Real-time streaming analysis method and system based on multi-source heterogeneous data

Abstract

The invention discloses a real-time streaming analysis method and system based on multi-source heterogeneous data, and relates to the technical field of multi-source data real-time analysis. The real-time streaming analysis method and system based on the multi-source heterogeneous data comprises the steps that S1, multi-source data in the operation process of a terminal is collected and preprocessed, and a standardized behavior sequence data set is constructed; s2, evaluating the activity degree of multi-channel behaviors in the sliding window and constructing a chain type operation structure; s3, analyzing implicit coupling characteristics among multi-channel behaviors, complementing an operation chain and marking risk nodes; s4, integrating multi-channel activeness and coupling characteristics to analyze operation aggregation compactness in the sliding window, and driving early warning response; and S5, converting the high-matching structure into a structured early warning event and realizing real-time pushing. The problem that a real high-risk operation path is difficult to recognize in real time due to the lack of a dynamic recognition mechanism for a chain type exudation behavior completed by multi-terminal cooperative operation in a daily use scene of a high-definition video monitoring platform is solved.

Description

Technical Field

[0001] This invention relates to the field of real-time analysis technology for multi-source data, specifically to a real-time streaming analysis method and system based on multi-source heterogeneous data. Background Technology

[0002] With the increasing demands for information system security supervision, sophisticated monitoring technologies for terminal operation behavior are maturing. Current mainstream monitoring solutions widely employ data acquisition mechanisms and streaming processing frameworks based on multi-source heterogeneous data to perform real-time analysis and process modeling of key behaviors during terminal operation. Existing methods typically collect various types of terminal operation data through embedded agents, including window clicks, file access, USB connections, image generation, command execution, and resource path calls. This data is then combined with network access records, system event logs, and peripheral device interaction information to form a multi-channel, multi-dimensional data input structure.

[0003] For example, the invention patent with announcement number CN116340437B discloses a multi-clustering method for large-scale multi-source heterogeneous data, which relates to the field of data processing technology. The method includes: preprocessing heterogeneous data from different sources using ETL tools to convert them into a unified target data format; then classifying them according to voltage level, equipment type, and acquisition measurement type; constructing a topology analysis engine for the classified multi-source heterogeneous datasets based on the interrelationships between the distribution network and network components; eliminating datasets that do not meet the requirements based on topology analysis to obtain the dataset to be fused; performing observation coefficient analysis on the dataset to be fused and allocating a corresponding number of processing terminals to fuse the dataset, improving data fusion efficiency, and achieving cross-composite in-depth analysis of historical and near-real-time data of the distribution network; outputting the data fusion results for distribution network staff to study and analyze, providing guidance for refined energy management and user services, and enabling timely fault warnings to improve power safety.

[0004] For example, the invention patent with announcement number CN119884229B discloses a method and system for processing multi-source heterogeneous data. The method includes: collecting data from different target systems and adding identification tags for each data point corresponding to the target system; constructing multiple real-time pipelines parallel to the ETL path to process the collected data, writing failed parsing data into an error data area and generating warning messages; removing failed parsing data from the collected data and writing it into a temporary storage area; writing the output of the real-time data processing system and / or the output of the ETL path into a data warehouse; creating visualized dynamic reports using data in the data warehouse, analyzing and predicting the dynamic report data using a pre-trained machine learning model, and writing the prediction results into the dynamic reports to predict inventory demand and identify supplier risks.

[0005] However, such data analysis solutions generally focus on result labeling and isolated operation identification, lacking in-depth analysis of cross-channel collaborative paths, chain operation structures, and resource reuse trajectories during the behavioral process. Especially in complex scenarios such as multiple sliding window overlays, command injection masking, and path jump camouflage, it is difficult to identify latent data leakage chains and constructed evasion behaviors in real time. In addition, existing tools are mostly based on static auditing of single-source behavior logs, making it difficult to integrate the dynamic correlations between heterogeneous signals such as video jumps, image generation, USB writing, and parameter referencing. This results in a lack of effective modeling mechanisms for the temporal continuity, resource path consistency, and command call integrity between chain operation segments, severely restricting the accurate identification and response generation of high-risk chain behaviors.

[0006] Therefore, there is an urgent need to design a real-time streaming analysis method and system based on multi-source heterogeneous data. Summary of the Invention

[0007] Technical problems to be solved

[0008] To address the shortcomings of existing technologies, this invention provides a real-time streaming analysis method and system based on multi-source heterogeneous data. This solves the problem that in the daily use scenarios of high-definition video surveillance platforms, there is a lack of dynamic identification mechanisms for chain-like leakage behaviors completed by multi-terminal collaborative operations, making it difficult to identify real high-risk operation paths in real time.

[0009] Technical solution

[0010] To achieve the above objectives, the present invention provides the following technical solution: a real-time streaming analysis method and system based on multi-source heterogeneous data, comprising: S1, collecting interactive behavior data, external access data, and potential instruction scheduling data during terminal operation, and preprocessing the collected interactive behavior data, external access data, and potential instruction scheduling data to construct a standardized behavior sequence dataset; S2, evaluating the activity of multi-channel behaviors within a sliding window based on the standardized behavior sequence dataset and video jump frequency, and triggering the construction of a chain operation structure based on the evaluation results; S3, analyzing the implicit coupling characteristics between multi-channel behaviors within a sliding window based on the standardized behavior sequence dataset, and completing the operation chain and marking potential risks based on the analysis results; S4, comprehensively analyzing the aggregation tightness of operations within a sliding window using the multi-channel behavior activity evaluation results and implicit coupling characteristic analysis results as input, and driving an early warning response based on the analysis results; S5, transforming the highly matched chain operation structure into a structured early warning event based on the calculation results of the operation chain aggregation strength value, and triggering real-time identification and early warning push of potential data leakage chains.

[0011] Furthermore, the specific steps for collecting interactive behavior data, external access data, and potential command scheduling data during the operation of the terminal, and preprocessing the collected interactive behavior data, external access data, and potential command scheduling data to construct a standardized behavior sequence dataset are as follows: Interactive behavior data during terminal operation is collected through the terminal interaction log module. This interactive behavior data includes: video playback jump counts, number of screenshots, screen dwell time, total number of operations, and total number of screenshot files. Simultaneously, the average number of screenshot files generated is calculated and recorded. External access data during terminal operation is collected through the external access monitoring component. This external access data includes: the number of outgoing commands involving images, the number of duplicate names of referenced image files, the minimum time difference between screenshotting and sending an outgoing command, and the number of USB writes. The system records the number of times operations on the same file and image are repeated. Potential instruction scheduling data is collected via a command call tracker, including: the total number of operation commands, the number of mergeable chain segments identified in the current aggregation process, and the number of times nodes referencing the same image path are referenced by multiple behavior nodes. It also records the number of video playback command calls made by end users on the video platform. Zero-mean normalization is used to standardize the interaction behavior data, external access data, and potential instruction scheduling data. The standardized data is then normalized to eliminate differences in cross-channel behavior expression amplitude caused by variations in operation frequency, access duration, and instruction call complexity. A standardized behavior sequence dataset is then constructed and stored uniformly.

[0012] Furthermore, the specific steps for evaluating the activity level of multi-channel behavior within the sliding window based on the standardized behavior sequence dataset and the video jump frequency are as follows: extract the number of video playback jumps, the number of screenshots, and the number of video playback command calls by the terminal user in the video platform from the standardized behavior sequence dataset, square them respectively, and then sum them to obtain the operation feature strength value; extract the number of outgoing commands involving images and the total number of operation commands, divide the number of outgoing commands involving images by the total number of operation commands and then add one to obtain the outgoing command weight value; multiply the operation feature strength value and the outgoing command weight value and then take the logarithm to obtain the collaborative behavior matching value.

[0013] Furthermore, the specific steps for constructing the chain operation structure based on the evaluation results are as follows: Real-time comparison of the collaborative behavior matching value and the recognition threshold of the current sliding window segment: When the collaborative behavior matching value is less than or equal to the recognition threshold, it is determined to be a non-collaborative behavior state, maintaining the current behavior flow's normal recording mode, only archiving operation segments, and temporarily not triggering further analysis and linkage judgment; When the collaborative behavior matching value is greater than the recognition threshold, it is determined to be a potential collaborative behavior state, extracting all image paths within this window that match the screenshot file naming rules and recording the source directory and generation time, marking whether it is consistent with the default screenshot path; binding the terminal ID, USB device identification code, and instruction triggering source process involved in the chain, generating a cross-index relationship of behavior between devices, tracing back the playback behavior before and after the screenshot, extracting the jump segment timestamps before and after triggering the screenshot, and locking the user-focused segment duration and video segment sensitivity.

[0014] Furthermore, the specific steps for analyzing the implicit coupling characteristics between multi-channel behaviors within a sliding window based on a standardized behavior sequence dataset are as follows: The difference between the total number of operations within the sliding window and the number of repetitions of operations on the same file and image, plus the number of name repetitions of referenced image files and minus the number of USB writes, is used as the numerator, and the total number of operations within the sliding window is used as the denominator to obtain the operation distribution dispersion. The minimum transmission time difference from screenshot to outgoing command is extracted, the absolute value of the difference between the minimum transmission time difference and the time interval adjustment coefficient is calculated and divided by the time interval adjustment coefficient. This value is then multiplied by the ratio of the total number of screenshot files generated within the current sliding window to the average number of screenshot files generated in all sliding window segments, and the logarithm is added to obtain the path temporal offset value. The operation distribution dispersion is multiplied by the path temporal offset value to obtain the cross-channel coupling strength value.

[0015] Furthermore, the specific steps for completing the operation chain and marking potential risks based on the analysis results are as follows: When the cross-channel coupling strength value continuously increases in three consecutive sliding windows, and the increase between each window exceeds 15% of the increase of the previous window, immediately starting from the screenshot generation event, track whether the USB write path and outgoing command parameters reference image resources within the next 10 seconds, construct a cross-channel operation sequence chain, and synchronously record the image file name, generation directory, and write device ID involved in the chain. Perform bidirectional verification on the terminal behavior of continuously referencing images in a short period of time to determine whether there is behavior deception that circumvents the path matching rules by copying-renaming-outgoing; when the cross-channel coupling strength value fluctuates more than 30% of the previous window in three consecutive sliding windows, and the interval between each high-low switch is less than two seconds, merge and splice multiple highly jumpy sliding window segments to combine non-continuous screenshot-write-command behaviors. The system is reorganized into delayed chain operation segments, identifying path breakpoints and drop points in resource call frequency. Command call anomaly comparison is initiated to determine if the current terminal is bypassing the standard identification process by dynamically injecting parameters and temporarily splicing paths. When the cross-channel coupling strength value fluctuates within 5% above and below the average of the overall cross-channel coupling strength value within five consecutive sliding windows, and the maximum fluctuation is less than 0.1, the image files generated, the written USB paths, and the reference path fields within the current sliding window are checked item by item. The resource namespace overlap rate and file generation time stability index are calculated. Further analysis is conducted to determine if there are buffered behavior segments in the terminal where image generation lags behind video jump operations but precedes command execution. Simultaneously, a path consistency tree is constructed for all image resource reference paths, screenshot generation paths, and USB write paths to identify path breakpoints and path splicing positions, and to determine if path tampering and naming variations exist.

[0016] Furthermore, the specific steps for comprehensively analyzing the aggregation tightness of operations within the sliding window, using the multi-channel behavior activity assessment results and implicit coupling feature analysis results as input, are as follows: Obtain the collaborative behavior matching value and the cross-channel coupling strength value; subtract the collaborative behavior matching value from one and then multiply it by the cross-channel coupling strength value to obtain the collaborative offset coupling value; use the collaborative offset coupling value as the numerator, add one to the screen dwell time, and take the logarithm as the denominator to obtain the behavior stagnation adjustment value; calculate the ratio of the number of times nodes referencing the same image path to the number of mergeable chain segments identified in the current aggregation process, and add one to obtain the path reuse enhancement value; multiply the behavior stagnation adjustment value by the path reuse enhancement value to obtain the current operation chain aggregation value.

[0017] Furthermore, the specific steps for driving the early warning response based on the analysis results are as follows: Real-time comparison of the current operation chain aggregation value with the chain integrity aggregation threshold, which includes a first aggregation threshold and a second aggregation threshold: When the operation chain aggregation value is less than or equal to the second aggregation threshold, it is determined that the current behavioral structure exhibits loose characteristics, and the chain operation has not yet formed a closed loop. Key behavioral nodes such as screenshots, image processing, and outgoing commands are retained as potential chain endpoints, and key paths and their timestamp information are recorded. When the operation chain aggregation value is greater than the second aggregation threshold but less than or equal to the first aggregation threshold, it is determined to be in the chain aggregation transition stage. Node reorganization and edge completion are performed on cross-channel operation paths, prioritizing the integration of behavioral segments with strong path continuity and consistent reference resources. Simultaneously, the frequency of image resource occurrences within the chain, consistency of external parameters, and device ID matching are collaboratively verified to assess the trend of evolution towards a stable structure, and the path overlap rate and behavior convergence index are statistically analyzed. When the operation chain aggregation value is greater than the first aggregation threshold, it is determined that the chain structure has been stably formed. The current chain structure is topologically frozen and a unique chain identifier ID is generated. At the same time, the resource path tracing mode is entered, hash fingerprints are generated for the image files involved in the chain, and event logs are recorded. The terminal prioritizes matching and risk linkage warning for subsequent behaviors with the same chain head node starting path, synchronously executes behavior archiving and task backtracking, and performs automatic multi-target comparison and repeated reference monitoring for high-frequency image files to assist in identifying and avoiding path and command spoofing behaviors.

[0018] Furthermore, the specific steps for converting the highly matched chain operation structure into a structured early warning event based on the calculation result of the operation chain aggregation strength value, and triggering the real-time identification and early warning push of potential data leakage chains are as follows: Based on the calculation result of the operation chain aggregation value, the chain operation structure constructed in multiple sliding windows is deeply analyzed and converted into a structured behavioral event with operation path, time span and channel coverage information; all aggregated chain structures are normalized in fields and reorganized in timeline, and key nodes involving screenshot, USB write, and image parameter injection are extracted, and the covered physical channels, path objects and cross-node trigger intervals are analyzed. When multiple key nodes in the chain structure reference the same image file and have the same directory prefix, naming template and path consistency characteristics that are continuously distributed within the generation time period, it is determined to be a potential chain data leakage chain. All core nodes of the operation chain are assigned a unique identifier and a structured alarm event is generated. At the same time, an early warning data packet is constructed and pushed to the behavioral alarm processing center.

[0019] The second aspect of this invention provides a real-time streaming analysis system based on multi-source heterogeneous data, comprising: a multi-channel data access and standardization processing module for collecting interactive behavior data, external access data, and potential instruction scheduling data during terminal operation, and preprocessing the collected interactive behavior data, external access data, and potential instruction scheduling data to construct a standardized behavior sequence dataset; a multi-source behavior segment parallel sliding window matching module for evaluating the activity of multi-channel behaviors within the sliding window based on the standardized behavior sequence dataset and video jump frequency, and triggering the construction of a chain operation structure based on the evaluation results; and implicit coupling behavior. The relationship building module analyzes the implicit coupling characteristics between multi-channel behaviors within a sliding window based on a standardized behavior sequence dataset, and completes the operation chain and marks potential risks based on the analysis results. The operation chain aggregation module comprehensively analyzes the aggregation tightness of operations within the sliding window using the multi-channel behavior activity assessment results and implicit coupling characteristic analysis results as input, and drives the early warning response based on the analysis results. The linkage response marking and early warning generation module transforms the highly matched chain operation structure into a structured early warning event based on the operation chain aggregation strength value calculation results, and triggers the real-time identification and early warning push of potential data leakage chains.

[0020] Beneficial effects

[0021] The present invention has the following beneficial effects:

[0022] (1) The real-time streaming analysis method and system based on multi-source heterogeneous data, by constructing a linkage calculation mechanism between cross-channel coupling strength value and collaborative behavior matching value, identifies chain-like leakage paths such as screenshotting, writing, and outward transmission in terminal behavior, realizes full-process tracking of potential cross-channel data leakage behavior, and effectively breaks through the problem of traditional behavior auditing that it is impossible to establish a chain for identifying scattered and isolated actions.

[0023] (2) The real-time streaming analysis method and system based on multi-source heterogeneous data, by designing the operation chain aggregation intensity value calculation method, performs topological merging and operation path fusion on the behavioral structure graphs identified in multiple sliding windows, dynamically extracts the complete chain operation structure, and transforms it into structured early warning events, effectively improving the system's linkage recognition capability and response efficiency for complex behavioral construction patterns.

[0024] (3) This real-time streaming analysis method and system based on multi-source heterogeneous data introduces a chain behavior fluctuation trend identification mechanism and combines the continuous window trend change of coupling strength value to distinguish the evolution states of chain behavior such as formation, concealment and latency, which significantly enhances the system's ability to perceive abnormal behavior trends in advance and the accuracy of risk classification.

[0025] (4) This real-time streaming analysis method and system based on multi-source heterogeneous data, through chain behavior buffering and structure reconstruction mechanism, performs delayed aggregation processing on operation chain segments that have not completed closed-loop structure in continuous sliding windows, and combines path consistency tree and node naming rule comparison logic to dynamically restore path breakpoints and hidden behavior splicing positions, which significantly enhances the platform's robustness in identifying evasion behaviors such as slow triggering, path changing, and renaming in complex attack chains and its chain building and recovery capabilities.

[0026] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0027] Figure 1 This is a flowchart of a real-time streaming analysis method based on multi-source heterogeneous data according to the present invention.

[0028] Figure 2 This is a structural diagram of a real-time streaming analysis system based on multi-source heterogeneous data according to the present invention.

[0029] Figure 3 This is a line graph showing the aggregation value of the operation chain involved in this invention;

[0030] Figure 4 This is the image reference flow map involved in the present invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Please see Figures 1-4This invention provides a technical solution: a real-time streaming analysis method and system based on multi-source heterogeneous data, comprising: S1, collecting interactive behavior data, external access data, and potential instruction scheduling data during terminal operation, and preprocessing the collected interactive behavior data, external access data, and potential instruction scheduling data to construct a standardized behavior sequence dataset; S2, evaluating the activity of multi-channel behaviors within a sliding window based on the standardized behavior sequence dataset and video jump frequency, and triggering the construction of a chain operation structure based on the evaluation results; S3, analyzing the implicit coupling characteristics between multi-channel behaviors within the sliding window based on the standardized behavior sequence dataset, and completing the operation chain and marking potential risks based on the analysis results; S4, comprehensively analyzing the aggregation tightness of operations within the sliding window using the multi-channel behavior activity evaluation results and implicit coupling characteristic analysis results as input, and driving an early warning response based on the analysis results; S5, transforming the highly matched chain operation structure into a structured early warning event based on the calculation results of the operation chain aggregation strength value, and triggering real-time identification and early warning push of potential data leakage chains.

[0033] Specifically, the steps for collecting interactive behavior data, external access data, and potential instruction scheduling data during terminal operation, and preprocessing the collected interactive behavior data, external access data, and potential instruction scheduling data to construct a standardized behavior sequence dataset are as follows:

[0034] The terminal interaction log module collects interaction behavior data during terminal operation. The interaction behavior data includes: number of video playback jumps, number of screenshots, screen dwell time, total number of operation actions and total number of screenshot files. At the same time, the number of screenshots generated in each sliding window is counted, and the average number of screenshot files generated is calculated and recorded for subsequent time balance correction of behavior activity.

[0035] External access data during terminal operation is collected through an external access monitoring component. The external access data includes: the number of outgoing commands involving images, the number of repeated names of referenced image files, the shortest time interval between screenshot and outgoing command, and the number of USB writes. At the same time, the number of repeated operations of the same image and file in multiple behavior segments is recorded to evaluate the call density of resource paths and the coupling trend across command paths.

[0036] The potential instruction scheduling data is collected by the command call tracker. The potential instruction scheduling data includes: the total number of operation instructions in the current sliding window, the number of mergeable chain segments identified during the aggregation analysis, the number of times that multiple behavior nodes reference the same image path, and the number of times the video playback instruction call triggered by the end user in the video platform is recorded in real time to characterize the cross-channel response consistency index in the behavior rhythm.

[0037] The three types of data are standardized by using the zero-mean standardization algorithm to uniformly measure the fluctuation trend and deviation of various behavioral indicators. After standardization, normalization is performed to effectively eliminate the data scale inconsistency caused by differences in behavioral operation frequency, access command call complexity and terminal task duration, and construct a standardized behavioral sequence dataset for cross-channel behavioral fusion analysis.

[0038] This implementation plan achieves unified collection, standardized processing, and structured modeling of multi-source behavioral data during terminal operation, providing high-quality data support for subsequent chain operation identification and cross-channel coupling analysis. By comprehensively collecting interactive behavior data, external access data, and potential command scheduling data, it can cover dynamic behavioral characteristics across multiple dimensions of user operations, resource calls, and command triggers. Combined with zero-mean standardization and normalization, it effectively solves the problem of imbalanced behavioral expression amplitude caused by different indicator scales between different channels, improving the accuracy and robustness of subsequent multi-channel behavioral activity assessment and operation chain construction within the sliding window, thus laying the foundation for the identification and early warning of complex chain behaviors.

[0039] Specifically, based on the standardized behavior sequence dataset, the evaluation of multi-channel behavior activity within the sliding window is carried out by combining video jump frequency with the following steps: extract the number of video playback jumps, the number of screenshots, and the number of video playback command calls by the end user on the video platform from the standardized behavior sequence dataset, square them respectively, and then sum them to obtain the operation feature strength value; extract the number of outgoing commands involving images and the total number of operation commands, divide the number of outgoing commands involving images by the total number of operation commands and add one to obtain the outgoing command weight value; multiply the operation feature strength value and the outgoing command weight value and then take the logarithm to obtain the collaborative behavior matching value.

[0040] The formula for calculating the collaborative behavior matching value is:

[0041]

[0042] In the formula, This indicates the number of times video playback jumps, used to measure the intensity of a user's behavior of frequently switching playback segments in a short period of time. It is an important feature value that characterizes the instability of their operation rhythm and the accuracy of resource positioning. It comes from the instruction log records of video playback control events, including fast forward, rewind, and dragging the progress bar, in the data acquisition module. The number of screenshots indicates the frequency with which a user actively extracts static visual information in a specific task and scenario, reflecting the information extraction density and operation segmentation characteristics. It originates from the event call sequence of the image processing instruction acquisition module for the terminal screenshot operation. This indicates the number of times a user invokes video playback commands on the video platform. It reflects the frequency with which users actively control video resource playback, demonstrating their initiative and controllability in operating video content. It originates from the identification and statistics of internal video playback commands, including start, pause, resume, and speed adjustment, in the terminal control command acquisition module. This indicates the number of outgoing commands involving images. It is used to measure whether a user has the behavior of transferring image resources across channels. It is a key trigger indicator for the image propagation path in the chained operation chain. It comes from the recognition results of the image resource reference field in the upload, send, and share behaviors in the outgoing command parsing module. This represents the total number of operation commands. It serves as a standardized basis and is a reference value for intensity normalization and structure ratio of other behavioral characteristic values. It is the sum of all valid control commands executed by the user within the sliding window time period and is derived from the complete parsing results of the terminal command event queue.

[0043] This implementation scheme comprehensively evaluates users' operational activity, information extraction density, and image dissemination intent in multi-source visual tasks by integrating the frequency of users' video navigation operations, screenshot behavior, video playback control behavior, and the proportion of image outgoing commands. A higher collaborative behavior matching value indicates a highly collaborative operational pattern between user behavior in video retrieval, screenshot extraction, and image outgoing, forming the core node of a chain-like image propagation path and serving as a key input indicator for chain-like risk identification.

[0044] Specifically, the steps for constructing the chain operation structure based on the evaluation results are as follows:

[0045] Real-time comparison of the collaborative behavior matching value and the recognition threshold of the current sliding window segment: The collaborative behavior matching value is calculated by three indicators: the time overlap of the multi-channel behavior path within the sliding window, the consistency of resource reference, and the synchronization rate of operation rhythm. Combined with the image naming similarity, instruction triggering interval, and device call frequency parameters in the standardized behavior sequence dataset, the current collaborative behavior matching value is obtained through weighted fusion.

[0046] When the matching value of the collaborative behavior is less than or equal to the recognition threshold, it is determined to be a non-collaborative behavior state. The behavior segment is marked as a normal operation flow, the normal recording mode of the current behavior flow is maintained, and screenshots, instructions and peripheral operation segments are archived in chronological order. Chain structure analysis and inter-device behavior association judgment are not triggered temporarily, reducing the consumption of computing resources and providing background data for subsequent cumulative behavior trends.

[0047] When the matching value of collaborative behavior exceeds the identification threshold, it is determined to be a potential collaborative behavior state, and the process of behavior chain reconstruction and resource path tracking is automatically initiated. All image paths in this window that match the naming rules of screenshot files are extracted, and their source directory, generation time, naming format and whether they are consistent with the default screenshot path are recorded. At the same time, it is determined whether there are any evasion behaviors such as directory switching and renaming. Furthermore, the unique identifier of the terminal device involved in the chain, the corresponding USB device identification code and the source process of the external command are bound, and the video behavior backtracking mechanism is started simultaneously. The video playback jump records before and after the screenshot operation are extracted, and the start and end timestamps, focus dwell time and playback operation frequency of the corresponding segment are obtained. Combined with the content sensitivity model, it is determined whether the screenshots are concentrated in high-risk segments, so as to achieve sensitive source tracing and structured marking of the collaborative behavior triggering period.

[0048] In this implementation scheme, by comparing the matching values ​​of collaborative behaviors within a sliding window with a set recognition threshold in real time, ordinary behavior flows and potential cross-channel collaborative behaviors are identified and distinguished. This enables dynamic labeling and structured analysis of behavior segments with consistent resource references, synchronized operation rhythms, and time overlap. When a potential collaborative behavior state is identified, image paths, device information, and command sources can be automatically extracted to establish cross-relationships between terminal behaviors. Combined with video content review to focus on user operation intentions, this provides crucial support for subsequent chain behavior reconstruction, resource path tracking, and anomaly warning triggering, significantly improving the perception capability and linkage recognition accuracy of complex collaborative behavior features.

[0049] Specifically, based on a standardized behavior sequence dataset, the implicit coupling characteristics between multi-channel behaviors within a sliding window are analyzed using the following steps: The difference between the total number of operations within the sliding window and the number of repetitions of operations on the same file and image, plus the number of name repetitions of referenced image files, minus the number of USB writes, is used as the numerator, and the total number of operations within the sliding window is used as the denominator to obtain the operation distribution dispersion. The minimum transmission time difference from screenshot to outgoing command is extracted, and the absolute value of the difference between the minimum transmission time difference and the time interval adjustment coefficient is calculated and divided by the time interval adjustment coefficient. This value is then multiplied by the ratio of the total number of screenshot files generated in the current sliding window to the average number of screenshot files generated in all sliding window segments, and the logarithm is added to obtain the path temporal offset value. Finally, the operation distribution dispersion is multiplied by the path temporal offset value to obtain the cross-channel coupling strength value.

[0050] The formula for calculating the cross-channel coupling strength is:

[0051] ;

[0052] In the formula, A represents the total number of operations within the sliding window, which is used to measure the overall interaction density of the user in the current analysis window. It comes from the real-time recording of operation logs in the behavior data acquisition module, including the statistical results of behavior actions such as mouse clicks, file operations, and input commands. This indicates the number of times operations on the same file and image are repeated, reflecting the high-frequency operation behavior of users on specific resources. It is derived from the aggregated statistical results of operation events targeting the same resource path in the terminal behavior sequence. This indicates the number of repeated names of referenced image files, used to identify whether there is a behavior of generating similar named files multiple times during resource utilization. It is derived from the comparison between the image generation directory and the naming rules, and the duplicate count of similar structured file names is extracted. This indicates the number of USB write operations. The number of USB write operations is an important reference for determining whether a user has a tendency to export external data. It is derived from the capture and statistics of USB write events in the device port monitoring module. It represents the minimum time difference between taking a screenshot and sending an external command, measuring the tightness of the response between the user using the image for command execution and sending the file. It is calculated from the difference between the screenshot generation timestamp and the image parameter call time in the command execution log. This indicates the total number of screenshot files generated within the current sliding window, reflecting the intensity of image acquisition at the current stage. It is derived from the cumulative count of operation screenshot events by the image acquisition monitoring module. 1 represents the average number of screenshot files generated across all sliding window segments, used as a standard reference value to measure the deviation of current screenshot activity. It is derived from the average index obtained from the statistical analysis of all sliding window image generation logs. β represents the time interval adjustment coefficient, used to measure the deviation of the response rhythm between screenshot actions and subsequent outgoing commands. Its value ranges from 0.5 to 2.5, and it is a rhythm-sensitive weighting factor in the stability evaluation process of the screenshot-command linkage relationship. It is derived from the analysis results of the fluctuation range and mean deviation ratio of the minimum time difference sequence between screenshot commands and outgoing commands in historical sliding windows. The specific calculation steps are as follows: First, extract the time interval value between each pair of screenshot actions and subsequent outgoing commands involving image resources in the current sliding window, generating... The system first analyzes the time difference sequence and calculates the minimum, mean, and standard deviation of the time difference within the current window to characterize the response delay distribution. Second, it extracts the steady-state characteristics of the screenshot-outgoing response interval recorded in historical stable window phases, including the mean, variance, and minimum offset range of the time difference distribution, to construct a baseline time response template. Then, it compares the time interval characteristics of the current window with the historical baseline template, calculating the response synchronization matching degree, rhythm drift index, and proportion of high deviation segments to determine whether there are rhythm misalignments, delays, or preceding abnormalities in the current phase's screenshot and instruction responses. Finally, it combines the rhythm adjustment tolerance range under different task types to weight and summarize the above indicators, generating the time interval adjustment coefficient β for the current window. When the interval between screenshots and outgoing actions in the current window is generally large, highly variable, and significantly deviates from the historical stable rhythm, the β value increases, strengthening the evaluation weight of chain-like rhythm anomalies within the window. Conversely, when the current time response characteristics are highly consistent with the baseline rhythm and the rhythm continuity is good, the β value decreases to avoid over-responding to minor rhythm changes. By dynamically adjusting the β value, the ability to adapt to and judge the rationality of chain responses under different rhythm types can be enhanced, and the robustness and analytical accuracy of the chain construction formula to the problem of inconsistency between timing disturbances and responses can be improved.

[0053] This implementation measure assesses whether a user's screenshotting behavior within the current sliding time window poses a potential risk of data leakage, particularly whether it could constitute a chain-like output path across operation channels. The formula calculates the final suspiciousness strength value using two parts: the first part calculates the proportion of effective operations remaining after removing duplicate accesses, naming anomalies, and write operations from all operations within the current window, to assess the true density of operation activity; the second part starts with the minimum time interval between the screenshot and the outgoing command, combining a time interval adjustment coefficient to calculate whether the latency deviates from the normal behavioral rhythm, and further combines the deviation between the number of screenshots within the current window and the historical average number of screenshots to determine whether the current behavior exhibits a trend of dense screenshotting and rapid outgoing. A higher suspiciousness strength value obtained from the combined two parts indicates that the current screenshotting behavior is more likely to become the starting point of a chain-like output operation, triggering subsequent link tracing and early warning mechanisms to improve the ability to identify and respond to potential hidden data leakage behaviors.

[0054] Specifically, the steps for completing the operational chain and marking potential risks based on the analysis results are as follows:

[0055] When the cross-channel coupling strength value continues to rise in three consecutive sliding windows, and the increase between each window exceeds 15% of the increase of the previous window, it is immediately determined that the terminal behavior is in the initial stage of the chain data extraction behavior and the path focusing mode is activated simultaneously: at this time, the screenshot generation event is used as the starting node of the operation chain, and all USB write paths and outgoing command parameters that occur within the next 10-second time window are tracked. The focus is on searching for whether there is a direct reference to image resources. At the same time, the image file name, generation directory and USB write device ID involved in the completed cross-channel operation sequence chain are automatically identified. The two-way verification mechanism is further enabled to perform forward path association and reverse path comparison for the behavior of continuously referencing image resources, and to identify whether there is a path deception behavior constructed by copying-renaming-outgoing, thus avoiding the high-risk operation mode of traditional path matching rules.

[0056] When the cross-channel coupling strength value fluctuates by more than 30% of the previous window within three consecutive sliding windows, and the interval between each high-low switching is less than two seconds, the current behavior mode is judged to be in the intentional fuzzification stage of chained operations, and the behavior fuzziness segment aggregation mechanism is entered: multiple sliding window contents with high jumps and discontinuous behavior segments are automatically integrated and recombined into delayed chained operation segments through splicing processing. The time interval, resource call frequency, and path consistency between screenshot—USB write—command behavior are re-verified, the path breakpoint and behavior jump point are identified, and command call anomaly comparison is initiated. Rule matching is performed on the dynamic parameter injection, temporary path splicing, and repeated call features appearing in the behavior path to determine whether the terminal has bypassed the standard identification process illegally, triggering anomaly marking and operation compression mode. For example... Figure 4 The image reference flow graph clearly illustrates the path jump relationships, breakpoints, and behavior aggregation strategies between screenshots, write-outs, and commands in a structured manner. The top of the graph shows two sets of behavior paths: screenshot generation A → USB write-out A → external command A constitutes a partial chain, while screenshot generation B → external command B represents a path jump. Both are aggregated at the path breakpoint nodes and enter the analysis process. In the middle layer structure, two types of identification mechanisms are applied to the broken chains: first, named template fitting, which searches for name field perturbations, timestamp spoofing, and extension spoofing in image resource references; second, dynamic injection identification, which determines whether the command path bypasses the identification rules through temporary script splicing and parameter embedding. The results of these identification operations will be uniformly sent to the pool of chains to be merged. Behavior segments with incomplete structures but clear reference characteristics will be temporarily stored, awaiting subsequent sliding window completion before being integrated into the main chain. The behavior snapshot record node at the bottom of the graph represents a complete runtime stack snapshot of the terminal behavior of all referenced images during periods of structural instability. This snapshot packages and archives information on the call flow, parameter paths, and operation trajectories for subsequent tracing and auditing. The entire graph demonstrates how, in chain-structure breakage scenarios, path aggregation, anomaly identification, and chain pool temporary storage mechanisms can preserve evidence of potential violations and provide structural support for behavior reconstruction and risk assessment. The nodes in the graph use color-coded layers to highlight the hierarchical relationships between behavior sources, structural breaks, identification mechanisms, and operations, enhancing the logical clarity and processing depth of the chain-extraction behavior visualization model. The structured approach clearly indicates the path jump relationships between screenshots, write-outs, and instructions, as well as the break nodes and behavior aggregation strategies, forming a key basis for identifying chain-masking behaviors.

[0057] When the cross-channel coupling strength value fluctuates within 5% above and below the overall average within five consecutive sliding windows, and the maximum fluctuation is less than 0.1, the weak coupling behavior observation mechanism is entered: focusing on the potential delayed chain behavior construction process, the image file generated in the current sliding window, the written USB path, and the reference path field in the outgoing command are taken as the main analysis objects, and the structure is sampled item by item. The characteristics of resource namespace overlap rate and file generation time stability index are calculated. The temporal relationship between image generation time and video jump operation and command execution behavior is further compared, and the buffer behavior segment with delayed image generation behavior but early command triggering is extracted as a suspected chain segment. At the same time, the path consistency tree of all image resource reference path, screenshot generation path and USB write path is constructed to identify path breakpoints and splicing positions, and to determine whether there are abnormal behaviors such as path naming variation, field tampering and path nesting.

[0058] This implementation scheme dynamically identifies cross-channel collaborative behavior construction patterns and distinguishes between high-risk chain-like data leakage paths and low-coupling behavior segments, thereby improving the analytical capabilities for complex cross-channel concealed behaviors and the accuracy of abnormal path identification. By finely discerning the changing trends of cross-channel coupling strength values ​​within a continuous sliding window, focusing tracking, path splicing and reconstruction, and consistency verification mechanisms are activated in the initial behavior stage, the fuzzy construction stage, and the latent stage, respectively. This enables multi-dimensional analysis of high-frequency image referencing, path reconstruction avoidance, and buffer behavior lag characteristics, thereby ensuring real-time perception of chain-like behaviors and the ability to construct structured chains.

[0059] Specifically, using the multi-channel behavior activity assessment results and implicit coupling feature analysis results as inputs, the comprehensive analysis of the tightness of operation aggregation within the sliding window is carried out in the following steps: Obtain the cooperative behavior matching value and the cross-channel coupling strength value; subtract the cooperative behavior matching value from the cross-channel coupling strength value and multiply it by the cooperative behavior matching value to obtain the cooperative offset coupling value; use the cooperative offset coupling value as the numerator, add one to the image dwell time, and take the logarithm as the denominator to obtain the behavior stagnation adjustment value; calculate the ratio of the number of times nodes referencing the same image path to the number of mergeable chain segments identified in the current aggregation process, and add one to obtain the path reuse enhancement value; multiply the behavior stagnation adjustment value and the path reuse enhancement value to obtain the current operation chain aggregation value.

[0060] The formula for calculating the aggregation value of the operation chain is:

[0061] ;

[0062] In the formula, M represents the cooperative behavior matching value, which represents the degree of coupling between different channel behaviors in operation timing, resource orientation and instruction response within the sliding window, and is used to characterize the synchronous correlation between operations; The value represents the strength of cross-channel coupling, indicating the overall degree of coordination between the behaviors of each channel within the current sliding window in terms of command triggering, resource invocation, and output path. It is used to measure the potential chain operation trend between different channels. The duration of screen focus is used to assess the synchronization between the focus behavior and the task rhythm. It is derived from continuous monitoring records of page focus duration, mouse stillness period, and video playback pause segment in the terminal interaction log; C represents the number of times nodes referencing the same image path, which is used to identify path reuse and resource reuse characteristics in the operation. It is derived from the consistency statistical analysis of the image resource path field in the instruction parameters, resource access path, and outgoing command fields. This indicates the number of mergeable chain segments identified in the current aggregation process, and the number of structural segments with merging characteristics among the behavioral chain segments identified in the current aggregation process. It is used to evaluate the reconstruction integrity and continuity of chain behavior, and is derived from the chain identification module's comprehensive judgment on the continuity of operation sequence, consistency of resource reference logic, and path connection density.

[0063] In this implementation example, the collaborative behavior matching value of Example 1 is set to 0.15, the cross-channel coupling relationship strength value is 1.22, the screen dwell time is 6.5, the number of identical node references is 12, and the number of mergeable chain segments is 3.

[0064] The collaborative behavior matching value of Example 2 is set to 0.35, the cross-channel coupling relationship strength value is 1.05, the screen dwell time is 5.2, the number of identical node references is 7, and the number of mergeable chain segments is 2.

[0065] The collaborative behavior matching value of Example 3 is set to 0.10, the cross-channel coupling relationship strength value is 1.78, the screen dwell time is 8.3, the number of identical node references is 18, and the number of mergeable chain segments is 4.

[0066] The collaborative behavior matching value of Example 4 is set to 0.40, the cross-channel coupling relationship strength value is 0.96, the screen dwell time is 4.1, the number of identical node references is 5, and the number of mergeable chain segments is 1.

[0067] The collaborative behavior matching value of Example 5 is set to 0.25, the cross-channel coupling relationship strength value is 1.30, the screen dwell time is 7.0, the number of identical node references is 15, and the number of mergeable chain segments is 5.

[0068] The collaborative behavior matching value of Example 6 is set to 0.05, the cross-channel coupling relationship strength value is 2.00, the screen dwell time is 9.4, the number of identical node references is 21, and the number of mergeable chain segments is 6.

[0069] The collaborative behavior matching value for Example 7 was set to 0.20, the cross-channel coupling strength value to 1.45, the screen dwell time to 6.8, the number of identical node references to 10, and the number of mergeable chain segments to 2. The operation chain aggregation value for each instance was calculated, as shown in Table 1.

[0070] Table 1. Aggregate Value Data of Operation Chain

[0071]

[0072] like Figure 3 As shown, this is a line graph of the aggregated values ​​of the operation chain provided in this application example. (See Table 1 and...) Figure 3 As can be seen, Example 6 has the highest operation chain aggregation value, reflecting strong cross-channel coupling, long screen dwell time, and high path repetition in this instance. This indicates that the terminal's operation chain structure is tight and the command triggering coordination is high at this stage, possessing strong data leakage risk identification value. It is suitable as a key monitoring target for priority execution of chain behavior reconstruction and source tracing analysis. In contrast, Example 4 has the lowest operation chain aggregation value. Although the coordinated behavior matching value is relatively high, it is limited by weak channel coupling, few path references, and insufficient chain segments, resulting in a low overall aggregation level. In the future, the analysis priority of this type of chain structure can be appropriately reduced, classifying it as a low-risk operation flow path. The operation chain aggregation value line chart can intuitively present the differences in chain complexity and aggregation strength of each instance, providing a quantitative basis for behavior pattern clustering and risk strategy stratification, and helping to dynamically define behavior screening priorities and optimize analysis resource allocation strategies.

[0073] Specifically, the steps for driving the early warning response based on the analysis results are as follows:

[0074] The current operation chain aggregation value is compared in real time with the chain integrity aggregation threshold, which includes a first aggregation threshold and a second aggregation threshold.

[0075] When the aggregation value of the operation chain is less than or equal to the second aggregation threshold, it is determined that the current behavior structure has loose characteristics and the chain operation has not yet formed a closed loop. The screenshot generation behavior, image processing call and external command submission identified in the current sliding window are marked as potential chain endpoints. The behavior channel number, file path, timestamp sequence and task process source corresponding to the operation node are recorded. At the same time, the operation chain is included in the structure buffer for dynamic backtracking processing.

[0076] When the operation chain aggregation value is greater than the second aggregation threshold and less than or equal to the first aggregation threshold, it is determined to be the chain aggregation transition stage. The cross-channel path fusion engine is started simultaneously to compare and correct the temporal relationship, resource path consistency and parameter injection mode of each behavior node in the sliding window. Node reorganization and edge chain segment completion are performed. Behavior segments with high resource name similarity, stable USB write path structure and consistent calling source process are aggregated first. The frequency of image resource occurrence, external parameter stability rate and device identification code matching degree are calculated. Combined with path overlap rate and behavior convergence index, an evolutionary stability assessment report is generated to determine whether the chain structure has a closed-loop evolution trend.

[0077] When the aggregation value of the operation chain exceeds the first aggregation threshold, it is determined that the chain structure has been stably formed. The current chain structure is immediately subjected to topology freezing, a unique chain identifier ID is automatically generated, and the resource path tracing mode is entered. All image files involved in the chain are extracted, their hash fingerprint values ​​are calculated and compared with the historical fingerprint database, and event logs, target device ports, and task trigger sources are recorded and written. Based on this, the chain head path is prioritized for identification, and subsequent actions involving similar path segments, duplicate naming formats, and abnormal splicing commands are quickly compared and risk-linked warnings are issued. Furthermore, high-frequency image resources within the chain undergo multi-target structure comparison, duplicate reference density detection, and path naming evolution analysis to identify potential evasion behaviors such as image copying and renaming, dynamic path splicing, and command spoofing, effectively improving the continuity, completeness, and leakage risk warning capabilities of chain structure identification.

[0078] This implementation scheme dynamically identifies the aggregation state and chain evolution stage of terminal behavior structures by comparing the aggregation value of the operation chain with the chain integrity aggregation threshold in real time. This allows for precise triggering of chain structure construction, path reorganization, and resource tracing mechanisms, enhancing the ability to identify the integrity, assess stability, and respond to early warnings of chain-like data leakage behavior. Its core significance lies in: identifying potential key nodes and recording operational trajectories before the chain is closed; performing node splicing, path verification, and stability assessment during the aggregation and evolution stage; and executing structure solidification, path tracing, and high-frequency image comparison monitoring after the closed loop is formed, achieving full-process control and root cause tracking of high-risk behavior chains.

[0079] Specifically, based on the calculation results of the operation chain aggregation strength value, the high-match chain operation structure is transformed into a structured early warning event, triggering real-time identification and early warning push of potential data leakage chains. The specific steps are as follows: Based on the calculation results of the operation chain aggregation value, the chain operation structure that has completed aggregation construction is identified and marked in each sliding window. Then, these chain structures are deeply analyzed, and the behavior action type, execution sequence and channel affiliation information of the nodes in the chain are extracted one by one, and they are transformed into structured behavior events containing operation path, time span, behavior rhythm and physical channel coverage information. During the analysis process, the screenshot generation path, USB write path and image injection parameter fields involved in the chain are unified through the field normalization module, and the timeline of all behavior nodes in the chain is reorganized by combining the operation occurrence timestamp to reconstruct the actual sequence logic of event triggering.

[0080] Based on this, key behavioral nodes involving screenshot generation, image writing, and parameter injection in the chain are extracted, and a comprehensive analysis is conducted on the path attribution, resource reference objects, and cross-node triggering time intervals of each key node. If multiple key nodes in the chain structure reference the same image file, and the image resource path has the same directory prefix, the same naming template format, and the file creation time is distributed within a continuous time period, further satisfying the joint characteristics of path consistency, file continuity, and high frequency of resource calls, then the chain is determined to have the risk of chain-like data leakage.

[0081] Subsequently, such chain structures are marked as potential abnormal chains, a unique identifier is assigned to all core nodes in the chain, and structured alarm events are generated based on the chain topology, resource path reuse frequency and time interval characteristics. At the same time, a complete early warning data packet is constructed and pushed to the behavior alarm processing center.

[0082] In this implementation scheme, the operation chains with high aggregation degree, tight behavior, and prominent cross-node collaboration characteristics are screened by the aggregation value of the operation chains in the chain operation structure within each sliding window. Then, combined with the indicators of path consistency, resource reuse rate, and node triggering time interval, chain structures with high frequency of image resource calls, consistent naming rules, and time clustering characteristics are identified and judged as potential chain data leakage behaviors. Finally, a unique identifier is assigned to each core node of the chain, a structured early warning event is output, and a complete early warning data packet is pushed to the behavior alarm processing center at the same time to support subsequent monitoring response and behavior auditing.

[0083] The second aspect of this invention provides a real-time streaming analysis system based on multi-source heterogeneous data, comprising: a multi-channel data access and standardization processing module, used to collect interactive behavior data, external access data, and potential instruction scheduling data during terminal operation; the interactive behavior data includes video playback jump counts, screenshot generation frequency, operation trigger type, and behavior path identifier; the external access data includes image reference counts, USB write path, and instruction parameter distribution; and the potential instruction scheduling data includes command call source, trigger window, and resource reference pointer; and preprocesses the collected interactive behavior data, external access data, and potential instruction scheduling data, eliminating frequency differences and data amplitude offsets through zero-mean standardization and normalization operations, and constructing a standardized behavior sequence dataset under a unified timeline;

[0084] The multi-source behavior segment parallel sliding window matching module is used to evaluate the activity of multi-channel behaviors within the sliding window based on a standardized behavior sequence dataset and video jump frequency. It calculates the channel collaborative activity index by statistically generating rhythm from screenshots, command call overlap, and USB write density, and triggers the construction of a chain operation structure based on the evaluation results. It identifies highly continuous operation segments with significant resource sharing characteristics within the sliding window and establishes a preliminary chain structure, while recording the node temporal sequence and path distribution characteristics.

[0085] The implicit coupling behavior relationship construction module is used to analyze the implicit coupling characteristics between multi-channel behaviors within a sliding window based on a standardized behavior sequence dataset. This includes the commonality of image resource references among multiple nodes, the overlap of path naming templates, and the similarity of instruction source processes. Based on the analysis results, the module completes the operation chain, automatically infers the location of relay nodes in sections with behavioral gaps and path interruptions, and marks potential risk nodes for subsequent aggregation judgment and anomaly comparison.

[0086] The operation chain aggregation module is used to comprehensively analyze the density of operation aggregation within the sliding window by taking the multi-channel behavior activity evaluation results and implicit coupling feature analysis results as inputs. By calculating the operation overlap rate, time interval and resource overlap path ratio of the nodes in the chain, it outputs the operation chain aggregation strength value and drives the early warning response based on the analysis results. When the aggregation value is higher than the set threshold, it triggers the subsequent linkage process.

[0087] The linkage response marking and early warning generation module is used to transform the highly matched chain operation structure into a structured early warning event based on the calculation result of the aggregation intensity value of the operation chain, and trigger the real-time identification and early warning push of potential data leakage chain. By extracting image resources of key nodes of the chain, writing out the path and instruction behavior, constructing a behavior index table and generating a unique alarm ID, the module also pushes alarm data packets for processing and traceability analysis.

[0088] In this implementation plan, the multi-channel data access and standardization processing module collects interactive behavior data, external access data, and potential instruction scheduling data, performs standardization and normalization processing on multi-dimensional data, constructs a behavior sequence dataset with consistent structure and time alignment, solves the heterogeneity problem of cross-channel data in terms of scale, rhythm, and attribute structure, and provides a unified input basis for subsequent chain behavior analysis.

[0089] The multi-source behavior segment parallel sliding window matching module evaluates the activity of channel behavior within the sliding window by introducing parameters such as video jump frequency, behavior triggering rhythm, and node response density. The module can identify high-intensity operation segments with similar operation times, concentrated resource references, and path continuity, and triggers the identification of preliminary chain structures based on the segment aggregation characteristics within the sliding window, completing the first round of coarse screening for chain construction.

[0090] The implicit coupling behavior relationship construction module infers and fills in logical gaps in the operation chain by detecting image resource reference similarity, path naming template consistency, and coupling characteristics of instruction triggering source processes. It also marks the behavior nodes with high coupling strength but not appearing in the initial chain with risk for subsequent aggregation and discrimination processing.

[0091] The operation chain aggregation module evaluates the degree of behavior aggregation from multiple dimensions, including the path overlap between chain nodes, the compactness of operation intervals, and the consistency of resource references. It also identifies potential chain-like risk structures based on the set aggregation threshold, providing a basis for triggering alarm generation.

[0092] The linkage response marking and early warning generation module uniquely identifies key nodes involved in screenshot generation, resource call, USB writing, and command injection within the high-aggregation chain, and simultaneously extracts meta-information such as behavior path, naming template, and call timestamp to construct a complete operation trajectory. Finally, the extracted results are packaged into an early warning data package and pushed to the behavior alarm processing center, supporting risk tracing and policy linkage execution.

[0093] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0094] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A real-time streaming analysis method based on multi-source heterogeneous data, characterized in that... include: S1 collects interactive behavior data, external access data, and potential instruction scheduling data during terminal operation, and preprocesses the collected interactive behavior data, external access data, and potential instruction scheduling data to construct a standardized behavior sequence dataset; S2, based on a standardized behavior sequence dataset, evaluates the activity of multi-channel behaviors within a sliding window by combining video jump frequency, and triggers the construction of a chain operation structure based on the evaluation results; S3, based on a standardized behavior sequence dataset, analyzes the implicit coupling characteristics between multi-channel behaviors within a sliding window, and completes the operation chain and marks potential risks based on the analysis results; S4 uses the results of multi-channel behavioral activity assessment and implicit coupling feature analysis as inputs to comprehensively analyze the aggregation tightness of operations within the sliding window, and drives the early warning response based on the analysis results; S5, based on the calculation results of the aggregation strength value of the operation chain, transforms the high-match chain operation structure into a structured early warning event, and triggers the real-time identification and early warning push of potential data leakage chains.

2. The real-time streaming analysis method based on multi-source heterogeneous data according to claim 1, characterized in that: The specific steps for collecting interactive behavior data, external access data, and potential instruction scheduling data during the operation of the terminal, and preprocessing the collected interactive behavior data, external access data, and potential instruction scheduling data to construct a standardized behavior sequence dataset are as follows: The terminal interaction log module collects interaction behavior data during terminal operation. The interaction behavior data includes: number of video playback jumps, number of screenshots, screen dwell time, total number of operation actions, and total number of screenshot files. At the same time, it calculates and records the average number of screenshot files generated. External access data is collected during the terminal's operation through the external access monitoring component. The external access data includes: the number of outgoing commands involving images, the number of duplicate names of referenced image files, the minimum time difference between taking a screenshot and sending an outgoing command, the number of USB writes, and the number of times the same operation is repeated for both files and images. The potential instruction scheduling data is collected by the command call tracker. The potential instruction scheduling data includes: the total number of operation instructions, the number of mergeable chain segments identified in the current aggregation process, the number of times that multiple behavior nodes reference the same image path, and the number of times the end user calls video playback instructions in the video platform. The zero-mean normalization algorithm is used to standardize the interaction behavior data, external access data, and potential instruction scheduling data. The normalized interaction behavior data, external access data, and potential instruction scheduling data are then normalized to eliminate the differences in cross-channel behavior expression amplitude caused by differences in operation frequency, access duration, and instruction call complexity. A standardized behavior sequence dataset is then constructed and stored uniformly.

3. The real-time streaming analysis method based on multi-source heterogeneous data according to claim 1, characterized in that: The specific steps for evaluating the activity level of multi-channel behavior within the sliding window based on the standardized behavior sequence dataset and video jump frequency are as follows: The number of video playback jumps, the number of screenshots, and the number of video playback command calls by end users on the video platform are extracted from the standardized behavior sequence dataset. The values ​​are then squared and summed to obtain the operation feature intensity value. Extract the number of outgoing commands involving images and the total number of operation commands. Divide the number of outgoing commands involving images by the total number of operation commands and then add one to obtain the weight value of the outgoing commands. The cooperative behavior matching value is obtained by multiplying the operation feature strength value by the outgoing instruction weight value and then taking the logarithm.

4. The real-time streaming analysis method based on multi-source heterogeneous data according to claim 1, characterized in that: The specific steps for constructing the chain operation structure based on the evaluation results are as follows: Real-time comparison of the collaborative behavior matching value and the recognition threshold of the current sliding window segment: When the matching value of the collaborative behavior is less than or equal to the recognition threshold, it is determined to be a non-collaborative behavior state. The normal recording mode of the current behavior flow is maintained, only the operation fragment is archived, and no further analysis and linkage judgment are triggered for the time being. When the matching value of collaborative behavior is greater than the recognition threshold, it is determined to be a potential collaborative behavior state. All image paths in this window that match the naming rules of the screenshot file are extracted and the source directory and generation time are recorded. It is marked whether they are consistent with the default screenshot path. The terminal ID, USB device identification code and command trigger source process involved in the chain are bound together to generate a cross-index relationship of behavior between devices. The playback behavior before and after the screenshot is traced back, the jump segment timestamps before and after the screenshot is triggered are extracted, and the duration of the user-focused segment and the sensitivity of the video segment are locked.

5. The real-time streaming analysis method based on multi-source heterogeneous data according to claim 1, characterized in that: The specific steps for analyzing the implicit coupling features between multi-channel behaviors within a sliding window based on a standardized behavior sequence dataset are as follows: The difference between the total number of operations within the sliding window and the number of times the same file and image were repeated, plus the number of times the image file was named repeatedly, minus the number of times the file was written via USB, is used as the numerator. The total number of operations within the sliding window is used as the denominator to obtain the operation distribution dispersion. Extract the minimum transmission time difference from the screenshot to the outgoing command, calculate the absolute value of the difference between the minimum transmission time difference and the time interval adjustment coefficient, divide it by the time interval adjustment coefficient, multiply it by the ratio of the total number of screenshot files generated in the current sliding window to the average number of screenshot files generated in all sliding window segments, add one and take the logarithm to obtain the path timing offset value. Multiplying the operation distribution dispersion by the path time offset value yields the cross-channel coupling strength value.

6. The real-time streaming analysis method based on multi-source heterogeneous data according to claim 1, characterized in that: The specific steps for completing the operation chain and marking potential risks based on the analysis results are as follows: When the cross-channel coupling strength value continues to rise in three consecutive sliding windows, and the increase between each window exceeds 15% of the increase of the previous window, the screenshot generation event is immediately used as the starting point to track whether the USB write path and the outgoing command parameters reference image resources within the next 10 seconds, construct a cross-channel operation sequence chain, and synchronously record the image file name, generation directory and writing device ID involved in the chain. Bi-directional verification is performed on the terminal behavior of continuously referencing images in a short period of time to determine whether there is any behavior of deceiving the path matching rules by copying-renaming-outgoing. When the cross-channel coupling strength value fluctuates more than 30% of the previous window within three consecutive sliding windows, and the interval between each high-low switching is less than two seconds, multiple high-jump sliding window segments are merged and spliced. The non-continuous screenshot-write-command behavior is re-aggregated into a delayed chain operation segment. The path break point and the drop point of resource call frequency are identified. Command call anomaly comparison is started to determine whether the current terminal uses parameter dynamic injection and path temporary splicing to bypass the standard identification process. When the cross-channel coupling strength value fluctuates within 5% above and below the average of the overall cross-channel coupling strength value within five consecutive sliding windows, and the maximum fluctuation is less than 0.1, the image files generated, the written USB paths, and the reference path fields within the current sliding window are checked item by item. The resource namespace overlap rate and file generation time stability index are calculated. Further analysis is conducted to determine whether there is a buffer behavior segment in the terminal where the image generation behavior lags behind the video jump operation but precedes the command execution behavior. At the same time, a path consistency tree is constructed for all image resource reference paths, screenshot generation paths, and USB write paths to find path breakpoints and path splicing positions and determine whether there is path tampering and naming variation.

7. The real-time streaming analysis method based on multi-source heterogeneous data according to claim 1, characterized in that: The specific steps for comprehensively analyzing the aggregation tightness of operations within the sliding window, using multi-channel behavioral activity evaluation results and implicit coupling feature analysis results as input, are as follows: Obtain the cooperative behavior matching value and the cross-channel coupling strength value, subtract the cooperative behavior matching value from one and then multiply it with the cross-channel coupling strength value to obtain the cooperative offset coupling value; The behavior stagnation adjustment value is obtained by taking the cooperative offset coupling value as the numerator and the logarithm of the screen dwell time plus one as the denominator. The path reuse enhancement value is obtained by adding one to the ratio of the number of times that multiple behavior nodes reference the same image path to the number of mergeable chain segments identified in the current aggregation process. Multiply the behavior stagnation adjustment value by the path reuse enhancement value to obtain the current operation chain aggregation value.

8. The real-time streaming analysis method based on multi-source heterogeneous data according to claim 1, characterized in that: The specific steps for driving the early warning response based on the analysis results are as follows: The current operation chain aggregation value is compared in real time with the chain integrity aggregation threshold, which includes a first aggregation threshold and a second aggregation threshold. When the operation chain aggregation value is less than or equal to the second aggregation threshold, it is determined that the current behavior structure has loose characteristics and the chain operation has not yet formed a closed loop. The key behavior nodes of screenshot, image processing, and external command are reserved as potential chain endpoints, and the key path and its timestamp information are recorded. When the operation chain aggregation value is greater than the second aggregation threshold and less than or equal to the first aggregation threshold, it is determined to be the chain aggregation transition stage. Node reorganization and edge completion are performed on the cross-channel operation path. Behavioral segments with strong path continuity and consistent reference resources are prioritized for integration. At the same time, the frequency of image resource occurrence, consistency of external parameters and device ID matching degree within the chain are jointly verified to evaluate the trend of evolution towards a stable structure and to count the path overlap rate and behavior convergence index. When the aggregation value of the operation chain exceeds the first aggregation threshold, it is determined that the chain structure has been stably formed. The current chain structure is topologically frozen and a unique chain identifier ID is generated. At the same time, the resource path tracing mode is entered. Hash fingerprints are generated for the image files involved in the chain and the event log is recorded. The terminal prioritizes matching and risk linkage warning for subsequent behaviors that have the same chain head node starting path. Behavior archiving and task backtracking are executed simultaneously. Automatic multi-target comparison and duplicate reference monitoring are implemented for high-frequency image files to help identify and avoid paths and command spoofing behaviors.

9. A real-time streaming analysis method based on multi-source heterogeneous data according to claim 1, characterized in that: The specific steps for converting the highly matched chain operation structure into a structured early warning event based on the calculation result of the aggregation strength value of the operation chain, and triggering the real-time identification and early warning push of potential data leakage chains are as follows: Based on the calculation results of the operation chain aggregation value, the chain operation structure constructed in multiple sliding windows is deeply analyzed and transformed into a structured behavior event with operation path, time span and channel coverage information. All aggregated chain structures are normalized in terms of fields and reorganized in terms of timeline. Key nodes involving screenshots, USB writes, and image parameter injection are extracted. The covered physical channels, path objects, and cross-node trigger intervals are analyzed. When multiple key nodes in the chain structure reference the same image file and have the same directory prefix, naming template, and path consistency characteristics that are continuously distributed within the generation time period, it is identified as a potential chain-like data leakage chain. All core nodes in the operation chain are assigned a unique identifier and a structured alarm event is generated. At the same time, an early warning data package is constructed and pushed to the behavior alarm processing center.

10. A real-time streaming analysis system based on multi-source heterogeneous data as described in any one of claims 1-9, characterized in that, include: The multi-channel data access and standardization processing module is used to collect interactive behavior data, external access data and potential instruction scheduling data during terminal operation, and to preprocess the collected interactive behavior data, external access data and potential instruction scheduling data to construct a standardized behavior sequence dataset. The multi-source behavior segment parallel sliding window matching module is used to evaluate the activity of multi-channel behaviors within the sliding window based on a standardized behavior sequence dataset and the video jump frequency, and to trigger the construction of a chain operation structure based on the evaluation results. The implicit coupling behavior relationship construction module is used to analyze the implicit coupling characteristics between multi-channel behaviors within a sliding window based on a standardized behavior sequence dataset, and to complete the operation chain and mark potential risks based on the analysis results; The operation chain aggregation module is used to comprehensively analyze the density of operation aggregation within the sliding window, taking the multi-channel behavior activity assessment results and implicit coupling feature analysis results as inputs, and drive early warning response based on the analysis results; The linkage response marking and early warning generation module is used to transform highly matched chain operation structures into structured early warning events based on the calculation results of the aggregation intensity value of the operation chain, and to trigger real-time identification and early warning push of potential data leakage chains.

Images