User behavior legality detection method based on hierarchical multi-feature fusion Markov matrix

Abstract

The invention relates to the technical field of computers, and discloses a user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix, which comprises the following steps: a client adds a user local operation log burying point on a key business interface and a page; the client side reports a local operation log of a user while sending a service interface request to the API gateway, and the log is subjected to unified formatting processing and stored in a data warehouse; and constructing a state space, mapping the URL route of each page into a state, and automatically completing the construction of the state space through a specific processing flow. The user behavior characteristics are layered and fused into the Markov model, so that the complexity of the user behaviors can be more comprehensively captured. The construction process not only comprises traditional URL routing jump information, but also integrates multi-dimensional features such as user operation behaviors, time sequences, equipment network information and user portraits.

Description

Technical Field

[0001] This invention relates to the field of computer technology, specifically to a method for detecting the legitimacy of user behavior based on a hierarchical multi-feature fusion Markov matrix. Background Technology

[0002] In today's increasingly complex and diversified internet business environment, the legality and compliance verification of user behavior has become a crucial link in ensuring business security, improving user experience, and maintaining a healthy platform ecosystem. With the booming development of various internet applications, user behavior patterns have become highly complex and diverse. From simple page browsing and information retrieval to complex online transactions and social interactions, the scope and depth of user behavior are constantly expanding. However, at the same time, malicious user behavior is also gradually emerging, such as web scraping and malicious order placement. These behaviors not only damage the normal operation of internet businesses but also bring a poor user experience to legitimate users.

[0003] Traditional Markov models have several limitations in the field of user behavior legitimacy detection. On one hand, they rely solely on the frequency of URL routing, a single-dimensional approach that fails to capture the rich details of user behavior in modern internet businesses. For example, crucial contextual information such as device fingerprints, actual user actions, and time-series characteristics are completely ignored, resulting in a severe deficiency in the model's ability to identify abnormal behavior. On the other hand, traditional Markov models struggle to accurately distinguish between "low-frequency but reasonable" long-tail paths and "high-frequency but suspicious" batch paths. In actual business operations, some niche but perfectly reasonable user behavior paths are often misjudged as abnormal due to data sparsity; while some meticulously designed malicious behavior paths can successfully bypass detection mechanisms by simulating normal paths through high-frequency requests.

[0004] Furthermore, existing technologies are particularly inadequate when dealing with business changes and cold start scenarios. When business logic changes, leading to new URL routes, traditional models cannot dynamically update their state space in a timely manner, thus failing to effectively determine the legitimacy of new session paths. This limitation makes it difficult for the model to maintain consistent detection performance when facing rapidly iterating internet businesses.

[0005] In summary, existing technologies have significant shortcomings in multi-dimensional feature fusion, dynamic adaptation to business changes, and accurate identification of abnormal behavior. Therefore, those skilled in the art propose a user behavior legitimacy detection method based on a hierarchical multi-feature fusion Markov matrix to address these issues. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix, which solves the problems mentioned in the background.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix, comprising the following steps: Add local user operation log tracking points to key business interfaces and pages on the client side; While sending a business interface request to the API gateway, the client also reports the user's local operation logs. These logs are then formatted and stored in a data warehouse. Construct a state space by mapping the URL route of each page to a state. The construction of the state space is completed automatically through a specific processing flow, which solves the problem of coarseness of state granularity and the problem of adding or removing state nodes due to business changes. Based on the pre-constructed state set, a hierarchical Markov matrix is ​​constructed, which includes a directly observable URL routing transition layer and a feature fusion layer corresponding to the relevant transition paths; Multiple feature metrics are extracted from candidate transitions, including state transition features, user local operation features, time series features, device and network features, and user profile features. A scoring function is defined for each type of feature, and a feature weight vector is defined. The feature scores are then fused using the weight vector to obtain the final transfer score. The calculation formula for the scoring function is as follows: ; in, Indicates from state Transition to state The final score, It is the first Weights of class features It is the first Class features for state Transition to state The score, It is the total number of features; During the cold start phase, equal weights are assigned to each dimension of the feature weight vector. After manual review and annotation data generation, the vector parameters are trained using the relevant prediction model. During the detection phase, the legality of user session paths is checked based on the target detection path length set by the system administrator, and the overall path anomaly score is calculated according to the judgment rules.

[0008] By integrating multiple dimensions of feature indicators, such as state transition features, user local operation features, time series features, device and network features, and user profile features, the above technical solutions can comprehensively capture the complexity and diversity of user behavior, thereby more accurately identifying abnormal behavior. By automatically constructing a state space, the URL routing of each page is mapped to a state, and the state nodes are dynamically adjusted according to business changes. This solves the problems of state granularity and the increase or decrease of state nodes caused by business changes, thus improving the adaptability and flexibility of the model.

[0009] Preferably, the specific processing flow for constructing the state space includes: Collect business interface request data and user local operation log data; The collected data is preprocessed to extract URL routing information and user behavior-related feature information; Based on business logic and data distribution, determine the state granularity and group page URLs with similar characteristics or functions into the same state to avoid state explosion or loss of important transfer information. Based on business changes, the state space is dynamically adjusted. When a new URL route request appears, a new state node is automatically identified and added. When some URL routes are no longer used, the corresponding state nodes are removed accordingly.

[0010] The above technical solution, through the automated construction of the state space processing flow, effectively collects and preprocesses business interface request data and user local operation log data, and accurately extracts URL routing information and user behavior feature information. State granularity is determined based on business logic and data distribution, and similar URL routes are reasonably categorized, effectively preventing state explosion or loss of important information.

[0011] Preferably, the feature weight vector is trained as follows: Collect user session path data that has been manually reviewed and labeled as training samples, which includes normal behavior paths and abnormal behavior paths; Extract multi-dimensional feature indicators for each candidate transition from the training samples and calculate the corresponding score; By utilizing the labeled information and feature scores of the training samples, a feature weight vector is obtained through machine learning algorithms, enabling the model to better distinguish between normal and abnormal behavior.

[0012] The above technical solution collects user session path data that has been manually reviewed and labeled as training samples, covering both normal and abnormal behavior paths, and extracts multi-dimensional feature indicators to calculate corresponding scores. Using the labeled information of the training samples combined with the feature scores, a feature weight vector is obtained through machine learning algorithm training, optimizing the model's ability to identify the legality of behavior and enhancing its effectiveness in distinguishing between normal and abnormal behavior.

[0013] Preferably, in the feature scoring and fusion, the scoring system of the scoring function consists of a rule layer and a statistical layer, wherein: The rule layer explicitly defines anomaly identification rules that do not conform to system requirements and common sense, such as accessing using values ​​in the proxy IP address blacklist, or URL request intervals that are significantly shorter than the normal range of human behavior. When a candidate transfer meets the anomaly rules of the rule layer, it is given a higher rule layer score. The statistical layer relies on the distribution statistics of the feature data to determine whether the detected feature value is an outlier. An adaptive Z-score outlier calculation method is used, and the formula for calculating the score of the k-th feature class is: ; in, The rule layer score represents the relevant features. The adaptive Z-score measures the degree to which eigenvalues ​​deviate from the normal distribution.

[0014] The specific formula for calculating the adaptive Z-score is as follows, for a given feature sample. First, skewness detection is performed on the data sample X, and the sample data is then transformed. The transformed data... The calculation formula is as follows: ; .

[0015] Through the aforementioned technical solution, the feature scoring and fusion mechanism effectively identifies abnormal features in user behavior by constructing a scoring system comprising a rule layer and a statistical layer. The rule layer pre-defines explicit rules for abnormal behavior, such as accessing the site using a proxy IP blacklist or abnormal URL request intervals. Once a candidate request matches these rules, it is assigned a higher score, ensuring that obvious abnormal behavior is quickly flagged. The statistical layer, based on the distribution statistics of feature data, uses an adaptive Z-score method to calculate the deviation of feature values, accurately quantifying the abnormality of the features. This two-layer scoring system enables the model to comprehensively evaluate behavioral features from different dimensions, significantly improving the accuracy and response speed in identifying abnormal behavior.

[0016] Preferably, the specific rules for calculating the overall path anomaly score during the detection phase are as follows: Assuming the path length is n, the anomalies of the i-th sub-path are categorized as follows: , , where 1 represents a clear anomaly, when and The time indicates a suspected abnormality, when This indicates that the time is normal; if ,in If the overall path anomaly score S=1, it indicates that the path is clearly abnormal; otherwise, the overall path anomaly score is... This indicates that the degree of abnormality of the path is the average of the abnormality scores of each sub-path.

[0017] By employing the aforementioned technical solution and calculating an overall path anomaly score using specific rules, the legitimacy of user session paths can be accurately assessed. Specifically, the rule first categorizes the degree of anomaly for each sub-path within the path: explicit anomalies are marked as 1, suspected anomalies are marked as values ​​between 0.5 and 1, and normal behavior is marked as a value not exceeding 0.5. Next, if any sub-path is determined to be explicitly anomaly, the overall path anomaly score is 1, directly indicating that the path contains an explicit anomaly. Conversely, if the anomaly scores of all sub-paths in the path do not meet the explicit anomaly standard, the anomaly degree of the overall path is determined by calculating the average of the anomaly scores of each sub-path. This method not only quickly identifies paths with obvious anomalies but also quantitatively evaluates suspected anomaly paths, thus providing users with a comprehensive and detailed anomaly detection mechanism, effectively improving the accuracy and precision of detection.

[0018] Preferably, the user's local operation features include, but are not limited to, the user's click behavior sequence, swipe behavior sequence, and input behavior sequence on the page. By analyzing these operation sequences, the user's actual interaction on the page can be understood, thereby more accurately determining the legality of the user's behavior.

[0019] By analyzing the user's click, swipe, and input sequences on the page, the aforementioned technical solution accurately captures the user's actual interactive behavior, providing direct evidence for determining the legitimacy of user actions. This helps to effectively distinguish between normal user operations and simulated behavior by automated tools, thereby enhancing the accuracy and reliability of behavior legitimacy detection.

[0020] Preferably, the temporal features also include a sequence of time intervals between user jumps between different pages. By analyzing this sequence, the rhythm and habits of user page browsing can be captured, further assisting in determining whether user behavior is abnormal.

[0021] By analyzing the time interval sequence of user navigation between different pages using the above technical solution, this invention can capture the unique rhythm and habitual patterns of user page browsing. This analysis can provide important temporal dimension information for determining whether user behavior is abnormal, thereby enhancing the ability to identify abnormal behavior and improving the accuracy and effectiveness of behavior detection.

[0022] Preferably, the device and network features also include the user device's screen resolution, operating system version, and browser type. These features can reflect the user's device environment, and combined with other features, can more comprehensively assess the legitimacy of the user's behavior.

[0023] By analyzing device and network characteristics, including screen resolution, operating system version, and browser type, the aforementioned technical solutions can accurately reflect the user's device environment. Combined with other characteristics, this information can be used to build a more comprehensive user behavior profile, thereby more accurately identifying abnormal behavior and improving the comprehensiveness and accuracy of behavior legitimacy detection.

[0024] Preferably, the user profile features also include the user's login frequency, active time period, and preference settings. By constructing a detailed user profile, the user's normal behavior patterns can be understood, thereby more accurately identifying abnormal behaviors that deviate from the normal pattern.

[0025] By analyzing user profile features such as login frequency, active periods, and preference settings, the aforementioned technical solutions can construct detailed user behavior profiles. This allows for more accurate detection of abnormal behaviors that deviate from normal patterns, significantly improving the accuracy and effectiveness of behavior legitimacy detection.

[0026] This invention provides a user behavior legitimacy detection method based on a hierarchical multi-feature fusion Markov matrix. It has the following beneficial effects: 1. This invention captures the complexity of user behavior more comprehensively by layering and fusing user behavior features into a Markov model. This construction process not only includes traditional URL routing information but also integrates multi-dimensional features such as user operation behavior, time series data, device network information, and user profiles. This multi-layered feature fusion allows the model to analyze user behavior from different perspectives, thereby improving its ability to identify abnormal behavior. Furthermore, through dynamic adjustment of feature weight vectors and scoring functions, the model can adaptively optimize the importance of features, further enhancing the accuracy and robustness of detection.

[0027] 2. This invention can dynamically identify and adjust state space nodes based on business logic and data distribution. This automatic identification mechanism enables the model to adapt to URL routing changes brought about by business changes, effectively solving the cold start problem and enhancing the model's adaptability and flexibility. Through this automated node identification and adjustment, the model can more accurately map user behavior states, thereby maintaining high detection performance in different business scenarios. This method not only improves the model's practicality but also reduces the need for manual intervention and lowers maintenance costs. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating the data collection and aggregation phase of the present invention. Figure 2 This is a schematic diagram of the automated construction process of state space nodes in this invention; Figure 3 This is a schematic diagram illustrating the hierarchical Markov matrix structure and the correlation of transition path features in this invention; Figure 4 This is a schematic diagram of the adaptive Z-score outlier calculation process of the feature scoring statistics layer of this invention. Detailed Implementation

[0029] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Please see the appendix Figure 1 - Appendix Figure 4 This invention provides a method for detecting the legitimacy of user behavior based on a hierarchical multi-feature fusion Markov matrix, comprising the following steps: Add local user operation log tracking points to key business interfaces and pages on the client side; While the client sends a business interface request to the API gateway, it also reports the user's local operation logs. The logs are uniformly formatted and stored in the data warehouse. Specifically, the first requirement is to add local user operation log tracking points to key business interfaces and pages on the client side. This involves inserting code at critical points of user interaction with the application to capture specific user actions on the client side, such as clicks, browsing, and input, thereby generating corresponding operation logs. These operation logs record in detail the user's behavioral trajectory and operating habits within the application.

[0031] Next, when the client sends a business interface request to the API gateway, it synchronously reports the previously recorded local user operation logs. During the reporting process, these logs are formatted into a uniform format to facilitate subsequent data processing and analysis. Finally, the formatted log data is stored in a data warehouse, providing foundational data support for the subsequent construction and training of Markov models. This data will be used to analyze user behavior patterns, identify abnormal operations, and thus achieve the legitimacy detection of user behavior.

[0032] A state space is constructed, mapping each page's URL route to a state. This state space construction is automated through a specific processing flow, resolving issues of state granularity and the addition or removal of state nodes due to business changes. The specific processing flow for state space construction includes: Collect business interface request data and user local operation log data; The collected data is preprocessed to extract URL routing information and user behavior-related feature information; Based on business logic and data distribution, determine the state granularity and group page URLs with similar characteristics or functions into the same state to avoid state explosion or loss of important transfer information. Based on business changes, the state space is dynamically adjusted. When a new URL route request appears, a new state node is automatically identified and added. When some URL routes are no longer used, the corresponding state nodes are removed accordingly.

[0033] Specifically, raw information for constructing the state space is provided by collecting business interface request data and user local operation log data. Next, the data is preprocessed to extract URL routing information and user behavior characteristics, laying the foundation for defining the state space. Then, the state granularity is determined based on business logic and data distribution, grouping similar page URL routes into the same state to balance state granularity and prevent problems caused by too many or too few states. Finally, the state space is dynamically adjusted according to business changes, including automatically adding new state nodes and removing unused nodes, enabling the state space to adapt to business changes and ensuring the accuracy and usability of the model.

[0034] Based on the pre-constructed state set, a hierarchical Markov matrix is ​​constructed. The hierarchical Markov matrix includes a URL routing transition layer that can be directly observed and a feature fusion layer corresponding to the relevant transition paths. Specifically, based on the constructed set of states, a matrix is ​​created to represent the transition relationships between states. This matrix consists of two layers: one is a directly observed URL routing transition layer, which reflects the user's navigation behavior between different pages; the other is a feature fusion layer, which integrates multi-dimensional feature information related to the transition path, such as user operation behavior, time series, device information, etc. Through this hierarchical structure, the model can more comprehensively capture the complexity and diversity of user behavior, thereby improving the ability to identify abnormal behavior.

[0035] Multiple feature metrics are extracted from candidate transitions, including state transition features, user local operation features, time series features, device and network features, and user profile features. Specifically, state transition features focus on the frequency and patterns of user transitions between different pages or operational states. For example, does the frequency of jumping from the product details page to the shopping cart conform to normal shopping behavior patterns? Local user operation features delve into the specific interactive behaviors of users on the page, such as the sequence and frequency of clicks, swipes, and input, to determine whether the operations conform to human behavioral habits. Temporal features involve time-dimensional information such as the time intervals and dwell times of user operations. For example, is the time a user spends on a certain page too short or too long, thus identifying possible automated script behaviors. Device and network features cover information such as device type, operating system, and network environment, used to detect whether abnormal devices or network environments are used, such as access from high-risk areas or the use of proxy IPs. User profile features construct user behavior profiles based on information such as user registration duration, payment history, and activity level, identifying abnormal behaviors that significantly deviate from the user's previous behavior patterns. By integrating these multi-dimensional features, potential malicious behaviors, such as web crawling and malicious order placement, can be detected and identified more accurately, thereby improving the accuracy and robustness of user behavior legitimacy detection.

[0036] Temporal features also include the time interval sequence of user jumps between different pages. Analyzing this sequence can capture the rhythm and habits of user page browsing, further assisting in determining whether user behavior is abnormal. Device and network features include the user's device screen resolution, operating system version, and browser type. These features reflect the device environment the user is using, and combined with other features, can more comprehensively assess the legitimacy of user behavior. User profile features also include the user's login frequency, active periods, and preference settings. By building detailed user profiles to understand the user's normal behavior patterns, abnormal behaviors that deviate from normal patterns can be identified more accurately.

[0037] Specifically, when analyzing candidate page transitions, feature indicators are extracted from multiple dimensions to comprehensively assess the legality and rationality of user behavior. Among these, temporal features not only focus on the frequency and path of user jumps between different pages, but also specifically examine the time interval sequence of these jumps. By analyzing the length and regularity of these time intervals, the rhythm and habits of user page browsing can be captured. For example, a normal user might spend some time thinking after reading an article, while automated tools such as web crawlers might quickly jump between pages in a short period. This analysis of time interval sequences helps to further assist in judging whether user behavior is abnormal, thereby effectively identifying automated script behavior.

[0038] Device and network features delve into information such as screen resolution, operating system version, and browser type of the user's device. These features reflect the user's device environment. For example, certain malicious behaviors may use specific devices or browser versions to launch attacks, or access from abnormal network environments may increase the suspiciousness of the behavior. Combined with other features, device and network features can more comprehensively assess the legitimacy of user behavior, providing richer judgment criteria for the model. User profile features construct detailed user profiles by analyzing information such as user login frequency, active periods, and preference settings.

[0039] A scoring function is defined for each type of feature, and a feature weight vector is defined. The feature scores are then fused using the weight vector to obtain the final transfer score. The formula for calculating the scoring function is as follows: ; in, Indicates from state Transition to state The final score, It is the first Weights of class features It is the first Class features for state Transition to state The score, It is the total number of features; During the cold start phase, equal weights are assigned to each dimension of the feature weight vector. After manual review and annotation of the data, the vector parameters are trained using a relevant prediction model. The training method for the feature weight vector is as follows: Collect user session path data that has been manually reviewed and labeled as training samples, which includes normal behavior paths and abnormal behavior paths; Specifically, in the cold start phase of this invention, each dimension of the feature weight vector is initially assigned equal weights to ensure that the model can balance the potential impact of each feature on the legality judgment of user behavior even in the absence of historical data. As the system runs, after manual review and the generation of labeled data, this labeled data, which includes normal and abnormal behavior paths, is used as training samples. The feature weight vector is trained through a relevant prediction model to optimize the parameters of the feature weight vector, thereby improving the model's accuracy in detecting the legality of user behavior.

[0040] Extract multi-dimensional feature indicators for each candidate transition from the training samples and calculate the corresponding score; By utilizing the labeled information and feature scores of the training samples, a feature weight vector is obtained through machine learning algorithms, enabling the model to better distinguish between normal and abnormal behavior.

[0041] During the detection phase, the legality of user session paths is checked based on the target detection path length set by the system administrator, and the overall path anomaly score is calculated according to the judgment rules.

[0042] Specifically, in the training phase of this invention, multi-dimensional feature indicators for each candidate transition in the training samples are first extracted, and the corresponding scores are calculated. These feature indicators include, but are not limited to, state transition features, user local operation features, temporal features, device and network features, and user profile features. By calculating the score of each feature in distinguishing between normal and abnormal behavior, basic data is provided for subsequent feature weight vector training. Next, using the labeled information of the training samples (i.e., known normal and abnormal behavior paths) and the calculated feature scores, the feature weight vector is trained using a selected machine learning algorithm. This process aims to optimize the parameters of the feature weight vector, enabling the model to more accurately identify and distinguish between normal and abnormal behavior.

[0043] During the detection phase, the system administrator can set the target detection path length, and this invention uses this length to detect the legality of user session paths. A specific rule is applied to calculate the overall path anomaly score: if the anomaly score of any sub-path in the path is the highest value of 1, then the overall path anomaly score is 1, indicating that the path is clearly abnormal; otherwise, the overall path anomaly score is the average of the anomaly scores of each sub-path. This quantifies the degree of path anomaly and achieves an effective assessment of the legality of user behavior.

[0044] The specific rules for calculating the overall path anomaly score during the detection phase are as follows: Assuming the path length is n, the anomalies of the i-th sub-path are categorized as follows: , , where 1 represents a clear anomaly, when and The time indicates a suspected abnormality, when This indicates that the time is normal; if ,in If the overall path anomaly score S=1, it indicates that the path is clearly abnormal; otherwise, the overall path anomaly score is... This indicates that the degree of abnormality of the path is the average of the abnormality scores of each sub-path.

[0045] In feature scoring and fusion, the scoring system of the scoring function consists of a rule layer and a statistical layer, wherein: The rule layer explicitly defines anomaly identification rules that do not conform to system requirements and common sense, such as accessing using values ​​in the proxy IP address blacklist, or URL request intervals that are significantly shorter than the normal range of human behavior. When a candidate transfer meets the anomaly rules of the rule layer, it is given a higher rule layer score. Specifically, the rule layer is used to define anomaly identification rules that do not conform to system requirements and common sense. For example, when abnormal behavior such as accessing using values ​​from a proxy IP address blacklist or URL request intervals significantly shorter than the normal range of human behavior is detected, the rule layer will identify these behaviors. Once a candidate transfer meets the preset abnormal rules in the rule layer, the behavior will be assigned a higher rule layer score, indicating that it has a high suspicion of being abnormal. This mechanism ensures that the system can quickly identify and label abnormal behaviors that clearly violate regulations or common sense, thereby improving the model's efficiency and accuracy in detecting abnormal behavior.

[0046] In feature scoring and fusion, the scoring system of the scoring function consists of a rule layer and a statistical layer, wherein: The rule layer explicitly defines anomaly identification rules that do not conform to system requirements and common sense, such as accessing using values ​​in the proxy IP address blacklist, or URL request intervals that are significantly shorter than the normal range of human behavior. When a candidate transfer meets the anomaly rules of the rule layer, it is given a higher rule layer score. The statistical layer relies on the distribution statistics of the feature data to determine whether the detected feature value is an outlier, employing an adaptive Z-score outlier calculation method. The formula for calculating the score of the k-th class feature is: ; in, The rule layer score represents the relevant features. The adaptive Z-score measures the degree to which eigenvalues ​​deviate from the normal distribution.

[0047] The specific formula for calculating the adaptive Z-score is as follows, for a given feature sample. First, skewness detection is performed on the data sample X, and the sample data is then transformed. The transformed data... The calculation formula is as follows: ;

[0048] ; User local operation characteristics include, but are not limited to, user click behavior sequences, swipe behavior sequences, and input behavior sequences on the page. By analyzing these operation sequences, we can understand the user's actual interaction on the page, thereby more accurately judging the legitimacy of the user's behavior.

[0049] Specifically, user local operation characteristics encompass various user interactions on the page, including but not limited to click sequences, swipe sequences, and input sequences. By analyzing these operation sequences in detail, the user's operational trajectory and interaction patterns on the page can be accurately reconstructed, leading to a deeper understanding of the user's true intentions and behavioral habits. Normal user operations are typically coherent and logical, while malicious automated tools may exhibit high-frequency, irregular click or swipe behaviors. This invention, through feature extraction and analysis of these operation sequences, can effectively identify abnormal operations that significantly differ from normal user behavior patterns, thereby more accurately determining the legitimacy of user behavior and providing strong support for detecting and preventing malicious behavior.

[0050] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix, characterized in that, Includes the following steps: Add local user operation log tracking points to key business interfaces and pages on the client side; While sending a business interface request to the API gateway, the client also reports the user's local operation logs. These logs are then formatted and stored in a data warehouse. Construct a state space by mapping the URL route of each page to a state. The construction of the state space is completed automatically through a specific processing flow, which solves the problem of coarseness of state granularity and the problem of adding or removing state nodes due to business changes. Based on the pre-constructed state set, a hierarchical Markov matrix is ​​constructed, which includes a directly observable URL routing transition layer and a feature fusion layer corresponding to the relevant transition paths; Multiple feature metrics are extracted from candidate transitions, including state transition features, user local operation features, time series features, device and network features, and user profile features. A scoring function is defined for each type of feature, and a feature weight vector is defined. The feature scores are then fused using the weight vector to obtain the final transfer score. The calculation formula for the scoring function is as follows: ； in, Indicates from state Transition to state The final score, It is the first Weights of class features It is the first Class features for state Transition to state The score, It is the total number of features; During the cold start phase, equal weights are assigned to each dimension of the feature weight vector. After manual review and annotation data generation, the vector parameters are trained using the relevant prediction model. During the detection phase, the legality of user session paths is checked based on the target detection path length set by the system administrator, and the overall path anomaly score is calculated according to the judgment rules.

2. The user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix according to claim 1, characterized in that, The specific processing flow for constructing the state space includes: Collect business interface request data and user local operation log data; The collected data is preprocessed to extract URL routing information and user behavior-related feature information; Based on business logic and data distribution, determine the state granularity and group page URLs with similar characteristics or functions into the same state to avoid state explosion or loss of important transfer information. Based on business changes, the state space is dynamically adjusted. When a new URL route request appears, a new state node is automatically identified and added. When some URL routes are no longer used, the corresponding state nodes are removed accordingly.

3. The user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix according to claim 1, characterized in that, The training method for the feature weight vector is as follows: Collect user session path data that has been manually reviewed and labeled as training samples, which includes normal behavior paths and abnormal behavior paths; Extract multi-dimensional feature indicators for each candidate transition in the training samples and calculate the corresponding score; By utilizing the labeled information and feature scores of the training samples, a feature weight vector is obtained through machine learning algorithms, enabling the model to better distinguish between normal and abnormal behavior.

4. The user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix according to claim 1, characterized in that, In the aforementioned feature scoring and fusion, the scoring system of the scoring function consists of a rule layer and a statistical layer, wherein: The rule layer explicitly defines anomaly identification rules that do not conform to system requirements and common sense, such as accessing using values ​​in the proxy IP address blacklist, or URL request intervals that are significantly shorter than the normal range of human behavior. When a candidate transfer meets the anomaly rules of the rule layer, it is given a higher rule layer score. The statistical layer relies on the distribution statistics of the feature data to determine whether the detected feature value is an outlier. An adaptive Z-score outlier calculation method is used, and the formula for calculating the score of the k-th feature class is: ； in, The rule layer score represents the relevant features. The adaptive Z-score measures the degree to which feature values ​​deviate from the normal distribution. The specific formula for calculating the adaptive Z-score is as follows, for a given feature sample. First, skewness detection is performed on the data sample X, and the sample data is then transformed. The transformed data... The calculation formula is as follows: ； 。 5. The user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix according to claim 1, characterized in that, The specific rules for calculating the overall path anomaly score during the detection phase are as follows: Assuming the path length is n, the anomalies of the i-th sub-path are categorized as follows: , , where 1 represents a clear anomaly, when and The time indicates a suspected abnormality, when This indicates that the time is normal; if ,in If the overall path anomaly score S=1, it indicates that the path is clearly abnormal; otherwise, the overall path anomaly score is... This indicates that the degree of abnormality of the path is the average of the abnormality scores of each sub-path.

6. The user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix according to claim 1, characterized in that, The user's local operation features include, but are not limited to, the user's click behavior sequence, swipe behavior sequence, and input behavior sequence on the page. By analyzing these operation sequences, we can understand the user's actual interaction on the page, thereby more accurately determining the legality of the user's behavior.

7. The user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix according to claim 1, characterized in that, The temporal features also include the time interval sequence of user jumps between different pages. By analyzing this sequence, the rhythm and habits of user page browsing can be captured, which can further help to determine whether user behavior is abnormal.

8. The user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix according to claim 1, characterized in that, The device and network characteristics also include the user's device screen resolution, operating system version, and browser type. These characteristics can reflect the device environment used by the user, and combined with other characteristics, can more comprehensively assess the legitimacy of the user's behavior.

9. The user behavior legality detection method based on a hierarchical multi-feature fusion Markov matrix according to claim 1, characterized in that, The user profile features also include the user's login frequency, active time period, and preference settings. By constructing detailed user profiles, we can understand the user's normal behavior patterns and thus more accurately identify abnormal behaviors that deviate from the normal pattern.

Images