Multi-scale user behavior anomaly detection method, system and electronic device

Abstract

The application discloses a multi-scale user behavior anomaly detection method and system based on unsupervised learning and an electronic device, and comprises the following steps: S1, acquiring user behavior data, and constructing multi-scale user behavior features, including user long-term behavior statistical features and user short-term operation sequence features; S2, performing hierarchical anomaly detection based on an unsupervised learning model for user behavior features of different scales to obtain anomaly evaluation results; S3, comprehensively processing the anomaly evaluation results corresponding to the different scales to generate a comprehensive anomaly score, quantifying the user behavior features of different scales to generate an anomaly contribution degree; and S4, determining whether the user behavior is an abnormal behavior according to the comprehensive anomaly score, and outputting the anomaly contribution degree. The technical scheme disclosed by the application can depict user behavior features comprehensively, effectively identify user behavior anomalies of different time scales, and has high interpretability and strong adaptability without relying on labeled data.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and more specifically, it relates to a multi-scale user behavior anomaly detection method based on unsupervised learning; this invention also relates to a multi-scale user behavior anomaly detection system based on unsupervised learning; this invention also relates to an electronic device. Background Technology

[0002] User behavior anomaly detection is a key technology in information security. It involves analyzing users' daily operational behaviors in network and system environments to identify abnormal activities that significantly deviate from normal behavior patterns. Traditional user behavior anomaly detection methods mainly include rule-based and statistical model-based methods. These suffer from high false positive rates, insufficient model generalization ability, and limited ability to identify unknown abnormal behaviors when user behavior patterns are complex, diverse, and dynamically changing over time. In recent years, machine learning-based user behavior anomaly detection methods have gained increasing attention. However, supervised learning-based methods face challenges in practical security scenarios, including a limited number of abnormal samples and high manual annotation costs. To reduce reliance on labeled data, semi-supervised learning-based anomaly detection methods have been proposed, and further, unsupervised learning-based methods have been proposed that fundamentally avoid dependence on labeled data.

[0003] Currently, unsupervised learning-based anomaly detection methods still have certain limitations. On the one hand, in the feature extraction and modeling process, existing unsupervised anomaly detection methods mostly use single-scale behavioral features for analysis, which limits their ability to characterize abnormal behavior in complex behavioral scenarios. On the other hand, in terms of anomaly scoring and judgment mechanisms, existing unsupervised anomaly detection methods usually output an overall anomaly score based on a single model, resulting in weak interpretability of the anomaly results and limited ability to distinguish between different types of abnormal behavior, affecting the effectiveness and traceability of anomaly detection results.

[0004] Therefore, how to provide a multi-scale user behavior anomaly detection method based on unsupervised learning that can comprehensively characterize user behavior features without relying on labeled data, effectively identify user behavior anomalies at different time scales, and possess high interpretability and strong adaptability has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a multi-scale user behavior anomaly detection method based on unsupervised learning. This method can comprehensively characterize user behavior features without relying on labeled data, effectively identify user behavior anomalies at different time scales, and possesses high interpretability and strong adaptability.

[0006] The technical solution provided by this invention is as follows:

[0007] This invention provides a multi-scale user behavior anomaly detection method based on unsupervised learning. The method includes: S1: acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data. The construction of multi-scale user behavior features includes at least constructing long-term user behavior statistical features and constructing short-term user operation sequence features; S2: performing hierarchical anomaly detection based on an unsupervised learning model for user behavior features at different scales to obtain anomaly evaluation results corresponding to different scales. The hierarchical anomaly detection includes at least long-term anomaly detection based on a variational autoencoder and short-term anomaly detection based on a conditional diffusion model. The input of the conditional diffusion model includes the output of the variational autoencoder; S3: comprehensively processing the anomaly evaluation results corresponding to different scales to generate a comprehensive anomaly score, and quantifying the anomaly contribution of user behavior features at different scales to generate an anomaly contribution degree; S4: determining whether the user behavior is an anomaly based on the comprehensive anomaly score and outputting the anomaly contribution degree.

[0008] Further, in a preferred embodiment of the present invention, the long-term anomaly detection includes: inputting long-term user behavior statistical features into a variational autoencoder model based on unsupervised learning, obtaining a user state encoding vector representing the user's long-term behavior pattern through the encoding process of the encoder, wherein the encoder is a multilayer perceptron composed of fully connected layers; reconstructing the long-term user behavior statistical features using a decoder based on the user state encoding vector, wherein the decoder is a multilayer perceptron composed of fully connected layers; and generating a long-term anomaly score based on the difference between the reconstructed result and the original long-term behavior statistical features, and the degree of deviation of the user state encoding vector in the latent space.

[0009] Further, in a preferred embodiment of the present invention, the short-term anomaly detection includes: inputting user short-term operation sequence features into an unsupervised learning model based on conditional diffusion under the conditional constraints of the user state encoding vector; modeling the user short-term operation sequence features through a diffusion process; and generating a short-term anomaly score based on the reconstruction error of the short-term operation sequence features by the conditional diffusion model. The unsupervised learning model based on conditional diffusion is trained through a forward noise addition process and a backward denoising process, and the user state encoding vector is introduced as conditional information to guide the denoising process.

[0010] Furthermore, in a preferred embodiment of the present invention, the step of acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data includes: acquiring user behavior data from the system, including login logs, operation records, access records, and device logs; parsing the user behavior data to extract behavior records related to user behavior, wherein each behavior record includes at least a user identifier, timestamp, operation type, operation object, and operation result; performing data cleaning and standardization processing on the behavior records, including: handling missing values, removing invalid and erroneous behavior records, standardizing the format of behavior records, and standardizing the timestamps of behavior records; setting a session time threshold to segment the sorted behavior records into sessions, and when the time interval between two adjacent behavior records is greater than the session time threshold, a session segmentation is performed at the corresponding position; and summarizing the multiple sessions to form a behavior data set with the user as the main body.

[0011] Furthermore, in a preferred embodiment of the present invention, the construction of long-term user behavior statistical features includes: setting a long-term statistical window size and step size, dividing the user's behavior data into multiple long-term statistical time windows; within each long-term statistical window, aggregating the user's conversational behavior data to obtain statistical features reflecting the user's long-term behavior patterns, wherein the statistical features include: intensity statistical features, frequency statistical features, time regularity features, result distribution features, and diversity features; and standardizing the statistical features to generate long-term user behavior statistical features.

[0012] Further, in a preferred embodiment of the present invention, the construction of user short-term operation sequence features includes: setting a short-term observation window size and a short-term operation sequence length; based on the time range corresponding to the user's long-term behavior statistical features, extracting the end portion of the corresponding long-term statistical window to construct a discrete short-term operation sequence, specifically: locating the session at the time point, using the session as a candidate sequence source; if the number of operations in the session is greater than the set short-term operation sequence length, extracting the last segment of the session's behavior record as a short-term operation sequence, the length of the last segment of the behavior record being the set short-term operation sequence length; if the number of operations in the session is less than the set short-term operation sequence length, merging the session with the connected preceding session, extracting the last segment of the merged session's behavior record as a short-term operation sequence, the length of the last segment of the behavior record being the set short-term operation sequence length; converting the discrete short-term operation sequence into a numerical feature vector, the numerical feature vector being a short-term operation sequence feature used for anomaly detection.

[0013] Furthermore, in a preferred embodiment of the present invention, step S3 includes: standardizing the long-term anomaly score and the short-term anomaly score, and performing weighted fusion based on a preset fusion weight to generate a comprehensive anomaly score; and calculating the anomaly contribution degree corresponding to different time scales based on the relative contribution of the long-term anomaly score and the short-term anomaly score in the comprehensive anomaly score, wherein the anomaly contribution degree is used to characterize the main source of user behavior anomalies.

[0014] Further, in a preferred embodiment of the present invention, step S4 includes: comparing the comprehensive anomaly score with a preset judgment threshold to determine whether the user behavior is abnormal; when the anomaly contribution of the long-term behavior pattern exceeds a preset threshold, determining the feature dimension with the largest anomaly contribution based on the reconstruction error of the long-term behavior statistical features, and outputting the corresponding behavior anomaly explanation information; when the anomaly contribution of the short-term operation sequence exceeds a preset threshold, locating the abnormal time period based on the reconstruction error of the short-term operation sequence features, and outputting the corresponding operation anomaly explanation information; when the anomaly contributions corresponding to the long-term behavior pattern and the short-term operation sequence are both within the preset threshold range, performing joint analysis by combining the long-term behavior statistical features and the short-term operation sequence features, and outputting composite anomaly explanation information.

[0015] This invention also provides a multi-scale user behavior anomaly detection system based on unsupervised learning. The system includes: a multi-scale feature construction subsystem, located at the data layer, for acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data. The construction of multi-scale user behavior features includes at least constructing long-term user behavior statistical features and constructing short-term user operation sequence features; a hierarchical unsupervised anomaly detection subsystem, located at the model layer, for performing hierarchical anomaly detection based on an unsupervised learning model for user behavior features at different scales, obtaining anomaly evaluation results corresponding to different scales; an anomaly determination and interpretability output subsystem, located at the decision layer, for comprehensively processing the anomaly evaluation results corresponding to different scales, generating a comprehensive anomaly score, and quantifying the anomaly contribution of user behavior features at different scales to generate an anomaly contribution degree. Based on the comprehensive anomaly score, it determines whether the user behavior is an anomaly and outputs the anomaly contribution degree; and a system management and maintenance subsystem, located at the management layer, for system management and control, and providing a human-computer interaction interface for displaying alarm information.

[0016] Furthermore, in a preferred embodiment of the present invention, the multi-scale feature construction subsystem includes: a data acquisition module, a data preprocessing and session segmentation module, and a multi-scale feature parallel construction module.

[0017] Furthermore, in a preferred embodiment of the present invention, the hierarchical unsupervised anomaly detection subsystem includes: a variational autoencoder model module, a conditional diffusion model module, and a model storage and loading module.

[0018] Furthermore, in a preferred embodiment of the present invention, the anomaly determination and interpretability output subsystem includes: an anomaly scoring fusion determination module and an interpretability and alarm generation module.

[0019] Furthermore, in a preferred embodiment of the present invention, the system control and maintenance subsystem includes: a system management module and a human-computer interaction module.

[0020] The present invention also provides an electronic device, comprising: a memory for storing a computer program for executing the multi-scale user behavior anomaly detection method based on unsupervised learning; and a processor for processing the computer program.

[0021] This invention provides a multi-scale user behavior anomaly detection method based on unsupervised learning. Compared with existing technologies, it includes: S1: acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data. The construction of multi-scale user behavior features includes at least constructing long-term user behavior statistical features and constructing short-term user operation sequence features; S2: performing hierarchical anomaly detection based on unsupervised learning models for user behavior features at different scales to obtain anomaly evaluation results corresponding to different scales. The hierarchical anomaly detection includes at least long-term anomaly detection based on variational autoencoders and short-term anomaly detection based on conditional diffusion models. The input of the conditional diffusion model includes the output of the variational autoencoders; S3: comprehensively processing the anomaly evaluation results corresponding to different scales to generate a comprehensive anomaly score, and quantifying the anomaly contribution of user behavior features at different scales to generate an anomaly contribution degree; S4: determining whether the user behavior is an anomaly based on the comprehensive anomaly score and outputting the anomaly contribution degree. In the execution of the technical solution involved in this invention, step S1 processes multi-source user behavior data in the system in a unified manner and organizes and divides user behavior into sessions based on the time dimension, transforming the original discrete user behavior logs into a structured set of behavior data, providing a stable data foundation for subsequent multi-scale modeling. Based on this, user behavior is characterized from different time scales by constructing long-term behavioral statistical features and short-term operation sequence features. Long-term behavioral statistical features reflect stable behavioral patterns formed by users over a longer period, while short-term operation sequence features characterize the specific operation process and its temporal correlation within a short period, thereby achieving multi-scale modeling of user behavior. Step S2 introduces unsupervised learning models for hierarchical anomaly detection based on user behavior features at different scales, and designs coupling between different levels to improve the efficiency and accuracy of anomaly detection, enabling the model to automatically learn behavior patterns based on the inherent distribution patterns of normal user behavior without relying on manually labeled data. In step S3, when user behavior deviates from the normal distribution at its corresponding scale, the model can output an anomaly assessment result reflecting the degree of deviation, thereby improving the detection capability for unknown and novel anomalies. Furthermore, by comprehensively processing the anomaly assessment results obtained at different time scales, a comprehensive anomaly score is generated, and the anomaly contribution corresponding to each time scale is quantitatively analyzed. This not only enables an overall judgment of user behavior anomalies but also clarifies whether the anomalies primarily originate from changes in long-term behavioral patterns or short-term operational anomalies, thereby enhancing the interpretability of anomaly detection results. Compared to existing technologies, the technical solution involved in this invention can comprehensively characterize user behavior features without relying on labeled data, effectively identify user behavior anomalies at different time scales, and possesses high interpretability and strong adaptability.

[0022] This invention also provides a multi-scale user behavior anomaly detection system based on unsupervised learning, comprising: a multi-scale feature construction subsystem, located at the data layer, for acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data, wherein constructing multi-scale user behavior features includes at least constructing long-term user behavior statistical features and constructing short-term user operation sequence features; a hierarchical unsupervised anomaly detection subsystem, located at the model layer, for performing hierarchical anomaly detection based on an unsupervised learning model for user behavior features at different scales, obtaining anomaly evaluation results corresponding to different scales; an anomaly determination and interpretability output subsystem, located at the decision layer, for comprehensively processing the anomaly evaluation results corresponding to different scales, generating a comprehensive anomaly score, and quantifying the anomaly contribution of user behavior features at different scales to generate an anomaly contribution degree, determining whether user behavior is an anomaly based on the comprehensive anomaly score, and outputting the anomaly contribution degree; and a system management and operation subsystem, located at the management layer, for system management and control, and providing a human-computer interaction interface for displaying alarm information. It also has the aforementioned technical effects.

[0023] This invention also provides an electronic device for multi-scale user behavior anomaly detection based on unsupervised learning, comprising: a memory for storing a computer program for executing the multi-scale user behavior anomaly detection method based on unsupervised learning; and a processor for processing the computer program. It also possesses the aforementioned technical effects. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 is a schematic diagram of a multi-scale user behavior anomaly detection method based on unsupervised learning provided in an embodiment of the present invention;

[0026] Figure 2 is a schematic diagram of the implementation process of the multi-scale user behavior anomaly detection method based on unsupervised learning provided in the embodiment of the present invention;

[0027] Figure 3 is a schematic diagram of the overall framework of the multi-scale user behavior anomaly detection method based on unsupervised learning provided in the embodiment of the present invention;

[0028] Figure 4 is a schematic diagram of the functional modules of the multi-scale user behavior anomaly detection system based on unsupervised learning provided in an embodiment of the present invention;

[0029] Figure 5 is a schematic diagram of the system framework of the multi-scale user behavior anomaly detection system based on unsupervised learning provided in an embodiment of the present invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0031] It should be noted that when a component is referred to as being "fixed to" or "set on" another component, it can be directly on or indirectly set on the other component; when a component is referred to as being "connected to" another component, it can be directly connected to or indirectly connected to the other component.

[0032] It should be understood that the terms "length", "width", "upper", "lower", "front", "rear", "first", "second", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the present invention.

[0033] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" or "several" means two or more, unless otherwise explicitly specified.

[0034] It should be noted that the structures, proportions, sizes, etc., shown in the accompanying drawings of this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed in the specification, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0035] Please Figures 1 to 5As shown in the embodiment of the present invention, a multi-scale user behavior anomaly detection method based on unsupervised learning includes: S1: acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data, wherein constructing multi-scale user behavior features includes at least constructing long-term user behavior statistical features and constructing short-term user operation sequence features; S2: performing hierarchical anomaly detection based on an unsupervised learning model for user behavior features at different scales to obtain anomaly evaluation results corresponding to different scales, wherein hierarchical anomaly detection includes at least long-term anomaly detection based on a variational autoencoder and short-term anomaly detection based on a conditional diffusion model, wherein the input of the conditional diffusion model includes the output of the variational autoencoder; S3: performing comprehensive processing on the anomaly evaluation results corresponding to different scales to generate a comprehensive anomaly score, and quantifying the anomaly contribution of user behavior features at different scales to generate an anomaly contribution degree; S4: determining whether the user behavior is an anomaly behavior based on the comprehensive anomaly score, and outputting the anomaly contribution degree.

[0036] This invention provides a technical solution for a multi-scale user behavior anomaly detection method based on unsupervised learning. Specifically, step S1 involves uniformly processing multi-source user behavior data within the system and organizing and segmenting user behavior based on the time dimension. This transforms the original discrete user behavior logs into a structured set of behavior data, providing a stable data foundation for subsequent multi-scale modeling. Based on this, long-term user behavior statistical features and short-term operation sequence features are constructed to characterize user behavior at different time scales. Long-term behavior statistical features reflect stable behavior patterns formed by users over a longer period, while short-term operation sequence features characterize the specific operation process and its temporal correlation within a short period, thus achieving multi-scale modeling of user behavior. Step S2 introduces unsupervised learning models for hierarchical anomaly detection based on user behavior features at different scales. This allows the model to automatically learn behavior patterns based on the inherent distribution patterns of normal user behavior without relying on manually labeled data. In step S3, when user behavior deviates from the normal distribution at its corresponding scale, the model outputs an anomaly assessment result reflecting the degree of deviation, thereby improving the detection capability for unknown and novel anomalies. Furthermore, by comprehensively processing the anomaly assessment results obtained at different time scales, a comprehensive anomaly score is generated, and the contribution of anomalies at each time scale is quantitatively analyzed. This not only enables an overall judgment of user behavior anomalies but also clarifies whether the anomalies primarily stem from changes in long-term behavioral patterns or short-term operational anomalies, thereby enhancing the interpretability of anomaly detection results. The technical solution provided by this invention can comprehensively characterize user behavior features without relying on labeled data, effectively identify user behavior anomalies at different time scales, and possesses high interpretability and strong adaptability.

[0037] Specifically, in this embodiment of the invention, the long-term anomaly detection includes: inputting long-term user behavior statistical features into a variational autoencoder model based on unsupervised learning, and obtaining a user state encoding vector representing the user's long-term behavior pattern through an encoding process; reconstructing the long-term user behavior statistical features based on the user state encoding vector; and generating a long-term anomaly score based on the difference between the reconstruction result and the original long-term behavior statistical features, as well as the degree of deviation of the user state encoding vector in the latent space.

[0038] The variational autoencoder model consists of an encoder. and decoder The encoder maps the input long-term behavioral statistical feature vector to a latent space that satisfies a preset probability distribution prior constraint. In this embodiment, the prior distribution is a Gaussian distribution. The encoder generates a user state encoding vector, and the decoder reconstructs the input features based on this encoding vector.

[0039] The encoder employs a multilayer perceptron consisting of fully connected layers, with the input layer having a receiving dimension of [missing information]. Long-term behavioral statistical vector The hidden layers consist of multiple fully connected layers, each followed by a ReLU activation function, with regularization mechanisms introduced as needed to prevent overfitting. The output layer consists of two parallel, fully connected layers without activation functions, including a mean layer and a log-variance layer. The mean layer outputs the mean vector of the latent distribution. The log-variance layer outputs the log-variance vector of the latent distribution. The encoder then defines a Gaussian posterior distribution based on the mean vector and the log-variance vector:

[0040]

[0041] By outputting the mean and variance parameters of the potential distribution separately, the model can simultaneously characterize the central tendency and uncertainty of users' long-term behavioral state.

[0042] Reparameterization samples latent vectors from the posterior distribution :

[0043]

[0044] in This indicates element-wise multiplication, and the latent vector... This is the user state encoding vector that represents the user's long-term behavioral patterns. This step transforms the random sampling process into a differentiable form, thereby supporting end-to-end training of the model parameters.

[0045] The decoder is also a multilayer perceptron, with the input layer receiving the user state encoded vector. The hidden layer consists of multiple fully connected layers, with a structure symmetrical to the encoder's hidden layer, each followed by a ReLU activation function; the output layer is a fully connected layer without an activation function, with an output dimension of... Its output is directly used as the reconstructed long-term behavior statistics vector. In this embodiment, it is assumed that... That is, the reconstructed distribution is a Gaussian distribution with a mean of 1 / 2. The variance is a fixed value, which converts the reconstruction error in the loss function into mean squared error.

[0046] During offline training, the training objective of the variational autoencoder is to maximize the lower bound of evidence, the negative of which is used as the loss function. To minimize this loss function, it consists of two parts: the reconstruction loss and the KL divergence regularization term. The reconstruction loss measures the reconstructed features. and original input features The difference between them is expressed using mean squared error:

[0047]

[0048] The KL divergence regularization term is used to constrain the posterior distribution. Approximate Gaussian prior distribution , is represented as:

[0049]

[0050] in Let KL divergence have a closed-form solution for a Gaussian distribution. Model loss function. It is a weighted sum of the reconstruction loss and the KL divergence regularization term, with a weighting factor introduced. To control the regularization strength:

[0051]

[0052] By adjusting the weighting factors, a trade-off can be struck between reconstruction accuracy and the strength of potential spatial constraints.

[0053] During the training phase, a large number of long-term behavioral statistical vectors of normal users are used as the training set, and the encoder parameters are optimized through stochastic gradient descent. and decoder parameters Minimize the loss function After the variational autoencoder model is trained, the model parameters are fixed. To train the conditional diffusion model, the corresponding long-term behavioral statistics vector is input into the encoder to generate the corresponding user state encoding vector. This serves as the key conditional information input during the training of the lower-level conditional diffusion model.

[0054] Simultaneously, a validation set consisting of normal samples is established. The reconstruction error and KL divergence of each sample are calculated using the trained model, and their mean is calculated. and standard deviation This is used for standardization of long-term anomaly scoring. By statistically modeling anomaly indicators of normal samples, a stable and consistent anomaly scoring benchmark can be obtained in the subsequent online detection stage under different users and different feature scales.

[0055] For online detection time Extracted long-term user behavior statistical features The long-term anomaly score is calculated using a trained variational autoencoder model. The input is fed into a trained variational autoencoder model, and the encoder outputs a user state encoded vector. The decoder outputs a reconstructed vector. .

[0056] The long-term anomaly score for user behavior consists of two parts: reconstruction error and latent space deviation. Reconstruction error measures the difference between the reconstructed features and the original input features, while latent space deviation measures the anomalous position of the user's state encoding in the latent space, represented by KL divergence. The reconstruction error and latent space deviation are calculated, and the data is standardized using the mean and standard deviation parameters generated from the validation set during the training phase, thereby eliminating the influence of differences in the magnitude of behavior among different users on the anomaly score.

[0057] The standardized reconstruction error is expressed as:

[0058]

[0059] The standardized latent spatial deviation is expressed as:

[0060]

[0061] The long-term anomaly score is obtained by combining the standardized reconstruction error and the potential spatial deviation.

[0062]

[0063] in The preset weights are used. The obtained... The higher the value, the greater the deviation of the long-term behavioral statistical feature vector from the normal distribution cluster, and the further away its state encoding position in the latent space is from the center of the Gaussian distribution, indicating that the user's long-term behavioral pattern is more abnormal.

[0064] Specifically, in this embodiment of the invention, the short-term anomaly detection includes: inputting the user's short-term operation sequence features into an unsupervised learning model based on conditional diffusion under the conditional constraints of the user state encoding vector; modeling the user's short-term operation sequence features through a diffusion process; and generating a short-term anomaly score based on the reconstruction error of the short-term operation sequence features by the conditional diffusion model.

[0065] It should be noted that, in this embodiment, the conditional diffusion model employs a forward noise addition process. And a reverse denoising process Training is performed, and conditional information is introduced to guide the denoising process. Statistical feature vectors for each long-term behavior are obtained during the short-term operational sequence feature construction. The corresponding short-term operation sequence feature vector The forward process is a fixed Markov chain, in Within a step, the short-term operation sequence features of the input will be analyzed. Gradually add Gaussian noise:

[0066]

[0067] in These are predefined noise scheduling parameters, and the process can be reparameterized as follows:

[0068]

[0069] in , .

[0070] The upper-layer detection model provides the corresponding user state encoding vector. This serves as conditional information during denoising. The inverse denoising process, given conditions... Below, from the noisy sequence Reconstructing the original sequence Define a denoising network The goal is to predict the first Step added The noise is reduced. The denoising network uses a 1D U-Net designed for processing one-dimensional sequences, with an encoder-decoder structure at its core. Conditional information is injected into the network through an adaptive group normalization module. For the adaptive group normalization module, the conditional vector is first generated, and the user state encoding vector is... and diffusion step Sine position encoding The data is stitched together and fused using a small multilayer perceptron, resulting in an output dimension of [dimensionality missing]. condition vector ,in This is the number of channels in the target network layer. Then, the conditional vector is equally split into two parts, each used as an adaptive scaling factor. and bias factor For features input to the target network layer Its adaptive group normalization operation is expressed as:

[0071]

[0072] in This is a standard group normalization operation. It is used to inject conditional information into the user state encoding vector provided by the upper-layer detection model.

[0073] For 1D U-Net, the received noisy sequence First through a Convolutional layers reduce their feature dimensions Initial number of channels mapped to the network , represented as The encoder is composed of... It consists of _ downsampling blocks, for the _ _ downsampling blocks block Let the target number of channels be... Each downsampling block contains a 1D convolutional layer for feature extraction, followed by AdaGN and SiLU activation functions, expressed as:

[0074]

[0075] And a 1D convolutional layer with a stride of 2 is used for downsampling, halving the sequence length and doubling the number of channels, as shown below:

[0076]

[0077] The final output of the downsampling block is The bottleneck layer is located at the end of the encoder, at the minimum sequence length. It is composed of multiple residual blocks stacked together. The parameterized residual function has the following output representation:

[0078]

[0079] The decoder receives the output of the bottleneck layer. Its structure is symmetrical with that of the encoder, and it is composed of... It consists of upsampling blocks. For the first... block The target number of channels and the encoder remain symmetrical. Each upsampling block contains a transposed convolutional layer with a stride of 2 for upsampling, doubling the sequence length and halving the number of channels, as shown below:

[0080]

[0081] The features of the layer corresponding to the symmetrical encoder are concatenated through skip connections, as shown below:

[0082]

[0083] It also includes a 1D convolutional layer for feature fusion, followed by AdaGN and SiLU activation functions, expressed as:

[0084]

[0085] The final output of the upsampling block is Finally, through a Convolutional layers map feature dimensions back to The predicted noise of the output denoising network 1D U-Net , represented as .

[0086] During offline training, the training objective of the conditional diffusion model is to minimize the error between the predicted noise and the actual added noise, and the loss function is expressed as:

[0087]

[0088] During the training phase, a large number of short-term operation sequence features from normal users are used as the training set, and user state encoding vectors generated by the upper-layer detection model are received as context conditions. The parameters of the denoising network are optimized through stochastic gradient descent. Minimize the loss function Simultaneously, a validation set consisting of normal samples is established. The noise prediction error for each sample is calculated using the trained model, and its mean is calculated. and standard deviation This is used for the standardization of subsequent short-term anomaly scoring.

[0089] For online detection time Extracted user short-term action sequence features The short-term anomaly score is calculated using a trained conditional diffusion model. The corresponding user state encoding vector provided by the upper-layer model is then used. and short-term operation sequence characteristics The input is fed into the conditional diffusion model, and the predicted noise is obtained after forward noise addition and a trained 1D U-Net denoising network. The user's short-term anomaly score is determined by the mean square error between the predicted noise and the true noise, which measures whether the predicted noise of the short-term operation sequence is close to the true noise that is normally distributed under given conditions. The noise prediction error is calculated, and the data is standardized using the mean and standard deviation parameters generated from the validation set during the training phase. The short-term anomaly score is then expressed as:

[0090]

[0091] Obtained The higher the value, the greater the noise prediction error of the short-term operation sequence feature vector, indicating that the user's short-term operation details are more abnormal.

[0092] Specifically, in this embodiment of the invention, acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data includes: acquiring user behavior data from the system and parsing it to extract behavior records related to user behavior; performing data cleaning and standardization on the behavior records, including: handling missing values, removing invalid and erroneous behavior records, standardizing the format of behavior records, and standardizing the timestamps of behavior records; setting a session time threshold to divide the behavior records into multiple sessions; and summarizing the multiple sessions to form a set of behavior data with the user as the main body.

[0093] It should be noted that, in this embodiment of the invention, the user behavior data includes: login logs, operation records, access records, and device logs. Each behavior record... At least include user identifier timestamp Operation type Operation objects and operation results After cleaning and standardizing the aforementioned behavior records, they are then processed in the user's... All user activity records are stored in timestamp format. Sort in ascending order based on session time threshold Session segmentation is performed if the time interval between two adjacent records exceeds a session time threshold. This allows a user's entire activity record to be divided into multiple sessions. Each session contains a list of actions arranged in chronological order. Records of any adjacent actions within this session All are satisfied Finally, the data is aggregated according to different user identifiers to form a set of behavioral data centered on the user. .

[0094] Specifically, in this embodiment of the invention, the construction of long-term user behavior statistical features includes: aggregating user conversational behavior data based on a preset long-term statistical time window to obtain statistical features reflecting long-term user behavior patterns; and standardizing the statistical features to generate long-term user behavior statistical features.

[0095] It should be noted that, before performing the aggregation process, the long-term statistical window size is set to [value missing]. Step size is The user's behavioral data is divided into multiple long-term statistical time windows. ,in The statistical features include: intensity statistical features. Frequency statistics are formed by calculating the average number of sessions, average number of operations per session, and total operation duration within a long-term statistical window; This is formed by calculating the total number of occurrences of different operation types within a long-term statistical window; it also reveals time-related patterns. By statistically analyzing the distribution of user activity across different time periods, the entropy value and average active period are calculated; the distribution characteristics of the results are analyzed. This is achieved by statistically analyzing the ratio of successful to failed operations, as well as the failure rate of each major operation type; diversity characteristics. The Gini coefficient for each operation type is calculated by statistically analyzing the number of different operation objects accessed.

[0096] Specifically, the normalization process is a standardization process that generates long-term behavioral statistical features for a single user in each long-term statistical window. .

[0097] Specifically, in this embodiment of the invention, constructing the user short-term operation sequence features includes: constructing a discrete short-term operation sequence from user behavior data based on the time range corresponding to the user's long-term behavior statistical features; and converting the discrete short-term operation sequence into a numerical feature vector, wherein the numerical feature vector is a short-term operation sequence feature for anomaly detection.

[0098] It should be noted that the short-term observation window size is set to... The short-running sequence length is For each long-term behavioral statistical feature Extract the corresponding long-term statistical window The last part serves as the corresponding short-term operation sequence, specifically: positioning time point. The session in which the sequence is located is used as a candidate sequence source. If the number of operands in the session is greater than 1, the sequence is considered as a candidate sequence source. Extract the last part of the conversation Each action record is used as a short-term operation sequence; if the number of operations in the session is less than... Merge the session with the preceding connected session, and extract the last segment of the merged session. Each behavior record is used as a short-term operation sequence.

[0099] In addition, in order to perform numerical modeling, discrete behavior records are... The specific steps for converting to a numerical feature vector are as follows: For operation types Through a learnable embedding matrix Operation type Mapped to A dimensional vector, represented as For the operation object Since the hash space is huge and sparse, it is mapped to a fixed-dimensional sparse binary vector through feature hashing. Let the hash space dimension be . The hash function is Then the mapping vector of the operation object is ,in For indicator functions, Regarding the operation results The dimension is obtained through one-hot encoding. vector Simultaneously, the cyclic encoding vector of the timestamp is obtained through sine and cosine encoding. The feature vector corresponding to each user's single behavior record is represented as follows: Then each long-term behavioral statistical feature vector The corresponding short-term operation sequence feature vector is The feature dimension is .

[0100] Specifically, in this embodiment of the invention, step S3 includes: standardizing the long-term anomaly score and the short-term anomaly score, and performing weighted fusion based on a preset fusion weight to generate a comprehensive anomaly score; and calculating the anomaly contribution degree corresponding to different time scales based on the relative contribution of the long-term anomaly score and the short-term anomaly score in the comprehensive anomaly score, wherein the anomaly contribution degree is used to characterize the main source of user behavior anomalies.

[0101] It should be noted that when conducting online testing, the current time is considered. Based on this, long-term behavioral statistical features and short-term operation sequence features of users are extracted in real time, both based on strictly aligned time windows to ensure contextual consistency between long-term behavior and short-term operations. The long-term behavioral statistical features are then input into the upper-layer variational autoencoder model to generate user state encoding vectors. And calculate long-term anomaly scores ;by As conditional information, the short-term operation sequence features are input into the lower-level conditional diffusion model to calculate short-term anomaly scores. .

[0102] Long-term anomaly scores reflect deviations from long-term behavioral patterns, while short-term anomaly scores reflect short-term operational anomalies, forming a multi-scale, hierarchical user anomaly detection score. Both scores have been standardized and approximate a standard normal distribution on normal samples. A comprehensive anomaly score is defined using weighted linear fusion:

[0103]

[0104] in and , which is the preset fusion weight; Ensure that only positive anomalies above normal levels are penalized, while negative biases are ignored.

[0105] Set a comprehensive judgment threshold Therefore, the final anomaly detection result is:

[0106]

[0107] Furthermore, since the two abnormal scores of the normal sample approximately follow a standard normal distribution, the threshold... It can be set between 2.0 and 3.0, corresponding to the 95%-99.7% confidence interval of the standard normal distribution.

[0108] In addition, the hierarchical model detects anomalies in user behavior from the perspectives of long-term behavioral patterns and short-term operational sequences, outputting a comprehensive anomaly score while quantifying the anomaly contribution of user anomalies at different scales:

[0109]

[0110] Specifically, in this embodiment of the invention, step S4 includes: comparing the comprehensive anomaly score with a preset judgment threshold to determine whether the user behavior is abnormal; when the anomaly contribution of the long-term behavior pattern exceeds a set threshold, determining the feature dimension with the largest anomaly contribution based on the reconstruction error of the long-term behavior statistical features, and outputting the corresponding behavior anomaly explanation information; when the anomaly contribution of the short-term operation sequence exceeds a set threshold, locating the abnormal time period based on the reconstruction error of the short-term operation sequence features, and outputting the corresponding operation anomaly explanation information; when the anomaly contributions of the long-term behavior pattern and the short-term operation sequence are both within the set threshold range, performing joint analysis by combining the long-term behavior statistical features and the short-term operation sequence features, and outputting composite anomaly explanation information.

[0111] Among them, the anomaly contribution level intuitively shows which time scale the user behavior anomalies mainly originate from, and by tracing the source of features based on the contribution level, the origin of user behavior anomalies can be analyzed and explained. When When user behavior anomalies primarily stem from deviations in long-term behavior patterns, the feature dimension with the highest standardized score in the reconstruction error vector of long-term behavioral statistical features is retrieved and matched against a predefined semantic dictionary. This allows for the output of user behavior anomaly descriptions such as "User behavior baseline has shifted: login frequency surges (+100%)". In this case, abnormal user behavior mainly stems from short-term operational anomalies. By locating the time period corresponding to the maximum noise prediction error in the short-term operational sequence features, extracting the behavioral records within that time period, and matching them with a predefined semantic dictionary, a user behavior anomaly description can be output, such as "High-risk operational sequence detected: 5 consecutive sudo privilege escalation executions within 3 minutes." In this context, a comprehensive analysis of long-term behavioral patterns and short-term operational details can be performed to identify spatiotemporal correlations and match them with a predefined semantic dictionary. This allows for the output of abnormal user behavior descriptions, such as "the user's behavior baseline has slightly shifted, superimposed with a sudden high frequency of failed login attempts, suspected of being an attack probe." Based on this, abnormal user behavior can be attributed to different time scales to accurately trace the source level of abnormal user behavior and perform multi-scale contextual diagnosis of abnormal behavior.

[0112] This invention also provides a multi-scale user behavior anomaly detection system based on unsupervised learning. The system includes: a multi-scale feature construction subsystem, located at the data layer, for acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data. The construction of multi-scale user behavior features includes at least constructing long-term user behavior statistical features and constructing short-term user operation sequence features; a hierarchical unsupervised anomaly detection subsystem, located at the model layer, for performing hierarchical anomaly detection based on an unsupervised learning model for user behavior features at different scales, obtaining anomaly evaluation results corresponding to different scales; an anomaly determination and interpretability output subsystem, located at the decision layer, for comprehensively processing the anomaly evaluation results corresponding to different scales, generating a comprehensive anomaly score, and quantifying the anomaly contribution of user behavior features at different scales to generate an anomaly contribution degree. Based on the comprehensive anomaly score, it determines whether the user behavior is an anomaly and outputs the anomaly contribution degree; and a system management and maintenance subsystem, located at the management layer, for system management and control, and providing a human-computer interaction interface for displaying alarm information.

[0113] This invention provides a multi-scale user behavior anomaly detection system based on unsupervised learning, which also has the above-mentioned technical effects.

[0114] Specifically, in this embodiment of the invention, the multi-scale feature construction subsystem includes: a data acquisition module, a data preprocessing and session segmentation module, and a multi-scale feature parallel construction module.

[0115] The data acquisition module collects raw behavioral data such as user login logs, operation records, access records, and device logs in real time by deploying a lightweight data acquisition agent or connecting to an existing security log platform. The module supports multiple data access protocols and features data buffering, compressed transmission, and breakpoint resumption mechanisms to ensure the integrity and low latency of the collected data. The data preprocessing and session segmentation module receives the raw behavioral data stream from the data acquisition module through a streaming processing framework and sequentially performs data cleaning, data completion, and format unification operations. Based on a preset session time threshold, it divides continuous user behavior records into multiple sessions, outputting a structured session sequence per user, providing a temporal context for subsequent feature construction. The multi-scale feature parallel construction module receives the preprocessed user session data and performs long-term feature aggregation and short-term sequence extraction in parallel. Long-term feature aggregation calculates statistical features such as user behavior intensity, frequency, time regularity, result distribution, and diversity based on a set long-term statistical window, forming a long-term behavioral statistical vector. Short-term sequence extraction extracts a fixed-length operation sequence from the user's most recent sessions based on a short-term observation window and converts it into a numerical feature vector. The modules are strictly time-aligned to ensure the consistency and timeliness of features.

[0116] Specifically, in this embodiment of the invention, the hierarchical unsupervised anomaly detection subsystem includes: a variational autoencoder model module, a conditional diffusion model module, and a model storage and loading module.

[0117] The variational autoencoder model module, based on a deep learning framework, implements an upper-layer long-term behavioral anomaly detection model. It employs a variational autoencoder built with a multilayer perceptron to perform unsupervised learning of the long-term behavioral statistical features of normal users. The model consists of an encoder and a decoder. The encoder maps the input features to a Gaussian distribution in the latent space and generates a user state encoding vector. The decoder reconstructs the original features based on this encoding. The module supports model training, inference, and user state encoding output, and provides interfaces for calculating reconstruction error and KL divergence for generating long-term anomaly scores. The conditional diffusion model module, also based on a deep learning framework, implements a lower-layer short-term operation sequence anomaly detection model. It employs a 1D U-Net architecture and uses the user state encoding generated by the upper-layer model as conditions for unsupervised learning of short-term operation sequences. The model includes two sub-processes: forward noise addition and backward denoising, injecting conditional information through an adaptive group normalization mechanism. The module supports model training and inference, and provides an interface for calculating noise prediction error for generating short-term anomaly scores. The model storage and loading module, implemented based on a model repository, is responsible for storing parameters, managing versions, and dynamically loading the variational autoencoder and conditional diffusion models. The module supports hot model loading, A / B testing, and rollback mechanisms to ensure the stability of the online detection service. It also provides a model performance monitoring interface to record key metrics such as inference latency and detection accuracy.

[0118] Specifically, in this embodiment of the invention, the anomaly determination and interpretability output subsystem includes: an anomaly scoring fusion determination module and an interpretability and alarm generation module.

[0119] The anomaly scoring fusion and judgment module receives long-term anomaly scores from the upper-layer variational autoencoder and short-term anomaly scores from the lower-layer conditional diffusion model, performs standardized alignment and weighted linear fusion to generate a comprehensive anomaly score. The module supports dynamic weight and judgment threshold adjustment, allowing for different judgment strategies to be set according to business scenarios. It ultimately outputs the anomaly judgment result and confidence interval. The interpretability and alarm generation module, based on an anomaly contribution metric mechanism, calculates the proportion of long-term and short-term anomaly scores in the comprehensive score, achieving hierarchical location of anomaly sources. The module has a built-in preset semantic dictionary, determines the anomaly type through contextual feature tracing, matches predefined alarm templates, and generates structured alarm descriptions such as "user behavior baseline has shifted" and "high-risk operation sequence detected." Alarm information is pushed to the management layer via a message queue and supports multiple notification methods such as email and work orders.

[0120] Specifically, in this embodiment of the invention, the system management and operation subsystem includes: a system management module and a human-computer interaction module.

[0121] The system management module provides a web-based management interface for system administrators to perform global configurations, including data source management, time window parameters, and alarm rules. Simultaneously, this module collects and displays the real-time operational status of each subsystem, including key indicators such as resource utilization, data throughput, inference latency, and detection accuracy, enabling global system control. The human-computer interaction module provides a web-based management interface with a real-time alarm dashboard, displaying explainable alarm events in list and detail page formats. Operations and maintenance personnel can use the interface to manually review alarms, mark false positives / false negatives, and add handling suggestions, achieving a human-machine collaborative user behavior anomaly handling process.

[0122] The present invention also provides an electronic device, comprising: a memory for storing a computer program for executing the multi-scale user behavior anomaly detection method based on unsupervised learning; and a processor for processing the computer program.

[0123] This invention provides an electronic device for detecting anomalies in user behavior based on unsupervised learning at multiple scales, which also has the aforementioned technical effects.

[0124] More specifically, this invention provides a multi-scale user behavior anomaly detection scheme based on unsupervised learning. It employs a multi-scale feature modeling mechanism combining long-term behavioral statistical features and short-term operation sequences, which is beneficial for comprehensively capturing abnormal patterns of user behavior across different time scales. This invention extracts long-term behavioral statistical features reflecting long-term user behavior patterns and short-term operation sequence features reflecting short-term operation details by setting long-term statistical windows and short-term observation windows, respectively. This mechanism overcomes the limitations of existing methods that rely on single-time-scale modeling, enabling simultaneous identification of both long-term behavioral patterns and short-term operation sequence anomalies, thereby improving the coverage and sensitivity of anomaly detection. A hierarchical unsupervised learning architecture combining a variational autoencoder model and a conditional diffusion model is adopted, which facilitates cross-scale context-aware anomaly detection. The upper-layer variational autoencoder model learns long-term behavioral statistical features and generates user state codes, while the lower-layer conditional diffusion model uses these codes as conditions to learn short-term operation sequence features. This architecture achieves deep coupling of anomaly detection based on long-term behavioral patterns or short-term operation sequences in the model structure, and enhances the model's context-awareness of abnormal behavior through conditional information injection. The use of a multi-scale anomaly scoring fusion and interpretable output mechanism facilitates hierarchical localization of anomaly sources and interpretable diagnosis. This invention weights and fuses long-term and short-term anomaly scores, and calculates the anomaly contribution at different scales to achieve hierarchical localization of the source of anomalous behavior. Simultaneously, by combining feature tracing and semantic dictionary matching, the system can output structured anomaly descriptions, providing security analysts with actionable diagnostic criteria and enhancing the system's practicality and reliability in actual deployment.

[0125] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multi-scale user behavior anomaly detection method based on unsupervised learning, characterized in that, The method includes the following steps: S1: Acquire user behavior data and construct multi-scale user behavior features based on the user behavior data. The multi-scale user behavior features include at least long-term user behavior statistical features and short-term user operation sequence features. S2: For user behavior features at different scales, hierarchical anomaly detection is performed based on unsupervised learning models to obtain anomaly evaluation results corresponding to different scales. The hierarchical anomaly detection includes at least long-term anomaly detection based on variational autoencoders and short-term anomaly detection based on conditional diffusion models. The input of the conditional diffusion model includes the output of the variational autoencoders. S3: Comprehensively process the anomaly assessment results corresponding to different scales to generate a comprehensive anomaly score, and quantify the anomaly contribution of user behavior features at different scales to generate anomaly contribution degree. S4: Determine whether the user behavior is abnormal based on the comprehensive anomaly score, and output the anomaly contribution score; the long-term anomaly detection includes the following steps: The statistical features of users’ long-term behavior are input into a variational autoencoder model based on unsupervised learning, and the user state encoding vector representing the user’s long-term behavior pattern is obtained through the encoding process. The long-term behavioral statistical features of the user are reconstructed based on the user state encoding vector; Based on the difference between the reconstruction result and the original long-term behavioral statistical features, and the degree of deviation of the user state encoding vector in the latent space, a long-term anomaly score is generated. The short-term anomaly detection includes: Under the conditional constraints of the user state encoding vector, the user's short-term operation sequence features are input into an unsupervised learning model based on conditional diffusion; The method further includes: modeling the user's short-term operation sequence features through a diffusion process, and generating a short-term anomaly score based on the reconstruction error of the short-term operation sequence features by the conditional diffusion model; the method also includes: inputting the corresponding user state encoding vector and short-term operation sequence features provided by the upper-layer model into the conditional diffusion model, and obtaining the predicted noise through forward noise addition and a trained 1D U-Net denoising network; The denoising network employs a 1D U-Net designed for processing one-dimensional sequences, with an encoder-decoder structure at its core. Conditional information is injected into the network through an adaptive group normalization module. For this module, the conditional vector is first generated, and the user state encoding vector is... and diffusion step Sine position encoding The data is stitched together and fused using a small multilayer perceptron, resulting in an output dimension of [dimensionality missing]. condition vector ,in This refers to the number of channels in the target network layer; then, the conditional vector is equally split into two parts, which are used as adaptive scaling factors. and bias factor For features input to the target network layer Its adaptive group normalization operation is expressed as: in It is a standard group normalization operation.

2. The multi-scale user behavior anomaly detection method based on unsupervised learning according to claim 1, characterized in that, The steps for acquiring user behavior data and constructing multi-scale user behavior features based on the user behavior data include: Acquire and parse user behavior data from the system, and extract behavior records related to user behavior; The behavior records are cleaned and standardized, including: handling missing values, removing invalid and erroneous behavior records, standardizing the format of behavior records, and standardizing the timestamps of behavior records. Set a session time threshold to divide the behavior records into multiple sessions; The multiple sessions are aggregated to form a set of behavioral data centered on the user.

3. The multi-scale user behavior anomaly detection method based on unsupervised learning according to claim 2, characterized in that, The construction of the user's long-term behavior statistical features includes: Based on a preset long-term statistical time window, user conversational behavior data is aggregated to obtain statistical features that reflect users' long-term behavior patterns. The statistical features are then normalized to generate long-term user behavior statistical features.

4. The multi-scale user behavior anomaly detection method based on unsupervised learning according to claim 3, characterized in that, The construction of the user's short-term operation sequence features includes: Based on the time range corresponding to the long-term statistical characteristics of user behavior, a discrete short-term operation sequence is constructed from the user behavior data; The discrete short-term operation sequence is transformed into a numerical feature vector, which is a short-term operation sequence feature used for anomaly detection.

5. The multi-scale user behavior anomaly detection method based on unsupervised learning according to claim 4, characterized in that, Step S3 specifically involves: The long-term and short-term anomaly scores are standardized and then weighted and fused based on preset fusion weights to generate a comprehensive anomaly score. Based on the relative contributions of the long-term anomaly score and the short-term anomaly score to the overall anomaly score, the anomaly contribution degree corresponding to different time scales is calculated.

6. The multi-scale user behavior anomaly detection method based on unsupervised learning according to claim 5, characterized in that, Step S4 includes: The comprehensive anomaly score is compared with a preset judgment threshold to determine whether the user behavior is abnormal. When the abnormal contribution of the long-term behavior pattern exceeds a set threshold, the feature dimension with the largest abnormal contribution is determined based on the reconstruction error of the long-term behavior statistical features, and the corresponding behavioral abnormality explanation information is output. When the abnormal contribution of the short-term operation sequence exceeds a set threshold, the abnormal time period is located based on the reconstruction error of the short-term operation sequence characteristics, and the corresponding operation abnormality explanation information is output. When the anomaly contribution of the long-term behavior pattern and the short-term operation sequence are both within a set threshold range, a joint analysis is performed by combining the statistical features of the long-term behavior and the features of the short-term operation sequence to output composite anomaly explanation information.

7. A multi-scale user behavior anomaly detection system based on unsupervised learning, characterized in that, This system is used to implement the multi-scale user behavior anomaly detection method based on unsupervised learning as described in any one of claims 1 to 6. The system employs a hierarchical design and includes: A multi-scale feature construction subsystem, located in the data layer, is used to acquire user behavior data and construct multi-scale user behavior features based on the user behavior data. The construction of multi-scale user behavior features includes at least constructing long-term user behavior statistical features and constructing short-term user operation sequence features. The hierarchical unsupervised anomaly detection subsystem, located in the model layer, is used to perform hierarchical anomaly detection based on unsupervised learning models for user behavior features at different scales, and obtain anomaly evaluation results corresponding to different scales. An anomaly detection and interpretability output subsystem, located at the decision layer, is used to comprehensively process the anomaly evaluation results corresponding to the different scales, generate a comprehensive anomaly score, quantify the anomaly contribution of user behavior features at different scales, generate anomaly contribution degree, determine whether the user behavior is an anomaly based on the comprehensive anomaly score, and output the anomaly contribution degree. The system management and operation subsystem, located at the management layer, is used for system management and control, and provides a human-machine interface for displaying alarm information.

8. An electronic device, characterized in that, include: A computer program, the computer program being used to execute the multi-scale user behavior anomaly detection method based on unsupervised learning according to any one of claims 1 to 6; A memory for storing the computer program; A processor for executing the computer program.

Images