a long period of time to achieve the goal of collecting a large number of sensitive files. Its significant characteristic is that the terminal has frequent but low-volume file operations.

[0059] Based on this, this embodiment employs a density-based clustering algorithm (DBSCAN), which divides data points into clusters according to their density distribution. Utilizing density reachability (connected by chains formed through core objects) and density connectivity (density reachability relationships originating from the same core object), all points density-connected to core objects are grouped into a single cluster, while points not density-connected to any core object are considered noise. The DBSCAN algorithm does not require pre-setting the number of clusters, can identify clusters of arbitrary shapes, and can automatically label noise points.

[0060] The specific implementation process is as follows: (1) Initially set the neighborhood radius and minimum number of neighborhood points of the DBSCAN algorithm. Use each user's IP features 1-9 and features 11-13 to form a feature vector to form data points and initialize the data features; multiple data points corresponding to each user can be obtained by extracting historical data through S101.

[0061] (2) Randomly select an unvisited data point p, and calculate the number of points (including data point p itself) contained in the neighborhood of the neighborhood radius centered on p; The distance between data points is calculated using Euclidean distance: In n-dimensional space, suppose there are two data points x (x1, x2, …, x…). n ) and y (y1, y2, …, y n The Euclidean distance between them is: ; (3) Expand the cluster traversal data points: If the number of points within the neighborhood radius of a data point is greater than the minimum number of neighborhood points, that point is a core point. A new cluster is created, all points within its neighborhood are marked, and all points within its neighborhood are added to the current cluster. For each newly added point: if it is a core point, its neighborhood is expanded. This process is repeated until no further expansion is possible.

[0062] (4) Repeat steps (2) and (3) above until all points have been visited.

[0063] (5) If there is a data point that is neither a core point nor covered by the neighborhood of any core point, it is a noise point and is marked as a noise point; the user corresponding to the noise point is the risk user initially identified.

[0064] In this embodiment, users who collect files frequently and have a large total number of files will be identified as risky users in the initial identification, and these users are at risk of sensitive file leakage.

[0065] This embodiment utilizes the density-sensitive clustering characteristics of the DBSCAN algorithm to automatically identify risky user groups with abnormal accumulation of sensitive data without the need for a preset anomaly threshold, thus solving the problem of traditional threshold methods missing detection of complex anomaly patterns.

[0066] S104: Combine the behavioral sequence of the initially identified risky users, the behavioral time entropy, and the current file processing depth score data to form a behavioral sequence; input the behavioral sequence into the pre-trained abnormal behavior sequence detection model, and output the abnormal user detection results.

[0067] In this embodiment, to identify the periodic, hidden, and long-term significant features of data leakage in a "spreading like ants" manner, and to capture the temporal correlation between "surface behavior + latent features," a Long Short-Term Memory (LSTM) network algorithm is used for detection. The LSM algorithm can capture the temporal dependencies of behavioral sequences, is suitable for long-sequence behavioral data, possesses dynamic pattern learning capabilities, and automatically uncovers hidden abnormal patterns.

[0068] The specific implementation process is as follows: (1) First, construct the user's behavioral sequence features: By combining the behavioral sequence of feature 10 with the behavioral temporal entropy of feature 12 and the real-time calculated value of the file processing depth score of feature 13, a user's behavioral sequence feature is constructed.

[0069] The format of each behavior sequence feature is: [Unix timestamp, behavior sequence type (enumerated value), behavior time entropy, current file processing depth score]. Here, the Unix timestamp is the timestamp when the behavior occurred, such as the time when a file download occurred; the behavior type refers to the specific behavior sequence, such as file download, compression, or outgoing; the behavior time entropy refers to the behavior time entropy on the day the behavior occurred; and the current file processing depth score refers to the score given to the operation chain of the file corresponding to the current behavior sequence, determined according to the aforementioned processing depth scoring rules.

[0070] (2) Standardize the behavioral sequence features, convert the timestamps to Unix timestamps, and use z-score to standardize the behavior types (represented by enumeration values) and numerical features to ensure that the numerical features are at the same level, forming a structured behavioral record that the model can input.

[0071] Specifically, all timestamps are converted to Unix timestamp format to ensure the entire system uses the same time precision; a behavior type mapping dictionary is created, assigning a unique enumeration value to each behavior and replacing the original behavior description with the corresponding numeric code; different behavior fields are standardized to have the same field; and missing values ​​are represented by a uniform specific value of -1.

[0072] (3) Model building and training: This embodiment uses a Long Short-Term Memory (LSTM) network model as the abnormal behavior sequence detection model. The model design consists of an input layer, hidden layers, and an output layer. The input layer receives the behavior sequence features, with the input dimension being the same as the behavior sequence feature dimension. The hidden layer consists of five layers: the first LSTM layer has 64 neurons to extract temporal features; the second dropout layer has a dropout rate of 20% to prevent overfitting; the third is an attention layer that focuses on key temporal steps; the fourth Dense layer has 32 neurons for feature transformation; and the fifth Dropout layer further prevents overfitting. The output layer uses a sigmoid activation function to output a single probability value, representing the confidence that the subsequence belongs to an abnormal pattern.

[0073] Construct a model training dataset and label abnormal behavior sequence samples based on expert experience, such as: file access -> file compression -> file forwarding to an unknown IP; or file compression -> copying via USB flash drive or other storage media. Divide the training and validation sets into an 8:2 ratio and employ a class balancing strategy to avoid model bias.

[0074] For newly generated user behavior sequence features within the current time period, a sliding window is used to extract and convert them into model input vectors. For example, the user's behavior sequence from the previous day, behavior time entropy, and file processing depth score can be obtained as model input vectors. The input vectors are then fed into a trained LSTM model, which outputs anomaly detection results. If the sequence is identified as an abnormal pattern, an alarm mechanism is triggered.

[0075] This embodiment leverages the LSTM algorithm's ability to capture temporal dependencies, deeply mining the dynamic evolution patterns of user behavior sequences and the temporal correlations between behaviors, accurately distinguishing between accidental anomalies and malicious behavior, and overcoming the limitations of single feature analysis.

[0076] By combining the DBSCAN and LSTM algorithms, the depth and breadth of anomaly identification are improved while ensuring detection efficiency, significantly reducing false alarm and false negative rates, and enhancing the system's ability to perceive and respond to abnormal behavior.

[0077] Example 2 In one or more embodiments, an abnormal user detection system based on behavioral sequences is disclosed, comprising: The data acquisition module is configured to: acquire and preprocess user file operation-related behavior data within a historical time period; The feature extraction module is configured to extract the basic features and latent features of each user, form a feature vector, and treat it as a data point; the latent features include file fragment correlation, behavior time entropy, and file processing depth deviation. The risk user preliminary identification module is configured to: cluster the feature vectors of each user using a clustering algorithm, select data points that are neither core points nor covered by the neighborhood of any core point as noise points, and the users corresponding to the noise points are identified as risk users in the preliminary identification. The abnormal user localization module is configured to: combine the behavioral sequence, behavioral time entropy, and current file processing depth score data of the initially identified risky users into behavioral sequence features; input the behavioral sequence features into the pre-trained abnormal behavior sequence discovery model, and output the abnormal user detection results.

[0078] The specific implementation methods of the above modules are exactly the same as those in Example 1, and will not be described in detail again.

[0079] Example 3 In one or more embodiments, a terminal device is disclosed, comprising a processor and a memory, wherein the processor is used to implement instructions; and the memory is used to store multiple instructions adapted to be loaded by the processor and executed by the abnormal user detection method based on behavior sequence as described in Embodiment 1.

[0080] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0081] Memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of memory may also include non-volatile random access memory. For example, memory may also store information about the device type.

[0082] In the implementation process, each step of the above method can be completed by the integrated logic circuits in the processor hardware or by software instructions.

[0083] Example 4 In one or more embodiments, a computer-readable storage medium is disclosed, wherein a plurality of instructions are stored, the instructions being adapted to be loaded by a processor of a terminal device and executed by the abnormal user detection method based on behavior sequence described in Embodiment 1.

[0084] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. An abnormal user detection method based on behavioral sequences, characterized in that, include: Acquire and preprocess user file operation data within a historical time period; Extract the basic and latent features of each user separately. The features are composed of a feature vector and treated as a data point; the latent features include file fragment correlation, behavioral temporal entropy, and file processing depth deviation. The feature vectors of each user are clustered using a clustering algorithm. Data points that are neither core points nor covered by the neighborhood of any core point are selected as noise points. The users corresponding to the noise points are identified as risk users in the preliminary identification. The behavioral sequence features are composed of the behavioral sequence, behavioral temporal entropy, and current file processing depth score data of the initially identified high-risk users. The behavioral sequence features are input into a pre-trained abnormal behavior sequence detection model, which outputs abnormal user detection results.

2. The abnormal user detection method based on behavioral sequences as described in claim 1, characterized in that, The basic features include: the number of files downloaded by the user's IP address each day, the number of times files were downloaded, the total size of downloaded files, the number of files uploaded, the number of times files were uploaded, the total size of uploaded files, the number of files operated on locally, the number of times files were operated on locally, the total size of files operated on locally, and the sequence of file operation actions performed by the user each day in chronological order.

3. The abnormal user detection method based on behavioral sequences as described in claim 1, characterized in that, The file fragment correlation feature is used to quantify the content correlation between different file fragments operated by the same user. The specific calculation process is as follows: For each file, extract local segment fingerprints from the header, middle, and tail. Calculate the cosine similarity of segment fingerprints between files operated by the same user within a set time period. Count the number of file pairs with similarity greater than a set value within the period, divide by the total number of files operated on in the same period, and obtain the file segment association characteristics.

4. The abnormal user detection method based on behavioral sequences as described in claim 1, characterized in that, The behavioral temporal entropy feature is used to quantify the disorder of the time distribution of user-sensitive file operations. The specific calculation process is as follows: Divide the time window, count the percentage of sensitive file operations in each window to form a percentage distribution; calculate the information entropy of the percentage distribution to obtain the behavioral time entropy feature.

5. The abnormal user detection method based on behavioral sequences as described in claim 1, characterized in that, The file processing depth deviation is used to quantify the user's processing depth of sensitive files. The specific calculation process is as follows: For each sensitive file's complete operation chain, a quantitative scoring standard is set according to the file's usage level. All sensitive files operated by a single user within a set time period are statistically analyzed, and the processing depth score for each file is calculated. The average score is taken as the user's average processing depth score, and the difference between the user's average processing depth score and the benchmark data is calculated as the processing depth deviation.

6. The abnormal user detection method based on behavioral sequences as described in claim 1, characterized in that, The feature vectors of each user are clustered using a clustering algorithm, specifically as follows: A density-based clustering algorithm is used to cluster the feature vectors of each user; the specific process is as follows: Set the neighborhood radius and the minimum number of neighborhood points. Randomly select an unvisited data point p and calculate the number of points contained within the neighborhood radius centered on p. If the number is greater than the minimum number of neighborhood points, then take point P as the core point, create a new cluster, and add all points in its neighborhood to the current cluster. For each newly added point, if it is a core point, continue to expand its neighborhood; repeat this process until it can no longer be expanded. Repeat the above process until all data points have been accessed.

7. The abnormal user detection method based on behavioral sequences as described in claim 1, characterized in that, The abnormal behavior sequence discovery model uses a long short-term memory network model to deeply mine temporal dependencies and focus on key hidden abnormal nodes through an attention layer.

8. An abnormal user detection system based on behavioral sequences, characterized in that, include: The data acquisition module is configured to: acquire and preprocess user file operation-related behavior data within a historical time period; The feature extraction module is configured to extract the basic and latent features for each user, respectively. The features are composed of a feature vector and treated as a data point; the latent features include file fragment correlation, behavioral temporal entropy, and file processing depth deviation. The risk user preliminary identification module is configured to: cluster the feature vectors of each user using a clustering algorithm, select data points that are neither core points nor covered by the neighborhood of any core point as noise points, and the users corresponding to the noise points are identified as risk users in the preliminary identification. The abnormal user location module is configured to combine the behavioral sequence, behavioral time entropy, and current file processing depth score data of the initially identified risky users into behavioral sequence features; The behavioral sequence features are input into a pre-trained abnormal behavior sequence detection model, which outputs abnormal user detection results.

9. A terminal device comprising a processor and a memory, the processor for implementing instructions; the memory for storing multiple instructions, characterized in that, The instructions are adapted to be loaded by a processor and executed by the abnormal user detection method based on behavioral sequences according to any one of claims 1-7.

10. A computer-readable storage medium storing a plurality of instructions, characterized in that, The instructions are adapted to be loaded by the processor of the terminal device and executed by the abnormal user detection method based on behavioral sequences as described in any one of claims 1-7.

Images