Privacy data access intention recognition and abnormal behavior blocking method and system based on deep learning

Abstract

The application discloses a privacy data access intention recognition and abnormal behavior blocking method and system based on deep learning, relates to the technical field of data security, and comprises the following steps: obtaining target access request data to be recognized; performing feature extraction on the target access request data through a request content feature extraction network in a privacy access intention recognition model to obtain target request content features; matching the target request content features with target access context features, and determining an access intention category according to a matching result, wherein the target access context features are obtained by an access context feature extraction network from target access intention context information containing a pre-trained intention representation weight vector and an access intention type set; and if the access intention category belongs to a preset abnormal intention set, performing an abnormal blocking operation. The application realizes multi-dimensional feature fusion through a deep learning model, improves intention recognition accuracy, and effectively prevents privacy data leakage risks.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and more specifically, to a method and system for identifying privacy data access intent and blocking abnormal behavior based on deep learning. Background Technology

[0002] With increasing demands for data security, access control for privacy-related data has become a critical issue. Traditional access control methods often rely on static rule engines, judging access intent based solely on simple dimensions such as the identity and permissions of the accessing entity. This makes it difficult to accurately identify access intent in complex scenarios, leading to false positives or false negatives. For example, normal business queries and abnormal batch exports may be treated the same due to identical permissions, resulting in the risk of sensitive data leakage. Deep learning technology provides a new path for intent recognition, but existing methods suffer from limitations such as single feature extraction and insufficient fusion of contextual information, failing to effectively correlate access request content with intent semantics, thus limiting the accuracy of intent recognition. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for identifying privacy data access intent and blocking abnormal behavior based on deep learning.

[0004] In a first aspect, embodiments of the present invention provide a method for identifying privacy data access intent and blocking abnormal behavior based on deep learning, comprising:

[0005] Obtain the target access request data to be identified;

[0006] The target access request data is extracted using the request content feature extraction network in the privacy access intent recognition model to obtain the target request content features.

[0007] Feature matching is performed based on the target request content features and target access context features, and the access intent category corresponding to the target access request data is determined based on the feature matching results; wherein, the target access context features are obtained by performing feature extraction operations on the target access intent context information through the access context feature extraction network in the privacy access intent recognition model, and the target access intent context information includes a pre-trained intent representation weight vector and a set of various access intent types in the privacy access recognition scenario;

[0008] If the access intent category belongs to a preset abnormal intent set, then an abnormal access behavior blocking operation will be performed.

[0009] In one possible implementation, the intent representation weight vector is obtained through the following training method:

[0010] Determine the access behavior semantic data corresponding to the sample access request data;

[0011] The access context feature extraction network in the privacy access intent recognition model performs feature extraction on the access behavior semantic data to obtain behavioral semantic features; the access context feature extraction network performs feature extraction on the learnable access intent context information to obtain training access context features, wherein the learnable access intent context information includes a learnable intent representation weight vector.

[0012] The request content feature extraction network in the privacy access intent recognition model is used to perform feature extraction on the sample access request data to obtain sample request content features.

[0013] Feature matching is performed based on the training access context features and standard intent association features, and the intent matching error function value is determined based on the feature matching results; the standard intent association features are determined based on the behavioral semantic features and the sample request content features;

[0014] Based on the intent matching error function value, train the intent representation weight vector in the learnable access intent context information.

[0015] In one possible implementation, the learnable access intent context information includes first access intent context information, which includes a learnable first intent representation weight vector and a set of access intent types in the privacy access recognition scenario; the trained access context features include first trained access context features.

[0016] The step of performing feature matching based on the trained access context features and standard intent association features, and determining the intent matching error function value based on the feature matching result, includes:

[0017] The access intent combination feature is determined by the bidirectional encoding interaction unit in the intent feature combination unit based on the behavioral semantic features embedded as target features and the sample request content features embedded as reference embedding vectors and feature response vectors.

[0018] The first standard intent association feature is obtained by performing feature aggregation operation on the access intent combination feature through the feature aggregation unit in the intent feature combination unit.

[0019] Feature matching is performed based on the first training access context features and the first standard intent association features to obtain a first intent association score; the first intent association score is used to reflect the intent relevance index between the sample access request data and each set of access intent types in the privacy access identification scenario.

[0020] Based on the first intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, the first intent matching error function value is determined.

[0021] In one possible implementation, training the intent representation weight vector in the learnable access intent context information based on the intent matching error function value includes:

[0022] Based on the first intent matching error function value, train the first intent representation weight vector in the first access intent context information;

[0023] The method further includes:

[0024] The network weight matrix of the intent feature combination unit is trained based on the first intent matching error function value.

[0025] In one possible implementation, the learnable access intent context information includes a second access intent context information and a third access intent context information. The second access intent context information includes a learnable second intent representation weight vector and an access object identifier parsed from the access behavior semantic data. The third access intent context information includes the second intent representation weight vector and a set of access intent types in the privacy access identification scenario.

[0026] The step of extracting features from learnable access intent context information through the access context feature extraction network to obtain training access context features includes:

[0027] The access context feature extraction network is used to perform feature extraction operations on the second access intent context information and the third access intent context information respectively, to obtain the second training access context feature corresponding to the second access intent context information and the third training access context feature corresponding to the third access intent context information.

[0028] In one possible implementation, the step of performing feature matching based on the trained access context features and standard intent association features, and determining the intent matching error function value based on the feature matching result, includes:

[0029] The feature representation reflecting the overall access behavior semantic information is extracted from the behavioral semantic features and used as the second standard intent association feature; the feature representation reflecting the overall request content feature information is extracted from the sample request content features and used as the third standard intent association feature;

[0030] Feature matching is performed based on the second training access context features and the second standard intent association features to obtain a second intent association score; the first component error is determined based on the second intent association score.

[0031] Feature matching is performed based on the third training access context features and the second standard intent association features to obtain a third intent association score; based on the third intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, a second component error is determined.

[0032] Feature matching is performed based on the third training access context features and the third standard intent association features to obtain a fourth intent association score; based on the fourth intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, a third component error is determined;

[0033] The second intention matching error function value is determined based on the first component error, the second component error, and the third component error.

[0034] In one possible implementation, training the intent representation weight vector in the learnable access intent context information based on the intent matching error function value includes:

[0035] Based on the second intent matching error function value, train the second intent representation weight vector in the second access intent context information and the third access intent context information.

[0036] In one possible implementation, determining the access behavior semantic data corresponding to the sample access request data includes:

[0037] The semantic construction network generates original access behavior semantic data corresponding to the sample access request data based on the sample access request data; the semantic construction network is used to generate semantic annotation access request data corresponding to the target input sample data.

[0038] The semantic optimization network is used to semantically reconstruct the original access behavior semantic data to obtain the access behavior semantic data corresponding to the sample access request data.

[0039] In one possible implementation, the target access context feature includes a first target access context feature and a second target access context feature. The first target access context feature corresponds to a first target access intent context information including a first intent representation weight vector, and the second target access context feature corresponds to a second target access intent context information including a second intent representation weight vector. The first intent representation weight vector and the second intent representation weight vector are obtained through a heterogeneous feature extraction mechanism.

[0040] The step of performing feature matching based on the target request content features and target access context features, and determining the access intent category corresponding to the target access request data based on the feature matching results, includes:

[0041] Based on the target request content features and the first target access context features, feature matching is performed to obtain a fifth feature matching result; based on the target request content features and the second target access context features, feature matching is performed to obtain a sixth feature matching result;

[0042] The access intent category is determined based on the fifth feature matching result and the sixth feature matching result;

[0043] Wherein, the first intent representation weight vector is obtained by training based on the access intent combination features of semantically related behavioral semantic features and sample request content features, and the second intent representation weight vector is obtained by transforming the first intent representation weight vector through a first heterogeneous feature mapping; or, the second intent representation weight vector is obtained by training based on the overall behavioral semantic features parsed from the behavioral semantic features and the overall request content features parsed from the sample request content features, and the first intent representation weight vector is obtained by transforming the second intent representation weight vector through a second heterogeneous feature mapping.

[0044] In a second aspect, embodiments of the present invention provide a server system, including a server, the server being used to execute the method described in the first aspect.

[0045] Compared to existing technologies, the beneficial effects of this invention include: employing a deep learning-based method and system for identifying privacy data access intent and blocking abnormal behavior, as disclosed in this invention, the following steps are taken: First, target access request data to be identified is acquired. Then, features are extracted from the target access request data using a request content feature extraction network in the privacy access intent identification model to obtain target request content features. Next, the target request content features are matched with target access context features, and the access intent category is determined based on the matching result. The target access context features are extracted by the access context feature extraction network from target access intent context information containing a pre-trained intent representation weight vector and an access intent type set. If the access intent category belongs to a preset abnormal intent set, an abnormal blocking operation is performed. This invention achieves multi-dimensional feature fusion through a deep learning model, improving intent recognition accuracy and effectively preventing the risk of privacy data leakage. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be considered as limiting the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart illustrating the steps of the method for identifying privacy data access intent and blocking abnormal behavior based on deep learning provided in an embodiment of the present invention;

[0048] Figure 2 A schematic block diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0050] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0051] In order to solve the technical problems mentioned in the background art Figure 1 This is a flowchart illustrating the method for identifying privacy data access intent and blocking abnormal behavior based on deep learning provided in this embodiment. The following is a detailed description of this method.

[0052] Step S201: Obtain the target access request data to be identified;

[0053] Step S202: The target access request data is subjected to feature extraction operation through the request content feature extraction network in the privacy access intent recognition model to obtain the target request content features;

[0054] Step S203: Perform feature matching based on the target request content features and target access context features, and determine the access intent category corresponding to the target access request data based on the feature matching result; wherein, the target access context features are obtained by performing feature extraction operations on the target access intent context information through the access context feature extraction network in the privacy access intent recognition model, and the target access intent context information includes a pre-trained intent representation weight vector and a set of various access intent types in the privacy access recognition scenario;

[0055] Step S204: If the access intent category belongs to a preset abnormal intent set, then perform an abnormal access behavior blocking operation.

[0056] In this embodiment of the invention, for example, this implementation takes a commercial bank's core privacy data access monitoring system as the application scenario. The server acts as the execution entity to identify and block access intentions to sensitive privacy data such as customer ID numbers, bank card transaction records, and credit approval information.

[0057] The server first obtains the target access request data to be identified. It receives privacy data access requests from all employees and external partners through the bank's unified API gateway. All requests are encapsulated into HTTP / 2 protocol data packets, which include three parts: request header, request body, and request tail. The request header fields include the initiator ID (e.g., employee ID EMP00123 of ZhangSan, a customer manager in the retail business department), the terminal IP (internal office network IP 192.168.1.101), the request timestamp (2024-05-20 09:30:00), and the interface identifier ( / api / v1 / customer / transaction). The request body fields include the target customer ID (CUST10001), the access data type (transaction_records), the operation type (query), the data volume parameter (limit=50), and the time range (2024-01-01 to 2024-05-19). The request tail fields include the request signature and the terminal device fingerprint. After receiving the request, the server decrypts the request signature through the in-house key management system, verifies its consistency with the initiator ID, checks whether the request body is missing required fields such as customer_id, and if so, directly returns a 400 Bad Request error. It then determines whether the terminal IP is in the allowed access whitelist. External partner IPs must be in the preset whitelist; otherwise, they are temporarily stored in the suspicious request queue. After passing the above preliminary legality verification, the server marks the request as target access request data to be identified and stores it in the request processing queue in memory.

[0058] Next, the server uses the request content feature extraction network in the privacy access intent recognition model to perform feature extraction on the target access request data to obtain the target request content features. The server first preprocesses the target access request data, converting heterogeneous fields in the request into standardized feature vectors. For string fields, operation:query is mapped to a pre-trained Word2Vec vector (300 dimensions), and data_type:transaction_records is mapped to a special embedding vector for "sensitive transaction data" (300 dimensions). For numeric and time fields, limit=50 is normalized to 0.2 (the maximum allowed number of data records for a single query by a customer manager in this bank is 250), time_range span of 149 days is normalized to 0.3 (the maximum allowed span is 500 days), and the request time 09:30, which belongs to working hours (09:00-18:00), is converted into binary feature 1. For employee attribute association information, the department (retail business department) and position (customer manager) information of EMP00123 are obtained through the bank's employee information system and mapped to department embedding vector (200 dimensions) and position embedding vector (200 dimensions) respectively. All the above feature vectors are concatenated into an original feature sequence of length 1003. Subsequently, the server calls a request content feature extraction network consisting of 6 Transformer encoder layers to process the original feature sequence. The original feature sequence is converted into a 512-dimensional input embedding through a linear transformation layer, and positional encoding is added to preserve the semantic association of field order. The association weight between feature positions is calculated through the 8 attention heads of the first encoder layer. For example, the attention weight between data_type:transaction_records and operation:query is 0.8, and the weight between data_type:transaction_records and limit:50 is 0.3. After the attention output is transformed by two fully connected networks (with the activation function GELU), the feature distribution is stabilized by the LayerNorm layer. The subsequent 5 encoder layers repeat the above attention and feedforward process to gradually extract high-level semantic features. Finally, the 512-dimensional vector output by the 6th encoder layer is the target request content feature. The server stores it in the feature cache and records the top 10 high-weight dimensions. For example, the 120th dimension (representing the semantic strength of "account manager querying transaction data of managed customers") has a value of 0.91, and the 345th dimension (representing the semantic strength of "accessing sensitive data but the data volume is compliant") has a value of 0.85.

[0059] Next, the server performs feature matching based on the target request content features and target access context features to determine the access intent category. The server first loads pre-trained target access intent context information, including an intent representation weight vector set and an access intent type set (pre-defined as five categories: normal business query, abnormal batch export, unauthorized access to non-managed customer data, unauthorized access to production data in the test environment, and malicious tampering with privacy data). The intent representation weight vector set corresponds to a 512-dimensional weight vector for each intent category. For example, in the weight vector for "normal business query," the 120th dimension has a weight of 0.9, the 345th dimension has a weight of 0.8, and the 400th dimension (representing "access during working hours") has a weight of 0.7. Then, the server calls an access context feature extraction network composed of two fully connected fusion modules to process the above information. It concatenates the intent representation weight vector set with the intent type embedding (each type is mapped to a 128-dimensional embedding), and after transformation by the fully connected layer and processing by the LayerNorm layer, obtains the target access context feature set (each intent category corresponds to a 512-dimensional context feature vector). Subsequently, the server calculates the similarity score between the target request content features and each context feature vector. For example, the highest similarity score between the request content features of EMP00123 and the context features of "normal business query" is 0.92, the similarity score with "abnormal batch export" is 0.15 (due to the low score in the data volume compliance dimension), and the similarity score with "unauthorized access" is 0.08 (due to the low score in the department and customer matching dimension). The server determines the intent category corresponding to the highest score as the final result, that is, the intent of the request is normal business query. If the content features of a request (such as the technical department intern EMP00999 exporting 10,000 customer ID information in batches using an external IP at 23:05) have the highest similarity score of 0.88 with the context features of "abnormal batch export", then the intent category is abnormal batch export.

[0060] Finally, the server determines whether the access intent category belongs to the preset abnormal intent set. If it does, it performs an abnormal access behavior blocking operation. The preset abnormal intent set includes four categories: abnormal batch export, unauthorized access to non-managed customer data, unauthorized access to production data in the test environment, and malicious tampering with privacy data. Taking the "abnormal batch export" request of EMP00999 as an example, the server first sends an interrupt command to the core Oracle database, closes the session SID=12345, and returns a 403 Forbidden error to the initiating terminal. Then, it encapsulates the request details (initiator ID, IP, time, content, intent category, and blocking reason) into a JSON log and sends it to the internal SIEM system. Subsequently, it calls the security management platform API to send SMS and email alerts to security manager LiMing, and updates the internal IAM system to freeze the "privacy data access permission" of EMP00999 for 24 hours. It also sends a verification email to the client's office email address, requiring the client to submit the access reason and administrator approval form within 24 hours, otherwise the permission will be permanently frozen. If the intent category is a normal business query (such as the request of EMP00123), the server forwards it to the core database, retrieves the transaction record of CUST10001, and returns it to the terminal, while recording a normal access log for subsequent auditing.

[0061] Through the above process, the server achieves accurate intent identification and abnormal blocking of requests for accessing private data, effectively preventing the risk of sensitive data leakage and ensuring the security of commercial bank's private data.

[0062] In this embodiment of the invention, the intent representation weight vector is obtained through the following training method, which can be implemented through the following examples.

[0063] Determine the access behavior semantic data corresponding to the sample access request data;

[0064] The access context feature extraction network in the privacy access intent recognition model performs feature extraction on the access behavior semantic data to obtain behavioral semantic features; the access context feature extraction network performs feature extraction on the learnable access intent context information to obtain training access context features, wherein the learnable access intent context information includes a learnable intent representation weight vector.

[0065] The request content feature extraction network in the privacy access intent recognition model is used to perform feature extraction on the sample access request data to obtain sample request content features.

[0066] Feature matching is performed based on the training access context features and standard intent association features, and the intent matching error function value is determined based on the feature matching results; the standard intent association features are determined based on the behavioral semantic features and the sample request content features;

[0067] Based on the intent matching error function value, train the intent representation weight vector in the learnable access intent context information.

[0068] In an embodiment of the present invention, for example, the server uses historical privacy data access logs of commercial banks as a sample set, selects 100,000 labeled samples (including 5 types of intents such as normal business queries and abnormal batch exports), and executes the training process of intent representation weight vectors:

[0069] First, the server determines the access behavior semantic data corresponding to the sample access request data. For the sample request labeled "normal business query", "EMP00123 (retail account manager) initiated a query request at 09:30 with an internal IP address, targeting customer CUST10001 (its managed customer), data type transaction_records, limit=50", the server calls the semantic construction network to generate the original access behavior semantic data "retail account manager queries customer transaction records", and then reconstructs it through the semantic optimization network into "retail account manager queries the number of compliant transaction records of managed customers during working hours" (supplementing key semantic dimensions such as "working hours", "managed customers", and "compliant number").

[0070] Next, the server extracts features from the access behavior semantic data through the access context feature extraction network of the privacy access intent recognition model: the semantic text is converted into 512-dimensional behavioral semantic features through a 3-layer CNN encoder (where the feature weights of the dimensions "working hours", "managed customers" and "compliance quantity" are 0.8, 0.9 and 0.7 respectively); at the same time, the network processes learnable access intent context information (including a randomly initialized 512-dimensional learnable intent representation weight vector and a preset set of 5 types of access intent) and extracts training access context features (in the initial state, the training context features corresponding to "normal business query" have a correlation degree of only 0.4 with the real semantics).

[0071] Subsequently, the server calls the request content feature extraction network (6-layer Transformer encoder) to process the sample request data: first, the request fields are preprocessed into a standardized feature sequence (e.g., "query operation" is mapped to a 300-dimensional Word2Vec vector, "limit=50" is normalized to 0.2, and "access during working hours" is converted into binary feature 1), and then 512-dimensional sample request content features are extracted through a multi-layer attention mechanism (the dimensions "compliant data volume" and "jurisdictional customer matching" have weights of 0.85 and 0.91, respectively).

[0072] The server further generates standard intent association features: the behavioral semantic features and sample request content features are weighted and summed according to dimensions (the weights are preset by the model to 0.5:0.5), resulting in 512-dimensional standard features (for example, in the standard features of "normal business query", the composite dimension of "working time + compliant data volume" has a weight of 0.92). Subsequently, the server performs similarity matching between the trained access context features and the standard intent association features, and calculates the intent matching error function value (the initial error value is 0.6, due to the low matching degree caused by the unoptimized learnable weights).

[0073] Finally, based on the backpropagation algorithm, the server iteratively adjusts the intent representation weight vector in the learnable access intent context information, with the error function value as the optimization objective. For example, the weights of the "working hours" and "managed customers" dimensions in the weight vector corresponding to "normal business query" are increased from the initial 0.3 and 0.4 to 0.8 and 0.9 respectively, while the weights of the "non-managed customers" and "large-scale export" dimensions are decreased. After 100 rounds of iterative training, the intent matching error function value drops to 0.05, and the learnable intent representation weight vector converges to a stable state, completing the training.

[0074] In this embodiment of the invention, the learnable access intent context information includes first access intent context information, which includes a learnable first intent representation weight vector and a set of access intent types in the privacy access recognition scenario; the trained access context features include first trained access context features.

[0075] The step of performing feature matching based on the trained access context features and standard intent association features, and determining the intent matching error function value based on the feature matching result, can be implemented through the following example.

[0076] The first standard intent association feature is obtained by performing feature interaction encoding on the behavioral semantic features and the sample request content features through the intent feature combination unit.

[0077] Feature matching is performed based on the first training access context features and the first standard intent association features to obtain a first intent association score; the first intent association score is used to reflect the intent relevance index between the sample access request data and each set of access intent types in the privacy access identification scenario.

[0078] Based on the first intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, the first intent matching error function value is determined.

[0079] In an embodiment of the present invention, for example, the server uses a sample request labeled "normal business query" (a request from retail account manager EMP00123 to query the compliant quantity transaction records of client CUST10001 during working hours) as the training object to execute the training process of the first intent representation weight vector:

[0080] The server first loads the first access intent context information, which includes a randomly initialized 512-dimensional first intent representation weight vector (the initial values ​​of each dimension follow a normal distribution N(0,0.1)) and a preset set of 5 access intent types (normal business query, abnormal batch export, unauthorized access to non-managed customer data, unauthorized access to production data in the test environment, and malicious tampering with privacy data). The server calls the access context feature extraction network of the privacy access intent recognition model to extract features from the first access intent context information: through a 2-layer fully connected fusion module, the learnable first intent representation weight vector is concatenated with the 128-dimensional embedding vector of each intent type (e.g., "normal business query" is mapped to an initial vector containing the semantic tendencies of "working hours" and "managed customers"). After linear transformation and LayerNorm layer stabilization of the feature distribution, a 512-dimensional first training access context feature is output (initially, the correlation between this feature and the true semantics of "normal business query" is only 0.42).

[0081] Next, the server calls the bidirectional encoding interaction unit in the intent feature combination unit to interactively encode the extracted behavioral semantic features and sample request content features: the behavioral semantic features (512 dimensions, the feature corresponding to "retail account managers query the number of compliant transaction records of managed customers during working hours", where the weights of "working hours", "managed customers", and "compliant quantity" are 0.8, 0.9, and 0.7 respectively) are embedded as target features, and the sample request content features (512 dimensions, extracted by a 6-layer Transformer encoder after preprocessing the sample request fields, with the weights of "compliant data volume" and "managed customer matching" dimensions being 0.85 and 0.91 respectively) are used as reference embedding vectors and feature response vectors. Through a bidirectional attention mechanism, the key dimensions of the two features are mutually enhanced (e.g., the "managed customer" dimension has a weight of 0.9 in the behavioral semantic features and a weight of 0.91 in the sample request content features, and after interaction, the weight of this dimension increases to 0.95); then, through the mean pooling operation of the feature aggregation unit, the 512-dimensional first standard intent association features are obtained (the key composite dimension corresponding to "normal business query" has a weight of 0.92).

[0082] Subsequently, the server performs feature matching between the first training access context features and the first standard intent association features: calculating the cosine similarity between the first training access context features and the first standard intent association features corresponding to each intent category to obtain the first intent association score (initially, the score for "normal business query" was only 0.42, and the score for "abnormal batch export" was 0.38, with a uniform distribution of intent scores). The server uses the true intent identifier of the sample request (labeled as "normal business query", corresponding to one-hot encoding [1,0,0,0,0]) as a benchmark and uses the cross-entropy loss function to calculate the first intent matching error function value (the initial error value is 1.18, due to the lack of obvious differentiation among intent scores, the deviation from the true label is large).

[0083] Finally, based on the backpropagation algorithm, the server iteratively adjusts the first intent representation weight vector in the first access intent context information, with the first intent matching error function value as the optimization objective. Specifically, the weights of the "working hours," "managed customers," and "compliant quantity" dimensions in the first intent representation weight vector corresponding to "normal business query" are increased from the initial 0.2, 0.3, and 0.1 to 0.8, 0.9, and 0.7, respectively, while the weights of the "non-managed customers" and "large quantity export" dimensions are decreased. After 50 rounds of iterative training, the first intent association score corresponding to "normal business query" increases to 0.91, the first intent matching error function value decreases to 0.06, and the first intent representation weight vector converges to a stable state.

[0084] In this embodiment of the invention, the step of performing feature interaction encoding on the behavioral semantic features and the sample request content features through the intent feature combination unit to obtain the first standard intent association feature can be implemented through the following example.

[0085] The bidirectional encoding interaction unit in the intent feature combination unit determines the access intent combination feature based on the behavioral semantic feature embedded as the target feature and the sample request content feature embedded as the reference embedding vector and feature response vector.

[0086] The first standard intent association feature is obtained by performing feature aggregation operation on the access intent combination feature through the feature aggregation unit in the intent feature combination unit.

[0087] In this embodiment of the invention, for example, the server calls the bidirectional encoding interaction unit of the intent feature combination unit, embedding behavioral semantic features as the target feature, and using sample request content features as both the reference embedding vector and the feature response vector. First, the bidirectional encoding interaction unit performs dimensional similarity calculations on the target feature embedding (behavioral semantic features, 512 dimensions, where the weights of the dimensions "working time", "managed customers", and "compliance quantity" are 0.8, 0.9, and 0.7, respectively) and the reference embedding vector (sample request content features, 512 dimensions, where the weights of the dimensions "compliance data volume" and "managed customer matching" are 0.85 and 0.91, respectively): For each dimension i, the cosine similarity between the behavioral semantic feature dimension i and the sample request content feature dimension i is calculated to obtain the dimension attention weight (e.g., the similarity between the "managed customers" dimension is 0.98, and the similarity between the "compliance quantity" and "compliance data volume" dimensions is 0.95). Subsequently, the bidirectional encoding interaction unit weights each dimension of the sample request content features according to attention weights to obtain a feature response vector (e.g., the weight of the "jurisdiction customer matching" dimension after being weighted by 0.98 is 0.91×0.98≈0.89, and the weight of the "compliance data volume" dimension after being weighted by 0.95 is 0.85×0.95≈0.81). This response vector is then added to the target feature embedding by dimension to generate the access intent combination feature (512 dimensions, the weight of the "jurisdiction customer" composite dimension is 0.9+0.89=1.79, the weight of the "compliance quantity + compliance data volume" composite dimension is 0.7+0.81=1.51, and the weight of other irrelevant dimensions such as "malicious tampering identifier" remains below 0.1).

[0088] Next, the server calls the feature aggregation unit of the intent feature combination unit to perform normalization and mean pooling operations on the access intent combination features: First, L2 normalization is performed on all dimensions of the access intent combination features, normalizing the weight of the "managed customers" composite dimension from 1.79 to 0.95, the weight of the "compliance quantity + compliance data volume" composite dimension from 1.51 to 0.82, and the weight of the "working time" composite dimension (behavioral semantic feature "working time" dimension 0.8 + sample request content feature "working time access" dimension 1 × 0.8 = 1.6) to 0.85; then, the mean vector of the normalized features is calculated, retaining the relative weights of key dimensions while compressing noise dimensions, finally obtaining 512-dimensional first standard intent association features, of which the weight of the "managed customers" dimension is 0.95, the weight of the "compliance quantity" dimension is 0.82, and the weight of the "working time" dimension is 0.85, and the overall semantic matching degree with the "normal business query" intent is improved to 0.92.

[0089] In this embodiment of the invention, the step of training the intent representation weight vector in the learnable access intent context information based on the intent matching error function value can be implemented through the following example.

[0090] Based on the first intent matching error function value, train the first intent representation weight vector in the first access intent context information;

[0091] The present invention also provides the following embodiments.

[0092] The network weight matrix of the intent feature combination unit is trained based on the first intent matching error function value.

[0093] In an embodiment of the present invention, for example, the server starts the parameter training process with the initial value of the first intent matching error function of 1.18 corresponding to the sample request labeled "normal business query" (compliant access request of EMP00123) as the optimization target:

[0094] First, the server trains the first intent representation weight vector from the first access intent context information. The server calls the Adam optimizer (learning rate 0.001) to calculate the partial derivatives of the first intent matching error function with respect to each dimension of the first intent representation weight vector: for the "working time" dimension (initial weight 0.2), the partial derivative is -0.6 (large error because the weight of this dimension is too low, it needs to be adjusted positively); for the "managed customers" dimension (initial weight 0.3), the partial derivative is -0.72 (similarly, it needs to be increased); for the "large quantity threshold" dimension associated with "abnormal batch export" (initial weight 0.4), the partial derivative is 0.3 (large error because the weight of this dimension is too high, it needs to be decreased). The server updates the weights according to the gradient descent rule: the weight for the "Working Hours" dimension is updated to 0.2 - 0.001 × (-0.6) = 0.2006, the weight for the "Managed Customers" dimension is updated to 0.3 - 0.001 × (-0.72) = 0.3007, and the weight for the "Large Quantity Threshold" dimension is updated to 0.4 - 0.001 × 0.3 = 0.3997. After 5 rounds of iteration, the weights for the "Working Hours" and "Managed Customers" dimensions increased to 0.35 and 0.52 respectively, the first intent association score increased from 0.42 to 0.68, and the error decreased to 0.52.

[0095] Subsequently, the server synchronously trains the network weight matrix of the intent feature combination unit. For the dimensional attention weight matrix of the bidirectional encoding interaction unit (initially a random matrix of 512×512), the server calculates the partial derivative of the error with respect to the matrix elements: it finds that the interaction coefficient of the "managed customers" dimension (the 120th dimension of behavioral semantic features and the 120th dimension of sample request content features) is initially 0.5, and the partial derivative is -0.48 (due to insufficient interaction in this dimension, the error is large), so the coefficient is updated to 0.5 - 0.001 × (-0.48) = 0.50048; for the interaction coefficient of the "compliance quantity" and "compliance data volume" dimensions (initially 0.45), the partial derivative is -0.42, and it is updated to 0.45042. For the mean pooling weight matrix of the feature aggregation unit (initially a uniformly distributed matrix of 512×1), the server adjusts the pooling weights of key dimensions: the weight of the "managed customers" dimension is increased from 0.00195 (1 / 512) to 0.0039 (doubled), and the weight of the "compliance quantity" dimension is increased from 0.00195 to 0.00293.

[0096] After 50 iterations, the weights of the "working hours" and "managed customers" dimensions in the first intent representation weight vector stabilized at 0.8 and 0.9, respectively. The interaction coefficient of the bidirectional encoding interaction unit on the "managed customers" dimension increased to 0.85, and the pooling weight of the feature aggregation unit on the "compliance quantity" dimension increased to 0.0048. At this point, the first intent matching error function value dropped to 0.06, and the first intent association score corresponding to "normal business query" reached 0.91, indicating that parameter training was complete.

[0097] In this embodiment of the invention, the learnable access intent context information includes a second access intent context information and a third access intent context information. The second access intent context information includes a learnable second intent representation weight vector and an access object identifier obtained by parsing from the access behavior semantic data. The third access intent context information includes the second intent representation weight vector and a set of access intent types in the privacy access identification scenario.

[0098] The step of using the access context feature extraction network to extract features from learnable access intent context information to obtain training access context features can be implemented through the following example.

[0099] The access context feature extraction network is used to perform feature extraction operations on the second access intent context information and the third access intent context information respectively, to obtain the second training access context feature corresponding to the second access intent context information and the third training access context feature corresponding to the third access intent context information.

[0100] In an embodiment of the present invention, for example, the server uses a sample request labeled "normal business query" (a compliant access request of EMP00123) as the training object to execute the second and third training access context feature extraction processes:

[0101] First, the server constructs second and third access intent context information. For the second access intent context information, the server parses the access object identifier "CUST10001" from the access behavior semantic data "Retail account manager queries compliant quantity transaction records of managed customer CUST10001 during working hours," and maps it to a 128-dimensional customer identifier embedding vector using a pre-trained embedding model from the bank's customer information system (where the "managed customer" dimension has a weight of 0.2). Simultaneously, it loads a randomly initialized 512-dimensional second intent representation weight vector (each dimension value follows an N(0,0.1) distribution, with an initial "customer association" dimension weight of 0.15), and concatenates the two into a 640-dimensional input vector to constitute the second access intent context information. For the third access intent context information, the server uses the same 512-dimensional second intent representation weight vector as a basis, combined with the preset 5 types of access intent (normal business query, abnormal batch export, etc.), and maps each type of intent to a 128-dimensional type embedding vector (e.g., the "compliant access" dimension has a weight of 0.2 in the embedding vector of "normal business query"). The vectors are then concatenated to form a 512 + 5 × 128 = 1152-dimensional input vector, which constitutes the third access intent context information.

[0102] Next, the server calls the access context feature extraction network (a 2-layer fully connected fusion module) to process the two types of context information respectively: When processing the second access intent context information, the 640-dimensional input vector is transformed into a 512-dimensional intermediate feature through the first fully connected layer (W∈R^(640×512), activation function GELU), and then stably distributed through the LayerNorm layer to obtain the second training access context feature (512-dimensional, with an initial weight of 0.3 for the "customer identifier matching" dimension, and a true correlation of only 0.3 with CUST10001); When processing the third access intent context information, the 1152-dimensional input vector is transformed into a 512-dimensional intermediate feature through the first fully connected layer (W∈R^(1152×512)), and similarly processed through the LayerNorm layer to obtain the third training access context feature (512-dimensional, with an initial weight of 0.35 for the intent association dimension corresponding to "normal business query", and a matching degree of only 0.35 with the true intent).

[0103] Finally, the server stores the second training access context feature (associated access object identifier) ​​and the third training access context feature (associated intent type) in the training feature cache, providing input for subsequent matching and error calculation with standard intent-associated features. Initially, the association degree between the second training feature and the access object CUST10001 is 0.3, and the matching degree between the third training feature and the "normal business query" intent is 0.35, pending further training iterations for optimization.

[0104] In this embodiment of the invention, the step of performing feature matching based on the training access context features and standard intent association features, and determining the intent matching error function value based on the feature matching result, can be implemented through the following example.

[0105] The feature representation reflecting the overall access behavior semantic information is extracted from the behavioral semantic features and used as the second standard intent association feature; the feature representation reflecting the overall request content feature information is extracted from the sample request content features and used as the third standard intent association feature;

[0106] Feature matching is performed based on the second training access context feature, the third training access context feature, the second standard intent association feature, and the third standard intent association feature, and the second intent matching error function value is determined based on the feature matching result.

[0107] In an embodiment of the present invention, for example, the server uses the EMP00123 sample request labeled "normal business query" as the training object to execute the process of determining the second intent matching error function value. First, the server extracts the second and third standard intent association features: For the generated 512-dimensional behavioral semantic features (including the dimensions "working time", "managed customers", and "compliance quantity" with weights of 0.8, 0.9, and 0.7 respectively), the global average pooling layer is called to calculate the mean of all dimensions, extracting the feature representation reflecting the overall access behavior semantics, the second standard intent association features (512 dimensions, with the mean weight of each dimension concentrated around 0.8, among which the composite semantic dimension of "managed customers + working time" has a weight of 0.85); For the 512-dimensional sample request content features (including the dimensions "compliance data volume", "managed customer matching", and "intra-industry IP access" with weights of 0.85, 0.91, and 0.8 respectively), the global max pooling layer is called to extract the maximum value of each dimension, obtaining the third standard intent association features reflecting the overall request content features (512 dimensions, with the "managed customer matching" dimension becoming the core identifier dimension with a maximum value of 0.91, and the "compliance data volume" dimension retaining a weight of 0.85).

[0108] Next, the server performs multiple feature matching: it calls the cosine similarity calculation module to match the second training access context features (512-dimensional features extracted from the second access intent context information containing the access object identifier CUST10001, with an initial "customer identifier matching" dimension weight of 0.3) with the second standard intent association features, resulting in a similarity S1 = 0.35; it matches the third training access context features (512-dimensional features extracted from the third access intent context information containing a preset set of 5 access intent types, with an initial "normal business query" intent association dimension weight of 0.35) with the third standard intent association features, resulting in a similarity S2 = 0.4; and it cross-matches the third training access context features with the second standard intent association features, resulting in a similarity S3 = 0.38.

[0109] Finally, the server uses the true intent identifier of the sample request (one-hot encoding [1,0,0,0,0]) as a benchmark and calculates the second intent matching error function value using the weighted cross-entropy loss function: the weights of S1, S2, and S3 are set to 0.3, 0.5, and 0.2 respectively. Combined with the probability distribution of intent categories corresponding to each similarity (in the initial state, the probability of the "normal business query" category is only 0.32), the initial value of the second intent matching error function is finally obtained as 1.2. This value reflects the correlation deviation between the current second and third training access context features and the true intent.

[0110] In this embodiment of the invention, the step of performing feature matching based on the second training access context feature, the third training access context feature, the second standard intent association feature, and the third standard intent association feature, and determining the second intent matching error function value based on the feature matching result, can be implemented through the following example.

[0111] Feature matching is performed based on the second training access context features and the second standard intent association features to obtain a second intent association score; the first component error is determined based on the second intent association score.

[0112] Feature matching is performed based on the third training access context features and the second standard intent association features to obtain a third intent association score; based on the third intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, a second component error is determined.

[0113] Feature matching is performed based on the third training access context features and the third standard intent association features to obtain a fourth intent association score; based on the fourth intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, a third component error is determined;

[0114] The second intention matching error function value is determined based on the first component error, the second component error, and the third component error.

[0115] In this embodiment of the invention, for example, the server uses the sample request EMP00123 labeled "normal business query" as the training object and executes the process of determining the second intent matching error function value. First, the server calculates the first component error: it calls the cosine similarity calculation module to match the second training access context features (including the 512-dimensional features of the access object identifier CUST10001, with a "customer identifier matching" dimension weight of 0.3) with the second standard intent association features (512-dimensional features reflecting the overall access behavior semantics, with a "managed customer + working time" composite dimension weight of 0.85), obtaining a second intent association score of 0.35. Since this matching only needs to achieve feature dimension alignment and does not require associated intent classification, the server uses the mean squared error loss function to calculate the first component error, with an error value of (1-0.35)²=0.4225, quantifying the deviation between the customer identifier features and the overall behavioral semantics. Next, the server calculates the second component error: the third training access context features (containing 512-dimensional features of 5 intent type sets, with an initial weight of 0.35 for the "normal business query" intent dimension) are matched with the second standard intent association features to obtain a third intent association score of 0.38; combined with the sample's true intent identifier (one-hot encoding [1,0,0,0,0]), the server calls the cross-entropy loss function to normalize the 5 intent scores mapped by the third training context (0.38 for "normal business query" and 0.155 for the other four categories) into a probability distribution, and then calculates the cross-entropy with the true label to obtain a second component error of 0.58, quantifying the classification deviation between intent semantics and overall behavioral semantics. Subsequently, the server calculates the third component error: matching the third training access context features with the third standard intent association features (512-dimensional features reflecting the overall request content, with a weight of 0.91 for the "jurisdiction customer matching" dimension), resulting in a fourth intent association score of 0.4. Similarly, combining the real intent identifier, the five intent scores mapped from the third training context (0.4 for "normal business query" and 0.15 for the other four categories) are normalized and cross-entropy is calculated with the real labels, resulting in a third component error of 0.62, quantifying the classification deviation between intent semantics and the overall request content. Finally, the server weights and sums the values ​​according to preset weights (0.2 for the first component, 0.4 for the second component, and 0.4 for the third component) to obtain the second intent matching error function value: 0.4225×0.2+0.58×0.4+0.62×0.4=0.5645, comprehensively reflecting the overall deviation between multi-dimensional feature matching and intent classification.

[0116] In this embodiment of the invention, the step of training the intent representation weight vector in the learnable access intent context information based on the intent matching error function value can be implemented through the following example.

[0117] Based on the second intent matching error function value, train the second intent representation weight vector in the second access intent context information and the third access intent context information.

[0118] In this embodiment of the invention, for example, the server uses the initial value of the second intent matching error function (0.5645) as the optimization target and calls the Adam optimizer (learning rate 0.001) to start the joint training process of the second intent representation weight vector. First, the server calculates the partial derivatives of the error function with respect to each dimension of the second intent representation weight vector: for the "customer identifier matching" dimension (initial weight 0.3) corresponding to the second access intent context information, since the first component error of 0.4225 reflects the deviation of this dimension from the overall behavioral semantics, the partial derivative is -0.52 (the weight needs to be positively increased); for the "normal business query" intent dimension (initial weight 0.35) corresponding to the third access intent context information, since the second and third component errors of 0.58 and 0.62 reflect the classification deviation of this dimension from the behavioral semantics and request content, the partial derivative is -0.61 (the weight needs to be positively increased).

[0119] Subsequently, the server updates the weight vector of the second intent representation according to the gradient descent rule: the weight of the "customer identifier matching" dimension is adjusted from 0.3 to 0.3 - 0.001 × (-0.52) = 0.30052, and the weight of the "normal business query" intent dimension is adjusted from 0.35 to 0.35 - 0.001 × (-0.61) = 0.35061. Since the second and third access intent context information share this weight vector, the feature extraction results of both are synchronously optimized after the update: the weight of the "customer identifier matching" dimension of the second training access context feature increases to 0.35, and the weight of the "normal business query" intent dimension of the third training access context feature increases to 0.42.

[0120] The server repeats the gradient calculation and weight update process described above, recalculating the second intent matching error function value after each iteration. After 10 iterations, the weight of the "customer identifier matching" dimension reaches 0.52, the weight of the "normal business query" intent dimension reaches 0.65, and the second intent matching error decreases to 0.32. After 50 iterations, the weight of the "customer identifier matching" dimension stabilizes at 0.85 (perfectly aligned with the composite dimension of "managed customers + working hours" of the second standard intent association feature), the weight of the "normal business query" intent dimension rises to 0.9 (highly matched with the "managed customer matching" dimension of the third standard intent association feature), and the second intent matching error function value converges to 0.06. At this point, the matching score between the second training access context feature and the second standard intent association feature increases from 0.35 to 0.92, and the matching score between the third training access context feature and the third standard intent association feature increases from 0.4 to 0.91, completing the training of the second intent representation weight vector.

[0121] In this embodiment of the invention, the determination of the access behavior semantic data corresponding to the sample access request data can be implemented through the following example.

[0122] The semantic construction network generates original access behavior semantic data corresponding to the sample access request data based on the sample access request data; the semantic construction network is used to generate semantic annotation access request data corresponding to the target input sample data.

[0123] The semantic optimization network is used to semantically reconstruct the original access behavior semantic data to obtain the access behavior semantic data corresponding to the sample access request data.

[0124] In an embodiment of the present invention, for example, the server takes the EMP00123 sample request labeled "normal business query" as the processing object and executes the process of generating access behavior semantic data:

[0125] First, the server invokes the Semantic Construction Network (a structured data to semantic text module fine-tuned based on a pre-trained T5 model), inputting the structured fields of the sample request: Initiator ID "EMP00123", Operation type "query", Target customer ID "CUST10001", Data type "transaction_records", Request timestamp "2024-05-20 09:30:00", and Query quantity "limit=50". The Semantic Construction Network, through field mapping rules (e.g., "query" maps to "query request", "transaction_records" maps to "transaction records") and pre-trained text generation capabilities, generates raw access behavior semantic data: "EMP00123 initiated a query request, the target customer is CUST10001, the data type is transaction records, and the query quantity is 50 records." This raw semantics only covers the basic field associations of the request and does not include key business dimensions such as job attributes, customer jurisdiction, and compliance.

[0126] Next, the server invokes the Semantic Optimization Network (a semantic completion module that integrates multi-source system data, including the employee information system, customer management relationship database, and permission rule engine interface) to reconstruct the original semantic data. First, the Semantic Optimization Network calls the employee information system interface to obtain the job attribute "Retail Account Manager" for EMP00123; it calls the customer management relationship database interface to verify that CUST10001 belongs to EMP00123's managed customer list (by matching the customer ID with the employee's managed customer mapping table); and it calls the permission rule engine interface to confirm that limit=50 does not exceed the compliance threshold of 50 for a single query by an account manager, and that the request time of 09:30 falls within the industry's defined working hours (09:00-18:00). Subsequently, the Semantic Optimization Network embeds this supplementary information into the original semantics, performing dimensional completion and logical reconstruction to obtain the final access behavior semantic data: "Retail Account Manager EMP00123 queries the compliant number of transaction records of its managed customer CUST10001 during working hours." This semantic data contains four key semantic dimensions: "job attributes", "working hours", "managed clients", and "number of compliances", providing a complete semantic foundation for subsequent extraction of behavioral semantic features.

[0127] In this embodiment of the invention, the target access context feature includes a first target access context feature and a second target access context feature. The first target access context feature corresponds to a first target access intent context information including a first intent representation weight vector, and the second target access context feature corresponds to a second target access intent context information including a second intent representation weight vector. The first intent representation weight vector and the second intent representation weight vector are obtained through a heterogeneous feature extraction mechanism.

[0128] The step of performing feature matching based on the target request content features and target access context features, and determining the access intent category corresponding to the target access request data based on the feature matching results, includes:

[0129] Based on the target request content features and the first target access context features, feature matching is performed to obtain a fifth feature matching result; based on the target request content features and the second target access context features, feature matching is performed to obtain a sixth feature matching result;

[0130] The access intent category is determined based on the fifth feature matching result and the sixth feature matching result.

[0131] In this embodiment of the invention, for example, the server takes the target access request of EMP00123 as the processing object and executes the process of determining the access intent category. First, the server has extracted the target request content features of the request (512 dimensions, with a weight of 0.91 for the "jurisdiction customer matching" dimension, 0.85 for the "compliant data volume" dimension, and 0.8 for the "working hours access" dimension). These features are obtained by the request content feature extraction network through preprocessing and multi-layer Transformer encoding. Next, the server loads the pre-trained first target access context features and second target access context features: The first target access context features are derived from the first target access intent context information (including the trained first intent representation weight vector and 5 types of access intent types), and after being processed by the access context feature extraction network (2-layer fully connected fusion module), it outputs 512-dimensional features, of which the "normal business query" intent association dimension has a weight of 0.92 (this weight vector is trained by combining the semantic features of semantic association with the sample request content, and belongs to the semantic association path in the heterogeneous feature extraction mechanism); The second target access context features are derived from the second target access intent context information (including the trained second intent representation weight vector and the access object identifier CUST10001), and after being processed by the same network, it outputs 512-dimensional features, of which the "managed customer identifier matching" dimension has a weight of 0.88 (this weight vector is trained by the access object identifier and the overall behavioral semantic features, and belongs to the object association path in the heterogeneous feature extraction mechanism).

[0132] Subsequently, the server performs feature matching: the target request content features and the first target access context features are input into the cosine similarity calculation module, resulting in a fifth feature matching result of 0.91 (quantifying the semantic matching degree between the request content and the intent type set); the target request content features and the second target access context features are input into the same module, resulting in a sixth feature matching result of 0.89 (quantifying the association matching degree between the request content and the access object identifier). The server performs a weighted fusion of the two based on preset weights (the first target context feature matching result has a weight of 0.6, and the second target context feature matching result has a weight of 0.4), calculating a comprehensive matching score: 0.91 × 0.6 + 0.89 × 0.4 = 0.902. Finally, the server compares the comprehensive score with a preset intent category threshold (the threshold for "normal business query" is 0.85), and combines this score with the highest matching degree for the "normal business query" intent category, ultimately determining the access intent category of the request as "normal business query".

[0133] If the abnormal access request being processed is EMP00999 (the target request content feature "abnormal batch export" dimension weight is 0.88, and the "non-judgment customer" dimension weight is 0.9), the first target access context feature loaded by the server has a "abnormal batch export" intent association dimension weight of 0.85, and the second target access context feature has a "non-judgment customer identifier" dimension weight of 0.9. After matching, the fifth feature matching result is 0.88, the sixth feature matching result is 0.9, and the weighted comprehensive score is 0.888. Combined with the threshold rules of the preset abnormal intent set, the access intent category is finally determined to be "abnormal batch export".

[0134] In this embodiment of the invention, the first intent representation weight vector is obtained by training based on the access intent combination features of semantically related behavioral semantic features and sample request content features;

[0135] The second intent representation weight vector is obtained by training based on the overall behavioral semantic features parsed from the behavioral semantic features and the overall request content features parsed from the sample request content features.

[0136] In an embodiment of the present invention, for example, the server uses the EMP00123 sample request labeled "normal business query" as the training basis to execute a heterogeneous training process for the first and second intent representation weight vectors. First, the first intent representation weight vector is trained: The server calls the request content feature extraction network of the privacy access intent recognition model to preprocess the sample request data (including fields such as EMP00123 retail account manager job attributes, CUST10001 managed customer relationships, limit=50 compliance threshold, etc.). The "query operation" is mapped to a 300-dimensional Word2Vec vector, "limit=50" is normalized to 0.2, and "access during working hours" is converted into binary feature 1. Then, a 6-layer Transformer encoder extracts 512-dimensional sample request content features ("managed customer matching" dimension weight 0.91, "compliant data volume" dimension weight 0.85). At the same time, the access context feature extraction network encodes the access behavior semantic data corresponding to the sample ("retail account manager queries the compliant transaction records of managed customers during working hours") with a 3-layer CNN to obtain 512-dimensional behavioral semantic features ("working hours" dimension weight 0.8, "managed customer" dimension weight 0.9). The server inputs two features into the bidirectional encoding interaction module of the intent feature combination unit, embedding the behavioral semantic features as the target and the sample request content features as the reference. A bidirectional attention mechanism is used to enhance the association of key dimensions (e.g., the weight of the "managed customers" dimension increases to 0.95 after interaction), generating the access intent combination feature. Subsequently, the server loads the learnable first intent representation weight vector (initial 512-dimensional normal distribution vector) and a preset set of 5 access intent types. The server obtains the trained access context features through an access context feature extraction network, performs cosine matching with the access intent combination feature (initial matching score 0.42), calculates the error using the cross-entropy loss function (initial value 1.18), and iteratively updates the first intent representation weight vector using the Adam optimizer (learning rate 0.001). After 50 rounds of training, the weight of the "normal business query" intent association dimension in this vector stabilizes at 0.92, and the matching score increases to 0.91, completing the training of the first intent representation weight vector.

[0137] Next, the second intent representation weight vector is trained: the server performs global average pooling on the above 512-dimensional behavioral semantic features to extract 512-dimensional overall behavioral semantic features reflecting the overall access behavior ("Working Time + Managed Customers" composite dimension weight 0.85); simultaneously, global max pooling is performed on the sample request content features, retaining the maximum value of each dimension to obtain 512-dimensional overall request content features ("Managed Customer Matching" dimension weight 0.91). The server loads the learnable second intent representation weight vector (initial 512-dimensional normal distribution vector) and the access object identifier CUST10001 parsed from the access behavior semantic data (mapped to a 128-dimensional embedding vector through the in-house customer information system) to construct second access intent context information containing object associations, and obtains the trained access context features through the access context feature extraction network. The server performs cosine matching on the feature with the overall behavioral semantic feature and the overall request content feature (initial matching scores of 0.35 and 0.4 respectively). The error is calculated using a weighted cross-entropy loss function (first component weight 0.3, second component weight 0.7) (initial value 1.2). The second intent representation weight vector is iteratively optimized. After 50 rounds of training, the weight of the "management customer identifier matching" dimension in the vector increases to 0.88, and the matching score with the overall behavioral semantic feature reaches 0.92, completing the training of the second intent representation weight vector.

[0138] In this embodiment of the invention, the first intent representation weight vector is obtained by training based on the access intent combination features of semantically related behavioral semantic features and sample request content features, and the second intent representation weight vector is obtained by transforming the first intent representation weight vector through a first heterogeneous feature mapping.

[0139] or,

[0140] The second intent representation weight vector is obtained by training based on the overall behavioral semantic features parsed from the behavioral semantic features and the overall request content features parsed from the sample request content features. The first intent representation weight vector is obtained by transforming the second intent representation weight vector through a second heterogeneous feature mapping.

[0141] In this embodiment of the invention, for example, the server takes the EMP00123 sample request labeled "normal business query" as the processing object and executes the intent representation weight vector generation process of the first heterogeneous feature mapping path. First, the server loads the access behavior semantic data ("retail account manager queries the compliant transaction records of the managed customer during working hours") and the sample request content data (the query operation, limit=50, and in-line IP fields of EMP00123) corresponding to the sample. The server encodes the behavior semantic data through a 3-layer CNN encoder of the access context feature extraction network to obtain 512-dimensional behavior semantic features ("working hours" dimension weight 0.8, "managed customer" dimension weight 0.9). At the same time, the server preprocesses the sample request content data through a 6-layer Transformer encoder of the request content feature extraction network (e.g., "query" is mapped to a 300-dimensional Word2Vec vector, "limit=50" is normalized to 0.2) and encodes it to obtain 512-dimensional sample request content features ("compliant data volume" dimension weight 0.85, "managed customer matching" dimension weight 0.91). The server inputs two features into the bidirectional encoding interaction module of the intent feature combination unit, embedding the behavioral semantic features as the target and the sample request content features as the reference. A bidirectional attention mechanism is used to enhance the association between key dimensions such as "managed customers" and "compliant data volume" (after interaction, the weight of the "managed customers" dimension increases to 0.95), generating access intent combination features. Subsequently, the server loads a learnable first intent representation weight vector (initially a 512-dimensional normally distributed vector) and a preset set of 5 access intent types to construct the first access intent context information. The server obtains the trained access context features through a 2-layer fully connected fusion module of the access context feature extraction network, performs cosine matching with the access intent combination features, and iteratively optimizes the first intent representation weight vector using a cross-entropy loss function (initial error 1.18). After 50 rounds of training, the weight of the "normal business query" intent association dimension in this vector stabilizes at 0.92. Next, the server calls the built-in first heterogeneous feature mapping module (a 512×512 learnable linear transformation layer with GELU activation function, trained synchronously with the first weight vector). The trained and stable first intent representation weight vector is input into this module, and the key dimension weights are heterogeneously transformed through linear transformation (e.g., the weight of the "normal business query" dimension is scaled from 0.92 to 0.88 to adapt to the access object identification association requirement), and a 512-dimensional second intent representation weight vector is output, with the weight of the "managed customer identification matching" dimension reaching 0.88.For the second path, the server first trains the second intent representation weight vector to the "managed customer identifier" dimension weight of 0.88 based on the overall behavioral semantic features of the sample (weight of 0.85 for the "working time + managed customer" dimension after global average pooling) and the overall request content features (weight of 0.91 for the "managed customer matching" dimension after global max pooling). Then, it transforms the first weight vector through the second heterogeneous feature mapping module (symmetric linear transformation layer) to obtain the first weight vector, which has a weight of 0.92 for the "normal business query" dimension. Both paths achieve cross-dimensional adaptation through heterogeneous mapping, and can cover the generation requirements of two types of target context features without repeated training.

[0142] This invention provides a computer device 100, which includes a processor and a non-volatile memory storing computer instructions. When the computer instructions are executed by the processor, the computer device 100 performs the aforementioned deep learning-based method for identifying privacy data access intentions and blocking abnormal behavior. Figure 2 As shown, Figure 2 This is a structural block diagram of a computer device 100 provided in an embodiment of the present invention. The computer device 100 includes a memory 111, a processor 112, and a communication unit 113. To enable data transmission or interaction, the memory 111, processor 112, and communication unit 113 are electrically connected to each other directly or indirectly. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0143] For illustrative purposes, the foregoing description has been made with reference to specific embodiments. However, the foregoing illustrative discussions are not intended to be exhaustive or to limit the present disclosure to the precise forms disclosed. Numerous modifications and variations are possible in accordance with the foregoing teachings. These embodiments were chosen and described in order to best illustrate the principles of the present disclosure and its practical application, thereby enabling those skilled in the art to best utilize the disclosure and to employ various embodiments with different modifications to suit a particular intended application.

Claims

1. A method for identifying privacy data access intent and blocking abnormal behavior based on deep learning, characterized in that, include: Obtain the target access request data to be identified; The target access request data is extracted using the request content feature extraction network in the privacy access intent recognition model to obtain the target request content features. Feature matching is performed based on the target request content features and target access context features, and the access intent category corresponding to the target access request data is determined based on the feature matching results; wherein, the target access context features are obtained by performing feature extraction operations on the target access intent context information through the access context feature extraction network in the privacy access intent recognition model, and the target access intent context information includes a pre-trained intent representation weight vector and a set of various access intent types in the privacy access recognition scenario; If the access intent category belongs to a preset abnormal intent set, then an abnormal access behavior blocking operation is performed; The intent representation weight vector is obtained through the following training methods, including: Determine the access behavior semantic data corresponding to the sample access request data; The access context feature extraction network in the privacy access intent recognition model performs feature extraction on the access behavior semantic data to obtain behavioral semantic features; the access context feature extraction network performs feature extraction on the learnable access intent context information to obtain training access context features, wherein the learnable access intent context information includes a learnable intent representation weight vector. The request content feature extraction network in the privacy access intent recognition model is used to perform feature extraction on the sample access request data to obtain sample request content features. Feature matching is performed based on the training access context features and standard intent association features, and the intent matching error function value is determined based on the feature matching results; the standard intent association features are determined based on the behavioral semantic features and the sample request content features; Based on the intent matching error function value, train the intent representation weight vector in the learnable access intent context information.

2. The method according to claim 1, characterized in that, The learnable access intent context information includes first access intent context information, which includes a learnable first intent representation weight vector and a set of access intent types in the privacy access recognition scenario; the trained access context features include first trained access context features. The step of performing feature matching based on the trained access context features and standard intent association features, and determining the intent matching error function value based on the feature matching result, includes: The access intent combination feature is determined by the bidirectional encoding interaction unit in the intent feature combination unit based on the behavioral semantic features embedded as target features and the sample request content features embedded as reference embedding vectors and feature response vectors. The first standard intent association feature is obtained by performing feature aggregation operation on the access intent combination feature through the feature aggregation unit in the intent feature combination unit. Feature matching is performed based on the first training access context features and the first standard intent association features to obtain a first intent association score; the first intent association score is used to reflect the intent relevance index between the sample access request data and each set of access intent types in the privacy access identification scenario. Based on the first intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, the first intent matching error function value is determined.

3. The method according to claim 2, characterized in that, The step of training the intent representation weight vector in the learnable access intent context information based on the intent matching error function value includes: Based on the first intent matching error function value, train the first intent representation weight vector in the first access intent context information; The method further includes: The network weight matrix of the intent feature combination unit is trained based on the first intent matching error function value.

4. The method according to claim 1, characterized in that, The learnable access intent context information includes second access intent context information and third access intent context information. The second access intent context information includes a learnable second intent representation weight vector and an access object identifier obtained from the access behavior semantic data. The third access intent context information includes the second intent representation weight vector and a set of access intent types in the privacy access identification scenario. The step of extracting features from learnable access intent context information through the access context feature extraction network to obtain training access context features includes: The access context feature extraction network is used to perform feature extraction operations on the second access intent context information and the third access intent context information respectively, to obtain the second training access context feature corresponding to the second access intent context information and the third training access context feature corresponding to the third access intent context information.

5. The method according to claim 4, characterized in that, The step of performing feature matching based on the trained access context features and standard intent association features, and determining the intent matching error function value based on the feature matching result, includes: The feature representation reflecting the overall access behavior semantic information is extracted from the behavioral semantic features and used as the second standard intent association feature; the feature representation reflecting the overall request content feature information is extracted from the sample request content features and used as the third standard intent association feature; Feature matching is performed based on the second training access context features and the second standard intent association features to obtain a second intent association score; the first component error is determined based on the second intent association score. Feature matching is performed based on the third training access context features and the second standard intent association features to obtain a third intent association score; based on the third intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, a second component error is determined. Feature matching is performed based on the third training access context features and the third standard intent association features to obtain a fourth intent association score; based on the fourth intent association score and the access intent identification information of the sample access request data in the privacy access identification scenario, a third component error is determined; The second intention matching error function value is determined based on the first component error, the second component error, and the third component error.

6. The method according to claim 5, characterized in that, The step of training the intent representation weight vector in the learnable access intent context information based on the intent matching error function value includes: Based on the second intent matching error function value, train the second intent representation weight vector in the second access intent context information and the third access intent context information.

7. The method according to claim 1, characterized in that, The access behavior semantic data corresponding to the determined sample access request data includes: The semantic construction network generates original access behavior semantic data corresponding to the sample access request data based on the sample access request data; the semantic construction network is used to generate semantic annotation access request data corresponding to the target input sample data. The semantic optimization network is used to semantically reconstruct the original access behavior semantic data to obtain the access behavior semantic data corresponding to the sample access request data.

8. The method according to claim 1, characterized in that, The target access context features include a first target access context feature and a second target access context feature. The first target access context feature corresponds to a first target access intent context information including a first intent representation weight vector. The second target access context feature corresponds to a second target access intent context information including a second intent representation weight vector. The first intent representation weight vector and the second intent representation weight vector are obtained through a heterogeneous feature extraction mechanism. The step of performing feature matching based on the target request content features and target access context features, and determining the access intent category corresponding to the target access request data based on the feature matching results, includes: Based on the target request content features and the first target access context features, feature matching is performed to obtain a fifth feature matching result; based on the target request content features and the second target access context features, feature matching is performed to obtain a sixth feature matching result; The access intent category is determined based on the fifth feature matching result and the sixth feature matching result; Wherein, the first intent representation weight vector is obtained by training based on the access intent combination features of semantically related behavioral semantic features and sample request content features, and the second intent representation weight vector is obtained by transforming the first intent representation weight vector through a first heterogeneous feature mapping; or, the second intent representation weight vector is obtained by training based on the overall behavioral semantic features parsed from the behavioral semantic features and the overall request content features parsed from the sample request content features, and the first intent representation weight vector is obtained by transforming the second intent representation weight vector through a second heterogeneous feature mapping.

9. A server system, characterized in that, Includes a server, the server being used to perform the method according to any one of claims 1-8.

Images