Multi-dimensional user behavior data real-time portrait construction method and system for rare earth industry

Abstract

The invention belongs to the technical field of data analysis and user modeling, and discloses a multi-dimensional user behavior data real-time portrait construction method and system for the rare earth industry. Aiming at the problems that traditional static color distribution cannot be matched with real appeals of users and abnormal operation is difficult to perceive, multi-dimensional feature vectors such as operation habits, access preferences and work collaboration are extracted by gathering operation track data of the users on multiple platforms; dynamically refreshing a user portrait by adopting a stream-oriented computing framework, and supporting a time sliding window and aging attenuation; and value-added services such as permission optimization suggestions, abnormal operation identification and interface personality adaptation are provided based on the portraits. According to the method, the permission configuration goodness of fit is improved by four percent, the abnormal operation recognition accuracy is over 90 percent, and the method is suitable for user management and safety audit scenes of a rare earth enterprise informatization platform.

Description

Technical Field

[0001] This invention falls under the category of data analysis and user modeling technology, specifically involving a multi-dimensional real-time user behavior profile construction scheme for rare earth enterprise information platforms. It can be widely applied to user management, permission optimization, security auditing, and personalized service scenarios in rare earth enterprise information systems such as manufacturing execution platforms, resource planning platforms, and supplier collaboration platforms. Background Technology

[0002] Rare earth enterprise information systems involve numerous user groups, including production operators, quality inspectors, material procurement personnel, and management personnel. Existing user management technologies have significant shortcomings: 1. Static color assignment is rigid: Traditional color-based access control uses static color assignment, which cannot dynamically adjust permission configuration according to the user's actual work needs, resulting in permissions that are too broad or too narrow; 2. Abnormal operations are difficult to detect: Due to the lack of continuous monitoring and analysis of user behavior, abnormal actions by internal personnel (such as batch export of sensitive data) are difficult to detect in a timely manner; 3. Poor user experience: The system's functional layout is rigid and does not take into account the usage habits of different users. Users have to search for frequently used functions in a complicated menu. 4. Lack of user insight: Managers struggle to grasp the actual usage of the system, resulting in a lack of data support for feature optimization and training. 5. Compliance audit difficulties: The lack of complete user behavior records and analysis makes it difficult to meet compliance audit requirements.

[0003] The aforementioned limitations prevent existing technologies from achieving an integrated design of "behavior aggregation + profile construction + intelligent application," making it difficult to meet the demands of rare earth enterprises for refined user management. Summary of the Invention

[0004] (a) Technical problems to be solved To address the shortcomings of traditional user management methods, such as static rigidity, difficulty in detecting abnormal operations, and poor user experience, this invention proposes a multi-dimensional real-time user behavior profiling scheme for the rare earth industry. The goal is to improve the consistency of permission configuration by 40%, the accuracy of abnormal operation identification by over 90%, and the efficiency of user operation by 20%.

[0005] (II) Technical Solution The core idea of ​​this invention is to construct an integrated user profiling system that combines "full data aggregation + multi-dimensional profiling + intelligent services." The specific technical path is as follows: 1. Convergence of multi-source behavioral trajectories Design of embedded components: Web client: A non-intrusive event tracking component based on a scripting language, which automatically aggregates page access, clicks, scrolling and other behaviors; Mobile: Based on natively developed event tracking components, it integrates screen switching, gesture operations, terminal information, etc. Server-side: Aggregates API calls, data operations, and other behaviors through aspect-oriented programming. Aggregate data structure: { "userId": "U001", "eventType": "PAGE_VIEW", "eventTime": "2024-03-15T10:30:45.123Z", "pageId": "order_list", "duration": 35000, "deviceInfo": {"os": "Windows", "browser": "Chrome"}, "sessionId": "S123456" } Data transmission: Behavioral data is transmitted in real time to a distributed message relay channel to ensure that no data is lost.

[0006] 2. Real-time extraction of multi-dimensional features Operating habits and characteristics: High-frequency functions: Count the number of times each function is accessed and select the top ten. Active periods: Count the number of operations by hour to identify patterns in users' work hours; Operation frequency: Calculate the average number of operations per day and the peak number of operations per minute; Operation sequence: Extracting common operation path patterns; Access preference characteristics: Duration of stay: The average time spent on each side of the vehicle; Usage depth: Function usage is divided into three levels: browsing level (less than 10 seconds), operation level (10 to 60 seconds), and deep usage level (more than 60 seconds); Search behavior: search keywords, search frequency; Features of collaborative work: Collaboration and Relationships: Analyze data sharing and process collaboration to build a user collaboration graph; Approval Roles: Statistics on the role distribution of users in the approval process; Workload: Number of tasks processed, average response time; Timeliness processing: A time-sliding window mechanism was used to calculate the characteristic values ​​for 7 days, 30 days, and 90 days, respectively. By introducing a time-decrease factor, recent behaviors are given higher weight.

[0007] 3. Dynamic updates to user profiles Real-time computing architecture: The streaming computing framework is used to consume behavioral data in the message relay channel; Grouping by user identifier; Use state storage to store the user's cumulative feature values; Incremental refresh of feature values ​​to avoid full recalculation; Profile data model: { "userId": "U001", "basicInfo": {"name": "Zhang San", "department": "Production Department", "role": "Operator"}, "habitFeatures": {"topFunctions": [...], "activeHours": [...], "avgDailyOps": 156}, "preferenceFeatures": {"avgPageDuration": 45, "useDepth": "deep"}, "workPatternFeatures": {"collaborators": [...], "approvalRole": "initiator"}, "updateTime": "2024-03-15T10:35:00Z" } Storage strategy: In-memory database: Stores the latest profiles and supports millisecond-level queries; Columnar storage: Stores historical image snapshots, supporting the tracking of image changes.

[0008] 4. Value-added services for portraits Permission optimization suggestions: Analyze the differences between the actual functions used by users and the current permission configuration; For features that you have permission to use but have never used, it is recommended to revoke them. For functions that are frequently accessed but for which the user does not have permission (identified by access denial logs), it is recommended to grant permission. Generate a permission optimization suggestion report for administrator approval and confirmation; Abnormal operation identification: Establish user behavior baselines (based on historical user profiles); Real-time monitoring of behavioral deviations: Abnormal authentication: unusual time period, unusual network address, unusual terminal; Unauthorized access attempts: Frequent attempts to access functions without permission; Data risk actions: Batch data export, access to sensitive data; An alert is triggered when the deviation exceeds the threshold. Personalized interface adaptation: The menu order is automatically adjusted based on frequently used functions; Advanced features are recommended based on usage depth; Recommend relevant users and data based on collaborative relationships.

[0009] (III) Beneficial Effects 1. Refined access control: Access recommendations based on actual usage behavior improve the accuracy by 40% and reduce access redundancy; 2. Controllable safety risks: Abnormal operation identification accuracy rate is over 90%, and internal risks are detected in a timely manner; 3. Enhanced User Experience: Customized interface adaptation improves user operation efficiency by 20%; 4. Evidence-based management decisions: User behavior analysis provides data support for system optimization and training; 5. Compliance audit support: Complete behavioral records and profile history to meet audit requirements. Attached Figure Description

[0010] Appendix Figure 1 This is a schematic diagram of the system architecture for building user behavior profiles. Detailed Implementation The following example, using the user profile construction of a rare earth enterprise's manufacturing execution platform, illustrates the specific implementation process of this invention in detail: (a) Implementation preparation 1. Data point deployment: Manufacturing execution platform web page: integrates script tracking components to automatically aggregate page access and click behavior; Manufacturing Execution Platform Server: Aggregates API call behaviors through aspect-oriented programming; The event tracking data is transmitted to the message relay channel (subject: user_behavior); 2. Computing environment configuration: Streaming computing cluster: three computing executors, each configured with eight computing slots; In-memory database cluster: three-master, three-slave architecture, total memory 64GB; Columnar storage cluster: three storage nodes; 3. User Scope: Manufacturing Execution Platform Users: A total of 350 people, including 200 production operators, 50 quality inspectors, 30 schedulers, and 70 managers.

[0011] (II) Implementation Steps 1. Behavioral data aggregation: The event tracking component automatically aggregates user behavior data, with an average daily aggregation volume of approximately 500,000 records. Aggregated behavior types: PAGE_VIEW (page view), CLICK (click), API_CALL (API call), LOGIN (authentication); Data is written to the message relay channel in real time and retained for seven days.

[0012] 2. Feature calculation configuration: Configure the streaming computing job and subscribe to the user_behavior topic; Configure feature calculation rules: High-frequency function: Seven-day sliding window, which counts the number of times each function is accessed; Active period: 30-day sliding window, operation distribution statistics by hourly interval; Abnormal baseline: Ninety-day sliding window, calculate the mean and standard deviation of behavior; Image refresh frequency: Real-time incremental refresh.

[0013] 3. Deployment of value-added services: Permission suggestion service: Generates a weekly report with suggestions for permission optimization; Anomaly detection service: Real-time monitoring and alerts triggered by abnormal behavior; Personalized Adaptation Service: Returns personalized configurations during user authentication.

[0014] 4. Effect Verification and Optimization: After one month of operation, user feedback was collected. Adjust feature weights and anomaly thresholds based on feedback; Iteratively optimize the profile model.

[0015] (III) Verification of Implementation Results 1. Optimized permission settings: Analysis revealed that 35% of users had redundant permissions (they had permissions but never used them). Recommendations for optimizing permissions: Revoke 156 redundant permissions and add 42 necessary permissions; Permission configuration accuracy improved from 60% to 95%. Anomaly detection performance: 23 instances of abnormal behavior were identified within one month of launch: 8 abnormal authentication attempts (outside of working hours, abnormal network address); Export data in batches 5 times; Unauthorized access attempts 10 times; After verification, there were 21 genuine anomalies and 2 false alarms, resulting in an accuracy rate of 91.3%. 3. User experience: Personalized menus reduced the average number of clicks required for users to find frequently used functions from 4.2 to 1.5. User satisfaction survey: 85% of users believe the system is easier to use; 4. Management decision support: The "Production Reporting" function was found to have a low usage rate (only 35%), which was found to be due to its complex operation, triggering function optimization. Ten high-performing users were identified, and their operating patterns were distilled into best practices for use in new employee training.

[0016] This implementation case fully verifies the feasibility and advancement of the present invention. It realizes refined user management of the rare earth enterprise information system through user behavior profiling. The features and application strategies can be adjusted according to different systems and user groups, and it has good versatility and scalability.

Claims

1. A method for constructing real-time profiles of multi-dimensional user behavior data for the rare earth industry, characterized in that, Includes the following steps: a. Multi-source behavior trajectory aggregation: Aggregates user authentication behavior: verification time, source network address, access terminal, verification method (password / single sign-on / biometrics); aggregates function access behavior: access page identifier, access time, dwell time, operation sequence; aggregates data operation behavior: CRUD operations, operation data category, operation data volume; aggregates business process behavior: approval initiation, approval processing, process time. Behavioral trajectories are aggregated through front-end tracking components and transmitted in real time to a distributed message relay channel; b. Real-time extraction of multi-dimensional features: Operational behavior characteristics: Top ten high-frequency functions and their usage frequency; Distribution of active time periods (statistics by hourly intervals); Operation frequency (average daily number of operations, peak operation density); Access Preference Features: Average dwell time on the screen; Depth of function usage (browsing level / operation level / deep usage level); Navigation path mode; Work Collaborative Features: * **Collaborative User Association Graph (Data Sharing, Process Collaboration)** * **Approval Link Roles (Initiator / Approver / Executor)** * **Workload Indicators (Number of Tasks Processed, Response Time)** * **Feature Calculation Uses a Time-Sliding Window (7 Days / 30 Days) with Support for Time-Fade Processing** * **Dynamic User Profile Refresh:** Utilizes a streaming computing framework to process behavioral data streams. * **Incremental Refresh of User Profiles:** New behavioral data triggers feature recalculation. * **Profile Data Storage:** Data is stored in an in-memory database (for real-time querying) and columnar storage (for historical archiving). * **Profile Refresh Latency Controlled Within 5 Seconds** * **Profile Value-Added Services:** * **Permission Optimization Suggestions:** Recommend permission adjustment schemes based on actual user usage. * **Abnormal Operation Identification:** Establish user behavior baselines and identify abnormal actions deviating from the baseline. * **Personalized Interface Adaptation:** Automatically adjust interface layout and function entry points based on user preferences. * **User Clustering:** Cluster users based on profile similarity to support refined operations. The system is characterized by the following features: a. A behavior aggregation module: providing web / mobile terminal tracking components, supporting automatic aggregation and custom events, with aggregation latency below 100 milliseconds; b. A feature calculation module: implemented based on a streaming computing framework, supporting real-time calculation of more than fifty features, with calculation latency below 1 second; c. A profile storage module: storing real-time profiles in an in-memory database (query latency below 5 milliseconds), and archiving historical profiles in columnar storage (supporting profile backtracking); d. A value-added service module: providing profile query interfaces, anomaly recognition interfaces, and recommendation interfaces, with a concurrent processing capacity of over a thousand times per second; e. A visualization module: providing a panoramic view of user profiles, behavior trajectory playback, and group analysis reports. The feature calculation in step 2 supports configuring differentiated time sliding windows and decay coefficients, with recent behavior having a higher weight than historical behavior. The decay formula is: Weight = e^(-λ×days), where λ is the decay factor. The system is characterized in that, in step 4, abnormal operation identification adopts a profile-based behavioral benchmark model. An alert is triggered when a user's behavior deviates from their own benchmark by more than three times the standard deviation. It supports the identification of risky actions such as abnormal identity verification, unauthorized access, and batch data export. Furthermore, the system supports data privacy compliance; users can view and export their own profile data and apply to clear historical behavior records.

Images