An account anomaly identification system and method based on time series pattern mining

Abstract

This invention relates to the field of account identification and discloses an account anomaly identification system and method based on time-series pattern mining. One method involves collecting account operation logs, interface call records, and permission status change records generated during the operation of a business system; splitting the behavior records into segments of unequal lengths according to time interval distribution, function entry jump relationships, and business module switching characteristics; conducting comparative analysis on the frequency, order, and duration of occurrence in different statistical periods to identify changes in patterns over time; mapping the selected behavior pattern set to the business function structure, considering overlapping access objects, cross-relationships of operation paths, and the density of function calls; and classifying the degree of deviation of the current behavior. This invention has the advantage of improving the ability to identify non-sudden account anomalies.

Description

Technical Field

[0001] This invention relates to the field of account identification, specifically to an account anomaly identification system and method based on time-series pattern mining. Background Technology

[0002] In enterprise information systems and platform-based business systems, account behavior is typically stored long-term in the form of operation logs for post-event auditing, operational analysis, and anomaly tracing. Current technologies largely rely on keyword matching, conditional filtering, or statistical summarization of log data for identification. This involves comparing and analyzing login frequency, number of operations, or accessed objects according to preset rules during log retrieval. However, in real-world operating environments, a subtle but persistent problem exists: some anomalous accounts do not show significant high-frequency events or violation fields at the log level, but rather exhibit abnormal usage characteristics through subtle changes in time sequence.

[0003] Taking an enterprise's internal management system as an example, some accounts may perform legitimate operations within their authorized scope. However, their abnormal behavior is mainly reflected in the order of operation types, the time interval between adjacent operations, and the repetitive patterns of cross-business module access paths. These anomalies are often scattered across a large number of regular log records. A single log entry is difficult to use as a basis for anomaly determination, and it is difficult to effectively distinguish them using log retrieval methods based on conditional filtering or static statistics.

[0004] Therefore, it is necessary to design an account anomaly identification system and method based on time-series pattern mining to improve the ability to identify non-sudden account anomalies. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an account anomaly identification system and method based on time-series pattern mining, which has the advantage of improving the ability to identify non-sudden account anomalies and solves the problems mentioned in the background technology.

[0006] To achieve the aforementioned goal of improving the ability to identify non-sudden account anomalies, this invention provides the following technical solution: an account anomaly identification method based on time-series pattern mining, comprising the following steps:

[0007] The system collects account operation logs, interface call records, and permission status change records generated during the operation of the business system, corrects the order based on a unified time benchmark, and combines the operation source, business object identifier, and session association to form a continuous behavior record reflecting the long-term use of the account.

[0008] Based on continuous behavior records, the behavior records are split into segments of unequal lengths according to the distribution of time intervals, the relationship between function entry points and the switching characteristics of business modules. The resulting behavior segments are then combined and categorized to construct a time-series pattern unit for describing the normal usage of an account.

[0009] Around the time-series pattern unit, the frequency, order and duration of occurrence in different statistical periods are compared and analyzed. By identifying the changes in the pattern over time, a set of behavioral patterns that consistently deviate from historical usage habits is selected.

[0010] The selected behavioral patterns are mapped to the business function structure. Combined with the overlap of access objects, the cross relationship of operation paths, and the density of function calls, a local temporal relationship structure reflecting the degree of internal correlation of account behavior is formed.

[0011] Based on the local temporal relationship structure and referring to the historical usage baseline of the account, the degree of deviation of the current behavior is classified and judged, and the account anomaly identification result is output.

[0012] Preferably, the process of generating continuous behavioral records reflecting the long-term use of an account is as follows:

[0013] Centralized extraction of account operation logs, interface call records, and permission status change records that are scattered across different business subsystems, and standardization and precision alignment of the time field of various records;

[0014] Based on a unified time base, the order of log entries that are out of order, delayed, or cross-system recorded is corrected to eliminate time offsets caused by system clock differences or asynchronous processing.

[0015] After completing the time sequence correction, the operation source identifier, business object identifier and session association identifier corresponding to each operation record are extracted, and the operation records are initially merged according to the session dimension.

[0016] The merged operation records are arranged sequentially in chronological order to generate continuous behavior records that reflect the long-term use of the account in multiple business scenarios.

[0017] Preferably, the process of splitting behavior records into unequal lengths is as follows:

[0018] Statistical analysis of the time interval distribution between adjacent operations in continuous behavior records to identify time breakpoints and high-frequency operation dense sections;

[0019] Based on the function entry identifier corresponding to the operation, analyze the jump relationship between different function entry points of the account and mark the jump position across modules;

[0020] By combining the time interval distribution, function entry jump relationship and business module switching characteristics, continuous behavior records are dynamically segmented to form behavior segments with variable lengths and boundaries adaptively determined by behavior characteristics.

[0021] Preferably, the process of constructing a time-series pattern unit to describe the normal usage of an account is as follows:

[0022] Encode and represent the operation type sequence, function call order, and duration features contained in each behavior segment;

[0023] Based on the similarity of operational structures and temporal distribution characteristics between segments, a multi-dimensional similarity assessment of behavioral segments is performed;

[0024] Behavioral segments with similarity exceeding a set threshold are grouped into the same combination unit, and the representative order of the internal operation arrangement is recorded. The combined set of behavioral segments is used as the temporal pattern unit.

[0025] Preferably, the process of comparative analysis of frequency, order of occurrence, and duration in different statistical periods is as follows:

[0026] Within multiple preset statistical periods, the occurrence frequency and cumulative duration of each time-series pattern unit are counted respectively;

[0027] Compare the internal operation sequence of the same timing mode unit in different cycles to identify changes in sequence stability.

[0028] By combining the frequency fluctuations and continuous span changes of the pattern unit in the periodic dimension, a periodic feature description reflecting the rhythm of account usage is constructed, and the periodic feature description is used as the time reference basis for the normal usage mode of the account.

[0029] Preferably, the process of filtering out the set of behavioral patterns that consistently deviate from historical usage habits is as follows:

[0030] The characteristics of time-series pattern units formed in the current statistical period are compared with the corresponding characteristics in the historical periods to calculate the pattern frequency shift, order variation, and duration span variation.

[0031] A comprehensive deviation score is constructed based on multiple change indicators to quantify the degree of change in time-series patterns relative to historical usage habits.

[0032] When the overall deviation score exceeds the set threshold for multiple consecutive periods, the corresponding time-series pattern unit is marked as an abnormal candidate pattern. All abnormal candidate patterns are aggregated to form a set of behavioral patterns that continuously deviate from historical usage habits.

[0033] Preferably, the process of mapping the selected set of behavioral patterns to the business function structure is as follows:

[0034] Obtain a description of the structured relationships between various functional modules, functional entry points, and interfaces in the business system;

[0035] Map each operation sequence involved in the set of behavioral patterns to the corresponding business function structure and interface node;

[0036] The actual access path of the operation sequence is marked in the business function structure, forming a mapping result that reflects the flow relationship of account operations in the function structure.

[0037] Preferably, the process of forming a local temporal relationship structure that reflects the degree of internal correlation of account behavior is as follows:

[0038] The overlap of accesses to the same business object or functional node by different operation sequences in the statistical behavior pattern set;

[0039] Analyze the intersection of multiple operation paths in the business function structure and the number of shared nodes, and calculate the call density of each function node by combining the number of function calls per unit time.

[0040] By comprehensively associating overlapping accesses, intersecting paths, and call density, a local temporal relationship structure reflecting the degree of internal correlation of account behavior is formed.

[0041] Preferably, the process for outputting the account anomaly identification results is as follows:

[0042] Using the local time-series relationship structure formed during the normal use of the account in history as the usage baseline, the local time-series relationship structure constructed in the current statistical period is compared with the usage baseline, and the structural difference is calculated.

[0043] Based on the degree of structural difference, the current behavior of the account is divided into multiple deviation levels, and the corresponding account anomaly identification results are output.

[0044] This invention also discloses another technical solution: an account anomaly identification system based on time-series pattern mining, comprising:

[0045] Behavior aggregation module: Aggregates account operation logs, interface call records, and permission status change records scattered across different business systems to form a continuous behavior record reflecting the long-term use of accounts;

[0046] Fragment construction module: Based on the time interval distribution, function entry jump relationship and business module switching characteristics in continuous behavior records, construct a time sequence pattern unit to describe the normal usage of the account;

[0047] Pattern Comparison Module: Compares and analyzes the frequency of occurrence, order of arrangement, and duration of time-series pattern units in different statistical periods to screen out a set of behavioral patterns that consistently deviate from historical usage habits;

[0048] Relationship mapping module: Maps the filtered behavioral patterns to the business function structure, and constructs a local temporal relationship structure that reflects the degree of correlation between behaviors within the account;

[0049] Deviation Detection Module: Based on the local temporal relationship structure, it classifies and determines the degree of deviation of the current account behavior and outputs the anomaly identification results.

[0050] Compared with existing technologies, the present invention provides an account anomaly identification system and method based on time-series pattern mining, which has the following beneficial effects:

[0051] This invention introduces an account behavior modeling mechanism based on time-series pattern mining, enabling continuous characterization and structured analysis of operational behaviors formed during long-term account use without altering the existing operational logic of the business system. By performing time-series correction and session-level integration on multi-source account behavior data, it avoids behavioral fragmentation caused by scattered logs, asynchronous writing, or system clock differences, ensuring the integrity and traceability of account behavior in the time dimension. Through unequal-length behavior segmentation and the construction of time-series pattern units, the normal usage patterns of accounts can be adaptively formed by the actual operation rhythm and function switching characteristics, reducing the risk of misjudgment caused by fixed rules or static thresholds. By comparing and analyzing the frequency, structure, and duration of time-series pattern units in different statistical periods and introducing a continuous deviation screening mechanism, it can distinguish between short-term fluctuations and long-term changes in usage habits, enhancing the stability and reliability of anomaly identification. By mapping abnormal behavior patterns to the business function structure and constructing a local time-series relationship structure based on access overlap, path intersection, and function call density, the anomaly identification results not only reflect the degree of deviation at the numerical level but also reveal the internal correlation changes of account behavior at the business function level. By performing a structured comparison with the account's historical usage baseline and implementing hierarchical judgment, it can output account anomaly identification results that are interpretable and hierarchically distinguishable, providing a more accurate, stable, and business semantically supported decision-making basis for risk warning, authorization review, or manual review. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of the method of the present invention;

[0053] Figure 2 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0054] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] Example 1: Please refer to Figure 1 As shown in the figure, an account anomaly identification method based on time-series pattern mining in an embodiment of the present invention includes the following steps:

[0056] S1: Collect account operation logs, interface call records, and permission status change records generated during the operation of the business system, correct the order according to a unified time base, and combine the operation source, business object identifier, and session association to form a continuous behavior record reflecting the long-term use of the account.

[0057] The process of creating continuous behavioral records reflecting the long-term use of an account in S1 is as follows:

[0058] Centralized extraction of account operation logs, interface call records, and permission status change records scattered across different business subsystems is performed, and the time fields of various records are standardized in format and aligned in precision. Through a pre-configured log collection interface or data subscription mechanism, centralized extraction is performed on the account operation logs, interface call records, and permission status change records scattered across different business subsystems. To address the issues of inconsistent log formats and different time field types used by different subsystems, the time fields of the extracted records are uniformly parsed, and the original string time, millisecond-level timestamp, or second-level timestamp are uniformly converted into the standard time format defined internally by the system. The time precision is aligned according to the smallest time record granularity of the business system. To avoid field missing or format abnormalities when writing logs from different systems, default correction rules or anomaly labeling mechanisms are introduced for time fields that cannot be directly parsed.

[0059] Based on a unified time base, log entries with out-of-order, delayed writes, or cross-system records are corrected to eliminate time offsets caused by system clock differences or asynchronous processing. After unifying the time field, the standardized time is used as a global reference to correct the order of centralized operation records. For log out-of-order issues caused by inconsistent system clocks, asynchronous writes, cache delays, or cross-system calls, log entries within adjacent time periods are reordered by setting time windows and maximum allowable offset thresholds. For records with obvious time anomalies, their timestamps are reasonably corrected or marked as indeterminate time records based on their business system, call chain relationships, and the time distribution of upstream and downstream logs. During the correction process, auxiliary judgment rules based on call causality or transaction association identifiers are introduced to verify the rationality of log arrangement, thereby minimizing the impact of time offsets caused by system clock differences or asynchronous processing without altering the original business meaning.

[0060] After completing the time sequence correction, the operation source identifier, business object identifier, and session association identifier corresponding to each operation record are extracted. The operation records are then initially merged according to the session dimension. The operation source identifier is used to distinguish whether the operation is triggered by a manual terminal, an automated interface, or a third-party system. The business object identifier is used to indicate the specific business entity that the operation affects. The session association identifier is used to reflect whether multiple operations belong to the same login, the same transaction process, or the same call chain. After extracting the identifiers, the operation records are grouped based on the session association identifier as the main merging basis. Multiple operation records belonging to the same session are merged into a logical operation sequence. For records that are missing session identifiers, they are supplemented and merged or retained separately based on time proximity and consistency of operation source to ensure the integrity and traceability of the merging results.

[0061] The merged operation records are arranged sequentially in chronological order to generate continuous behavior records that reflect the long-term use of the account across multiple business scenarios. During the arrangement process, key attribute information of each operation record is retained, and time interval descriptions are established between adjacent operations to reflect the operation rhythm and behavior continuity. For long-term account usage across sessions and business scenarios, multiple session-level operation sequences are chained together in chronological order to generate continuous behavior records that cover different business systems and different usage stages. This not only reflects the account's operation trajectory in a single business process, but also reflects the account's usage habits, operation evolution process, and cross-system behavior connection over a longer period of time.

[0062] S2: Based on continuous behavior records, the behavior records are split into segments of unequal length according to the distribution of time intervals, the relationship between function entry points and jumps, and the switching characteristics of business modules. The resulting behavior segments are then combined and categorized to construct a time-series pattern unit that describes the normal usage of the account.

[0063] The process of splitting behavior records into unequal lengths in S2 is as follows:

[0064] The system statistically analyzes the distribution of time intervals between adjacent operations in continuous behavior records to identify time breakpoints and high-frequency operation clusters. For each existing continuous behavior record, the system calculates the time interval between adjacent operation records to construct a time interval sequence that reflects the rhythm of account operations. Based on this time interval sequence, the system performs statistical analysis on different time interval ranges to form time interval distribution characteristics. These characteristics are used to distinguish between two types of behavior patterns: continuous operations in a short period of time and long pauses. By setting adaptive thresholds or quantile intervals, time points that are significantly larger than the normal operation interval are marked as potential time breakpoints. Operation clusters with consecutive short time intervals are aggregated to identify high-frequency operation clusters. Time breakpoints and clusters are used together to characterize the behavior characteristics of natural pauses, phase ends, or concentrated operations during account usage.

[0065] Based on the function entry identifier corresponding to the operation, the jump relationship between different function entry points of the account is analyzed, and the cross-module jump position is marked. On the basis of completing the time interval analysis, the function entry identifier corresponding to each operation in the continuous behavior record is parsed to distinguish the business function module or page entry to which the current operation of the account belongs. By comparing the function entry identifiers of adjacent operations, the jump relationship between different function entry points of the account is analyzed, and the cross-module jump position from one business module to another is identified. For cases with multi-level pages or nested sub-functions, function entry hierarchy information is introduced to distinguish and mark fine-grained jumps within the same business module and cross-module jumps, so that every significant change in function entry can form a clear structural identifier in the behavior record to reflect the change in the account's operation intention or usage scenario.

[0066] By combining time interval distribution, function entry jump relationships, and business module switching characteristics, continuous behavior records are dynamically segmented to form behavior segments of varying lengths with boundaries adaptively determined by behavior features. When a time breakpoint and cross-module jump are detected simultaneously, or when a significant business module switch occurs after a high-frequency operation-intensive segment ends, the corresponding position is determined as the segmentation boundary of the behavior segment. For cases where only a single feature change occurs, a determination is made based on preset weight rules or feature combination conditions to determine whether to trigger segmentation. Through this dynamic segmentation mechanism, the length of the generated behavior segments is not limited by a fixed window, and their boundaries are adaptively determined by the actual behavior features of the account, thereby forming a set of behavior segments of varying lengths that can more realistically reflect the account usage stage, operational intent, and changes in business scenarios.

[0067] The process of constructing a time-series pattern unit in S2 to describe the normal usage of an account is as follows:

[0068] The operation type sequence, function call order, and duration features contained in each behavior segment are encoded and represented. Each operation record in the behavior segment is mapped according to a predefined set of operation types, and different types of account operations are converted into discrete identifiers or index values. Combined with the function entry identifier, the call order of operations in the segment is sequentially encoded to form a sequence structure that reflects the order of operations. For the duration feature, the corresponding duration is calculated according to the start and end time of the behavior segment or the cumulative time interval between adjacent operations in the segment, and numerically processed by interval division or normalization. Through the encoding process, each behavior segment is transformed into a structured temporal representation containing operation type, call order, and duration information.

[0069] Based on the similarity of operational structures and temporal distribution characteristics between segments, a multi-dimensional similarity assessment of behavioral segments is conducted. Based on the sequence of operation types and the order of function calls, the consistency of behavioral segments in terms of operation composition and arrangement structure is compared. Structural similarity is calculated through methods such as sequence matching, position alignment, or relative order consistency statistics. The duration of behavioral segments and internal temporal distribution characteristics are introduced to assess the similarity of segments on a time scale, which is used to distinguish behavioral patterns with significantly different operation rhythms but similar structures. Structural similarity and temporal distribution similarity can be calculated separately and then weighted and fused to form a comprehensive similarity index that reflects the degree of similarity of the overall behavioral patterns of segments, thereby achieving an objective quantitative description of common account behavioral structures.

[0070] Behavioral fragments with similarity exceeding a set threshold are grouped into the same combination unit, and the representative order of internal operations is recorded. The combined set of behavioral fragments is used as the temporal pattern unit. During the merging process, for multiple behavioral fragments within the same combination unit, the frequency of occurrence of their operation type sequence and function call order is statistically analyzed. The representative operation order is identified and used as the typical temporal structure of the combination unit. The duration distribution range of each behavioral fragment within the combination unit and the common locations where operations occur are recorded to describe the stable characteristics of the temporal pattern in terms of time and structure. By using the merged set of behavioral fragments as a temporal pattern unit, the constructed temporal pattern unit can reflect the operation structure and rhythmic characteristics that repeatedly occur under normal account usage.

[0071] S3: Focusing on the time-series pattern unit, conduct comparative analysis on the frequency, order, and duration of occurrence in different statistical periods. By identifying the changes in the pattern over time, filter out the set of behavioral patterns that consistently deviate from historical usage habits.

[0072] The process of comparing and analyzing the frequency, order of occurrence, and duration of occurrence in different statistical periods in S3 is as follows:

[0073] Within multiple preset statistical periods, the frequency of occurrence and cumulative duration of each time-series pattern unit are counted. Multiple statistical periods are pre-defined to characterize the usage patterns of accounts at different time scales. The statistical periods include time intervals divided by day, week, month, or natural business cycle. For each statistical period, the behavioral segments generated within that period and their corresponding time-series pattern units are traversed. The frequency of occurrence of each time-series pattern unit within that period is counted, and the duration of behavioral segments belonging to the same pattern unit is accumulated to obtain the corresponding period occurrence frequency and cumulative duration of the period. To ensure the comparability of the statistical results, behavioral segments crossing period boundaries are segmented or assigned according to rules during the statistical process to ensure that the frequency and duration within each statistical period are calculated independently, thereby forming a statistical sequence of pattern units arranged by period.

[0074] The internal operation sequence of the same timing pattern unit in different cycles is compared to identify changes in sequence stability. By comparing the differences between representative operation sequences in different cycles, the stability of the operation structure of the pattern unit is analyzed. The operation sequence in each cycle is aligned or mapped to a relative order. The number of operation position changes, the frequency of sequence exchange, or the addition or absence of operations are counted to identify whether the operation sequence remains stable or undergoes phased changes. Through this sequence stability comparison, even when the frequency of occurrence is similar, it is possible to distinguish between different usage states where the operation structure remains consistent and where the operation process has been adjusted.

[0075] By combining the frequency fluctuations and continuous span changes of pattern units in the cyclical dimension, a periodic feature description reflecting the rhythm of account usage is constructed. This periodic feature description serves as the time reference basis for the account's normal usage patterns. The periodic feature description is used to characterize the degree of dependence, usage intensity, and structural stability of the account on various time-series pattern units at different time scales. It is organized into a feature sequence that can be advanced over time through a time axis. By using the periodic feature description as the time reference basis for the account's normal usage patterns, the analysis of account behavior can use historical cyclical patterns as a benchmark, thereby distinguishing between short-term fluctuations and long-term changes in usage patterns, and improving the stability and interpretability of account behavior assessment.

[0076] The process of filtering out the set of behavioral patterns that consistently deviate from historical usage habits in S3 is as follows:

[0077] By comparing the features of time-series pattern units formed in the current statistical period with the corresponding features in historical periods, the pattern frequency shift, order variability, and duration span variation are calculated. Using the periodic feature descriptions formed in historical periods as a reference, the pattern frequency shift between the current period and historical periods is calculated to reflect the magnitude of change in the number of times a pattern occurs relative to historical norms. By comparing the differences in the order of representative operations in the current period and historical periods, the order variability is calculated to characterize whether the stability of the operation structure has changed. Based on the changes in cumulative duration or single duration span, the duration span variation is calculated to reflect the degree of change in usage intensity or operation rhythm. Through multi-dimensional feature comparison, the behavioral changes of each time-series pattern unit in the current period can be quantitatively described.

[0078] A comprehensive deviation score is constructed based on multiple change indicators to quantify the degree of change of time-series patterns relative to historical usage habits. Based on preset weighting rules or empirical parameters, the various change indicators are weighted and integrated to construct a comprehensive deviation score for quantifying the degree of change of time-series pattern units relative to historical usage habits. This score reflects the overall deviation level of a single time-series pattern unit in the current period and enables horizontal comparison between different pattern units.

[0079] When the overall deviation score exceeds the set threshold for multiple consecutive periods, the corresponding time-series pattern unit is marked as an abnormal candidate pattern. All abnormal candidate patterns are aggregated to form a set of behavioral patterns that continuously deviate from historical usage habits. After marking is completed, all marked abnormal candidate patterns are aggregated to form a set of behavioral patterns that continuously deviate from historical usage habits. By introducing a continuous period judgment mechanism, misjudgments caused by short-term fluctuations or occasional operations are avoided, making the formed set of behavioral patterns more able to reflect the substantial changes in account usage.

[0080] S4: Map the selected set of behavioral patterns to the business function structure, and combine the overlap of access objects, the cross relationship of operation paths and the density of function calls to form a local temporal relationship structure that reflects the degree of internal correlation of account behavior.

[0081] In S4, the process of mapping the selected set of behavioral patterns to the business function structure is as follows:

[0082] Obtain the structured relationship description between each functional module, functional entry point, and interface in the business system; the structured relationship description is used to reflect the hierarchical relationship between functional modules, the belonging relationship between functional entry points and business modules, and the connection relationship of interface calls in the functional structure. The business functional structure is abstracted into a structured data model containing module nodes, entry nodes, and interface nodes, and connection descriptions reflecting calls, jumps, or dependencies are established between nodes, thereby forming a business functional structure representation that can be used for subsequent mapping processing, so that the functional organization form of the business system has the basic conditions of being traversable and annotable at the data level;

[0083] The operation sequences involved in the behavior pattern set are mapped one by one to the corresponding business function structure and interface node. After the structured representation of the business function structure is completed, the selected behavior pattern set is parsed one by one to extract the operation sequences contained therein. For each operation record in the operation sequence, the operation is mapped to the corresponding node position in the business function structure according to its corresponding function entry identifier, interface identifier or business object identifier. For cases where there are multiple function entry points or interface reuse, the mapping results are refined and located by combining the context information or call source when the operation occurs, to ensure that the operation can be accurately mapped to the specific function module or interface node. Through the one-by-one mapping process, the operation sequences in the behavior pattern set form a node association relationship in the business function structure that is consistent with the actual access behavior.

[0084] In the business function structure, the actual access path of the operation sequence is marked to form a mapping result that reflects the flow relationship of account operations in the function structure. After completing the mapping of the operation sequence to the functional structure node, the node positions of adjacent operations in the business function structure are connected and marked according to the time order in the operation sequence, thereby marking the actual access path of the account operation in the business function structure. The access path is used to reflect the flow relationship of the account between functional modules, functional entry points and interface nodes. It is recorded by path number, access order identifier or weight accumulation method. By summarizing the path marking results of multiple operation sequences, a mapping result that can reflect the flow characteristics of account operations in the business function structure is formed.

[0085] The process of forming a local temporal relation structure in S4 that reflects the degree of internal correlation of account behavior is as follows:

[0086] This study analyzes the overlap of accesses to the same business object or functional node in different operation sequences within a statistical behavior pattern set. Using the business object identifier or functional node identifier as an index, it summarizes the access nodes involved in all operation sequences, counts the number and frequency of nodes repeatedly accessed in different operation sequences, and records the temporal and positional relationships of the same node in different operation sequences. This is used to reflect whether accesses occur in a concentrated manner or exhibit phased overlap, so that the degree of association between account behavior and the same business object or functional node in different operation sequences can be described in the form of quantifiable overlap indicators.

[0087] This study analyzes the intersection positions and the number of shared nodes of multiple operation paths in the business function structure, and calculates the call density of each function node by combining the number of function calls per unit time. It compares the marked access paths one by one to identify the intersection positions of different operation paths in the business function structure, and counts the number of shared function nodes between paths to characterize the degree of overlap of operation processes at the structural level. Combined with the number of accesses or interface calls of each function node per unit time, the call density of function nodes is calculated to reflect the concentrated use of specific function nodes by accounts in a short period of time. By jointly analyzing the intersection positions of paths, the number of shared nodes, and the call density, the aggregation characteristics and interaction complexity of account operations in the functional structure can be comprehensively characterized.

[0088] By comprehensively associating access overlap, path intersection, and call density, a local temporal relationship structure reflecting the degree of internal correlation of account behavior is formed. Functional nodes or business objects are used as structural nodes, and the access overlap strength, path intersection degree, and call density weight between operation sequences are used as correlation attributes between or on nodes. This local temporal relationship structure, which reflects the degree of internal correlation of account behavior, is used to describe the close correlation formed between different operation sequences of an account around key functional nodes or business objects within a specific time range.

[0089] S5: Based on the local temporal relationship structure and referring to the historical usage baseline of the account, the degree of deviation of the current behavior is classified and judged, and the account anomaly identification result is output.

[0090] The process of outputting account anomaly detection results in S5 is as follows:

[0091] Using the local temporal relationship structure formed during the normal use of the account in history as the usage baseline, the local temporal relationship structure built in the current statistical period is compared with the usage baseline to calculate the structural difference degree. The comparison includes the appearance and absence of functional nodes, the strength of the relationship between nodes, and the magnitude of the change in the node call density. Combined with the temporal order of the node arrangement in the local temporal relationship structure, the deviation of the structural change at the temporal level is quantified. By normalizing and weighting the multiple structural differences, the structural difference degree reflecting the deviation of the current local temporal relationship structure from the historical usage baseline is calculated, so that the overall structural change of the account's current behavior can be described in numerical form.

[0092] Based on the magnitude of structural differences, the current account behavior is divided into multiple deviation levels, and the corresponding account anomaly identification results are output. The grading rules can classify account behavior into multiple levels such as normal, slight deviation, moderate deviation, or high deviation according to the numerical range of structural differences, and configure corresponding anomaly labels for different levels. After completing the grading, the anomaly identification results corresponding to the current statistical period of the account are output. The identification results include the anomaly level label, the corresponding structural difference value, and the main structural change features that triggered the level, so that the account anomaly identification results have clear quantitative basis and can be intuitively compared with the account's historical usage habits.

[0093] Example 2, as Figure 2 As shown, an account anomaly identification system based on time-series pattern mining includes:

[0094] Behavior aggregation module: Aggregates account operation logs, interface call records, and permission status change records scattered across different business systems to form a continuous behavior record reflecting the long-term use of accounts;

[0095] Fragment construction module: Based on the time interval distribution, function entry jump relationship and business module switching characteristics in continuous behavior records, construct a time sequence pattern unit to describe the normal usage of the account;

[0096] Pattern Comparison Module: Compares and analyzes the frequency of occurrence, order of arrangement, and duration of time-series pattern units in different statistical periods to screen out a set of behavioral patterns that consistently deviate from historical usage habits;

[0097] Relationship mapping module: Maps the filtered behavioral patterns to the business function structure, and constructs a local temporal relationship structure that reflects the degree of correlation between behaviors within the account;

[0098] Deviation Detection Module: Based on the local temporal relationship structure, it classifies and determines the degree of deviation of the current account behavior and outputs the anomaly identification results.

[0099] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0100] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for identifying account anomalies based on time-series pattern mining, characterized in that, Includes the following steps: The system collects account operation logs, interface call records, and permission status change records generated during the operation of the business system, corrects the order based on a unified time benchmark, and combines the operation source, business object identifier, and session association to form a continuous behavior record reflecting the long-term use of the account. Based on continuous behavior records, the behavior records are split into segments of unequal lengths according to the distribution of time intervals, the relationship between function entry points and the switching characteristics of business modules. The resulting behavior segments are then combined and categorized to construct a time-series pattern unit for describing the normal usage of an account. Around the time-series pattern unit, the frequency, order and duration of occurrence in different statistical periods are compared and analyzed. By identifying the changes in the pattern over time, a set of behavioral patterns that consistently deviate from historical usage habits is selected. The selected behavioral patterns are mapped to the business function structure. Combined with the overlap of access objects, the cross relationship of operation paths, and the density of function calls, a local temporal relationship structure reflecting the degree of internal correlation of account behavior is formed. Based on the local temporal relationship structure and referring to the historical usage baseline of the account, the degree of deviation of the current behavior is classified and judged, and the account anomaly identification result is output.

2. The method for identifying account anomalies based on time-series pattern mining according to claim 1, characterized in that, The process of creating a continuous record of account activity over a long period is as follows: Centralized extraction of account operation logs, interface call records, and permission status change records that are scattered across different business subsystems, and standardization and precision alignment of the time field of various records; Based on a unified time base, the order of log entries that are out of order, delayed, or cross-system recorded is corrected to eliminate time offsets caused by system clock differences or asynchronous processing. After completing the time sequence correction, the operation source identifier, business object identifier and session association identifier corresponding to each operation record are extracted, and the operation records are initially merged according to the session dimension. The merged operation records are arranged sequentially in chronological order to generate continuous behavior records that reflect the long-term use of the account in multiple business scenarios.

3. The method for identifying account anomalies based on time-series pattern mining according to claim 2, characterized in that, The process of splitting behavior records into unequal length segments is as follows: Statistical analysis of the time interval distribution between adjacent operations in continuous behavior records to identify time breakpoints and high-frequency operation dense sections; Based on the function entry identifier corresponding to the operation, analyze the jump relationship between different function entry points of the account and mark the jump position across modules; By combining the time interval distribution, function entry jump relationship and business module switching characteristics, continuous behavior records are dynamically segmented to form behavior segments with variable lengths and boundaries adaptively determined by behavior characteristics.

4. The method for identifying account anomalies based on time-series pattern mining according to claim 3, characterized in that, The process of constructing a time-series pattern unit to describe the normal usage patterns of an account is as follows: Encode and represent the operation type sequence, function call order, and duration features contained in each behavior segment; Based on the similarity of operational structures and temporal distribution characteristics between segments, a multi-dimensional similarity assessment of behavioral segments is performed; Behavioral segments with similarity exceeding a set threshold are grouped into the same combination unit, and the representative order of the internal operation arrangement is recorded. The combined set of behavioral segments is used as the temporal pattern unit.

5. The method for identifying account anomalies based on time-series pattern mining according to claim 4, characterized in that, The process of comparative analysis of frequency, order of occurrence, and duration across different statistical periods is as follows: Within multiple preset statistical periods, the occurrence frequency and cumulative duration of each time-series pattern unit are counted respectively; Compare the internal operation sequence of the same timing mode unit in different cycles to identify changes in sequence stability. By combining the frequency fluctuations and continuous span changes of the pattern unit in the periodic dimension, a periodic feature description reflecting the rhythm of account usage is constructed, and the periodic feature description is used as the time reference basis for the normal usage mode of the account.

6. The method for identifying account anomalies based on time-series pattern mining according to claim 5, characterized in that, The process of filtering out a set of behavioral patterns that consistently deviate from historical usage habits is as follows: The characteristics of time-series pattern units formed in the current statistical period are compared with the corresponding characteristics in the historical periods to calculate the pattern frequency shift, order variation, and duration span variation. A comprehensive deviation score is constructed based on multiple change indicators to quantify the degree of change in time-series patterns relative to historical usage habits. When the overall deviation score exceeds the set threshold for multiple consecutive periods, the corresponding time-series pattern unit is marked as an abnormal candidate pattern. All abnormal candidate patterns are aggregated to form a set of behavioral patterns that continuously deviate from historical usage habits.

7. The method for identifying account anomalies based on time-series pattern mining according to claim 6, characterized in that, The process of mapping the selected set of behavioral patterns to the business function structure is as follows: Obtain a description of the structured relationships between various functional modules, functional entry points, and interfaces in the business system; Map each operation sequence involved in the set of behavioral patterns to the corresponding business function structure and interface node; The actual access path of the operation sequence is marked in the business function structure, forming a mapping result that reflects the flow relationship of account operations in the function structure.

8. The method for identifying account anomalies based on time-series pattern mining according to claim 7, characterized in that, The process of forming a local temporal relationship structure that reflects the degree of internal correlation of account behavior is as follows: The overlap of accesses to the same business object or functional node by different operation sequences in the statistical behavior pattern set; Analyze the intersection of multiple operation paths in the business function structure and the number of shared nodes, and calculate the call density of each function node by combining the number of function calls per unit time. By comprehensively associating overlapping accesses, intersecting paths, and call density, a local temporal relationship structure reflecting the degree of internal correlation of account behavior is formed.

9. The method for identifying account anomalies based on time-series pattern mining according to claim 8, characterized in that, The process of outputting the account anomaly identification results is as follows: Using the local time-series relationship structure formed during the normal use of the account in history as the usage baseline, the local time-series relationship structure constructed in the current statistical period is compared with the usage baseline, and the structural difference is calculated. Based on the degree of structural difference, the current behavior of the account is divided into multiple deviation levels, and the corresponding account anomaly identification results are output.

10. An account anomaly identification system based on time-series pattern mining, applied to the account anomaly identification method based on time-series pattern mining as described in any one of claims 1-9, characterized in that, include: Behavior aggregation module: Aggregates account operation logs, interface call records, and permission status change records scattered across different business systems to form a continuous behavior record reflecting the long-term use of accounts; Fragment construction module: Based on the time interval distribution, function entry jump relationship and business module switching characteristics in continuous behavior records, construct a time sequence pattern unit to describe the normal usage of the account; Pattern Comparison Module: Compares and analyzes the frequency of occurrence, order of arrangement, and duration of time-series pattern units in different statistical periods to screen out a set of behavioral patterns that consistently deviate from historical usage habits; Relationship mapping module: Maps the filtered behavioral patterns to the business function structure, and constructs a local temporal relationship structure that reflects the degree of correlation between behaviors within the account; Deviation Detection Module: Based on the local temporal relationship structure, it classifies and determines the degree of deviation of the current account behavior and outputs the anomaly identification results.

Images