Data behavior prevention and control and anomaly detection system based on big data

Abstract

The invention discloses a data behavior prevention and control and anomaly detection system based on big data, and relates to the technical field of data security. Comprising a data acquisition module used for acquiring user behavior data; the feature construction module is used for constructing emotion features, space-time trajectory features and abnormal data features according to the preprocessed user behavior data; the calculation module is used for calculating to obtain a comprehensive score according to the emotion features, the spatial-temporal trajectory features and the abnormal data features; the threshold judgment module is used for respectively carrying out threshold judgment on the comprehensive emotion score, the comprehensive space-time score and the comprehensive generated data score, and generating a first abnormal signal, a second abnormal signal and a third abnormal signal when a threshold condition is exceeded; and the model construction module is used for constructing an anomaly detection model and generating a fourth anomaly signal when an anomaly is detected. Through multi-dimensional feature fusion, real-time anomaly detection and a deep learning technology based on big data, the accuracy of abnormal behavior recognition is improved, and the security and reliability of the system are enhanced.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to a data behavior prevention and anomaly detection system based on big data. Background Technology

[0002] With the rapid development of big data technology, more and more fields are beginning to utilize big data analytics for intelligent decision-making and behavior prediction. Especially in the areas of user behavior control and anomaly detection, efficiently identifying abnormal behavior and taking timely measures is crucial for improving system security and user experience.

[0003] Traditional anomaly detection methods primarily rely on rule-based detection and simple statistical analysis. However, these methods often fail to accurately identify complex anomaly patterns when faced with complex, multi-dimensional, and large-scale data. The limitations of traditional methods become increasingly apparent, especially when dealing with multiple features such as user emotions, behavioral trajectories, and automated behavioral data. Summary of the Invention

[0004] Based on the shortcomings of the prior art described above, the purpose of this invention is to provide a big data-based data behavior prevention and anomaly detection system to solve the aforementioned technical problems.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a big data-based data behavior prevention and anomaly detection system, comprising: Data acquisition module: used to acquire user behavior data, including user interaction data, spatiotemporal trajectory data, and generated data; Feature construction module: used to preprocess user behavior data and construct sentiment features, spatiotemporal trajectory features and abnormal data features based on the preprocessed user behavior data; Calculation module: used to calculate a comprehensive sentiment score based on sentiment characteristics, a comprehensive spatiotemporal score based on spatiotemporal trajectory characteristics, and a comprehensive generated data score based on abnormal data characteristics; Threshold judgment module: used to judge the threshold of the comprehensive sentiment score. When the threshold condition is exceeded, the first abnormal signal is generated. Threshold judgment is performed on the comprehensive spatiotemporal score. When the threshold condition is exceeded, the second abnormal signal is generated. Threshold judgment is performed on the comprehensive generated data score. When the threshold condition is exceeded, the third abnormal signal is generated. Model building module: used to build an anomaly detection model based on sentiment features, spatiotemporal trajectory features and abnormal data features, perform anomaly detection based on the anomaly detection model, and generate a fourth anomaly signal when an anomaly is detected.

[0006] The present invention is further configured such that the emotional features include emotional synchronicity, emotional ambiguity, emotional volatility, emotional coordination, and emotional deviation. A comprehensive emotional score is calculated based on emotional synchronicity, emotional ambiguity, emotional volatility, emotional coordination, and emotional deviation.

[0007] The present invention further specifies that the calculation logic for emotional synchronization is as follows: ,in, For the emotional synchronicity at time t, For the emotional state of i users at all times, The emotional state of the external environment at any given moment, including systems, groups, and social media. for and Difference in emotional perspective For indicator functions, The size of the time window; The calculation logic for sentiment ambiguity is as follows: ,in, For the emotional ambiguity at time t, and For emotional changes, For regulatory factors, It is an exponential decay factor; The calculation logic for sentiment volatility is as follows: ,in, Let be the emotional volatility at time t. To control the sensitivity coefficient of emotional fluctuations, For threshold, As a regulating factor; The calculation logic for emotional coordination is as follows: ,in, For the emotional coordination at time t, Let i be the emotional state of the k-th member in the group at time i. For the number of group members, To adjust the parameters affecting emotional compatibility, To adjust the parameters affecting emotional fluctuations, Parameters to control the impact of emotional changes on coordination; The calculation logic for emotional deviation is as follows: ,in, The degree of emotional deviation at time t For the time-to-time i system and social expected emotional state, For the nonlinear amplification factor of emotional deviation, To control for the impact of emotional differences on the degree of deviation, sensitivity was assessed. The calculation logic for the comprehensive sentiment score is as follows: ,in, , , , and These are the weighting coefficients for the sentiment parameters.

[0008] The present invention is further configured such that the spatiotemporal trajectory features include a spatiotemporal correlation increasing exponent, a spatiotemporal trajectory anomalous offset, spatiotemporal density cross-entropy, spatiotemporal nonlinear oscillation value, and spatiotemporal adaptive jump threshold; A comprehensive spatiotemporal score is calculated based on the spatiotemporal correlation increasing index, spatiotemporal trajectory anomalous offset, spatiotemporal density cross-entropy, spatiotemporal nonlinear turbulence oscillation value, and spatiotemporal adaptive jump threshold.

[0009] The present invention further specifies that the calculation logic of the spatiotemporal correlation increasing index is as follows: ,in, For the spatiotemporal correlation increasing index, For time point i, The spatial location of time point i, To adjust the rate of change in time and space; The calculation logic for the spatiotemporal trajectory anomalous offset is as follows: ,in, For spatiotemporal trajectory anomalous offset, For the trajectory start time, For the starting spatial position of the trajectory, and For exponential coefficients, It serves as a regulator of anomalous behavior; The calculation logic for time density entropy is as follows: ,in, For time density entropy, For the user's behavioral density in time i and spatial region j, and The edge density in time period i and spatial region j are respectively. and These are the discretized components of time and space, respectively; The calculation logic for the spatiotemporal nonlinear dynamic oscillation value is as follows: ,in, For spatiotemporal nonlinear dynamic oscillation values, To control the frequency of time oscillation, Spatial location at the previous time point, For the maximum possible spatial deviation, To control the oscillation sensitivity parameter; The calculation logic for the spatiotemporal adaptive jump threshold is as follows: ,in, For spatiotemporal adaptive jump threshold, and Parameters to control the impact of jump amplitude A decay factor to control time jumps; The calculation logic for the comprehensive spatiotemporal score is as follows: ,in, , , , and These are the weighting coefficients for the spatiotemporal parameters.

[0010] The present invention is further configured such that the abnormal data features include a generated data fuzziness factor, a generated data fluctuation factor, a script periodic anomaly intensity, and an automated behavior disorder degree; A comprehensive score for the generated data is calculated based on the fuzziness factor, fluctuation factor, script cycle anomaly intensity, and disorder of automated behavior.

[0011] The present invention is further configured such that the calculation logic for generating the data fuzziness factor is as follows: ,in, To generate data fuzzy factors, For the i-th feature, Features The second gradient, Features Information entropy To adjust the ambiguity sensitivity parameter of the i-th feature, the feature Information entropy The calculation logic is as follows: ,in, Features specific value probability, Features specific value The logarithm of the probability; The calculation logic for generating the data volatility factor is as follows: ,in, To generate data volatility factor, Features Changes over time Features Changes in spatial dimensions Features Changes in the semantic dimension For the standardized feature quantities, , and To adjust the sensitivity constant for dimensional changes; The calculation logic for the script cycle anomaly strength is as follows: ,in, For abnormal strength of the script cycle, The characteristics of the behavioral sequence at time t, The equilibrium value of the behavior over the entire time span, For time period range, To adjust the sensitivity constant for periodic behavioral changes; The calculation logic for the disorder degree of automated behavior is as follows: ,in, For the disorder of automated behavior, For the state sequence of the i-th action, For the entropy value of the behavior sequence, Duration of the behavior Entropy is a sensitivity constant to the randomness of behavior; the entropy value of the behavior sequence. The calculation logic is as follows: ,in, For state probability of occurrence The total number of different states in the behavioral sequence For state The logarithm of the probability of occurrence; The calculation logic for the comprehensive generated data score is as follows: ,in, , , and These are the weighting coefficients.

[0012] The present invention is further configured to: perform threshold judgment on the comprehensive sentiment score, and generate a first abnormal signal when the comprehensive sentiment score is greater than a preset comprehensive sentiment score threshold; perform threshold judgment on the comprehensive spatiotemporal score, and generate a second abnormal signal when the comprehensive spatiotemporal score is greater than a preset comprehensive spatiotemporal score threshold; and perform threshold judgment on the comprehensive generated data score, and generate a third abnormal signal when the comprehensive generated data score is greater than a preset comprehensive generated data score threshold.

[0013] The present invention is further configured such that the construction logic of the anomaly detection model includes: Acquire historical user behavior data and corresponding tags, construct sentiment features, spatiotemporal trajectory features, and abnormal data features based on historical user behavior data, set them as a dataset, and include normal and abnormal tags; Frequency correlation analysis was performed on sentiment features, spatiotemporal trajectory features, and abnormal data features, and the feature corresponding to the calculated maximum value was set as the construction feature of the decision tree. Based on the features constructed by the decision tree, an anomaly detection model is built according to the decision tree algorithm. The dataset is divided into a training set and a test set. The anomaly detection model is trained using the training set and validated using the validation set. After validation, user behavior data is input into the anomaly detection model to perform anomaly analysis on user behavior. Once anomaly behavior is detected, a fourth anomaly signal is generated.

[0014] The present invention further specifies that the calculation logic for frequency correlation analysis is as follows: ,in, For frequency association statistics, For observation frequency, The desired frequency.

[0015] This invention provides a big data-based data behavior prevention and anomaly detection system, which includes a data acquisition module for acquiring user behavior data, including user interaction data, spatiotemporal trajectory data, and generated data. The feature construction module is used to preprocess user behavior data and construct sentiment features, spatiotemporal trajectory features, and abnormal data features based on the preprocessed user behavior data. The calculation module calculates a comprehensive sentiment score based on the sentiment features, a comprehensive spatiotemporal score based on the spatiotemporal trajectory features, and a comprehensive generated data score based on the abnormal data features. The threshold judgment module performs threshold judgment on the comprehensive sentiment score; if the threshold condition is exceeded, a first abnormal signal is generated. It also performs threshold judgment on the comprehensive spatiotemporal score; if the threshold condition is exceeded, a second abnormal signal is generated. Finally, it performs threshold judgment on the comprehensive generated data score; if the threshold condition is exceeded, a third abnormal signal is generated. The model construction module constructs an anomaly detection model based on the sentiment features, spatiotemporal trajectory features, and abnormal data features. It then performs anomaly detection based on the anomaly detection model. When an anomaly is detected, a fourth abnormal signal is generated. The beneficial effects include: 1. Multi-dimensional feature fusion improves the accuracy of anomaly detection: By combining users' emotional features, spatiotemporal trajectory features and abnormal data features, the system comprehensively analyzes multiple dimensions of user behavior, which can more accurately identify abnormal behavior. The comprehensive evaluation of emotional features, spatiotemporal trajectory features and abnormal data features enables the system to capture different types of abnormal patterns, avoiding the limitations of single feature analysis. 2. Highly efficient real-time anomaly detection and early warning: By setting thresholds and establishing anomaly detection models, the system can promptly generate abnormal signals and activate corresponding prevention and control mechanisms when user behavior deviates from normal patterns. Combining historical data with real-time monitoring, the system has a high response speed and can provide timely early warnings for potential abnormal behaviors; 3. Deep learning and intelligent decision-making capabilities based on big data: By utilizing big data processing technology, it can efficiently process and analyze massive amounts of data. Through the application of decision tree algorithms, the system can automatically identify key features, reduce manual intervention and reliance, improve the model's adaptability and intelligence level, and further enhance the accuracy and reliability of anomaly detection.

[0016] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a structural diagram of a big data-based data behavior prevention and anomaly detection system, which is an exemplary embodiment of the present invention. Detailed Implementation

[0018] The embodiments of the present invention will be described below with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention and not for limiting the scope of protection of the present invention.

[0019] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0020] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0021] Data behavior control and anomaly detection systems based on big data, such as Figure 1 As shown, it includes: Data acquisition module: used to acquire user behavior data, including user interaction data, spatiotemporal trajectory data, and generated data; Feature construction module: used to preprocess user behavior data and construct sentiment features, spatiotemporal trajectory features and abnormal data features based on the preprocessed user behavior data; Calculation module: used to calculate a comprehensive sentiment score based on sentiment characteristics, a comprehensive spatiotemporal score based on spatiotemporal trajectory characteristics, and a comprehensive generated data score based on abnormal data characteristics; Threshold judgment module: used to judge the threshold of the comprehensive sentiment score. When the threshold condition is exceeded, the first abnormal signal is generated. Threshold judgment is performed on the comprehensive spatiotemporal score. When the threshold condition is exceeded, the second abnormal signal is generated. Threshold judgment is performed on the comprehensive generated data score. When the threshold condition is exceeded, the third abnormal signal is generated. Model building module: used to build an anomaly detection model based on sentiment features, spatiotemporal trajectory features and abnormal data features, perform anomaly detection based on the anomaly detection model, and generate a fourth anomaly signal when an anomaly is detected.

[0022] The present invention further specifies that the emotional features include emotional synchronicity, emotional ambiguity, emotional volatility, emotional consistency, and emotional deviation; the present invention further specifies that the calculation logic for emotional synchronicity is as follows: ,in, For the emotional synchronicity at time t, For the emotional state of i users at all times, The emotional state of the external environment at any given moment, including systems, groups, and social media. for and Difference in emotional perspective For indicator functions, The time window size; the calculation logic for sentiment ambiguity is as follows: ,in, For the emotional ambiguity at time t, and For emotional changes, For regulatory factors, The exponential decay factor is used; the calculation logic for sentiment volatility is as follows: ,in, Let be the emotional volatility at time t. To control the sensitivity coefficient of emotional fluctuations, For threshold, As a moderating factor; the calculation logic for emotional coordination is as follows: ,in, For the emotional coordination at time t, Let i be the emotional state of the k-th member in the group at time i. For the number of group members, To adjust the parameters affecting emotional compatibility, To adjust the parameters affecting emotional fluctuations, To control for the impact of emotional changes on coordination, the calculation logic for emotional deviation is as follows: ,in, The degree of emotional deviation at time t For the time-to-time i system and social expected emotional state, For the nonlinear amplification factor of emotional deviation, To control the sensitivity of emotional differences to deviation, specifically, emotional synchronicity comprehensively assesses the fluctuations of user emotions and their correlation with the surrounding environment by considering differences in emotional perspectives and changes in emotional state. It describes the synchronous relationship between the user's emotional state and the emotional state of the external environment, including groups and social media. Emotional ambiguity measures the uncertainty of emotional platforms, reflecting the degree of emotional fluctuation and the complexity of its changes. Emotional volatility measures the frequency and intensity of user emotional changes. Emotional coordination measures emotional coordination through differences in the emotional states of group members, emotional matching degree, and emotional volatility. Emotional deviation measures the difference between the user's emotions and the expected emotional state of the system or society, identifying abnormal emotional states, including drastic fluctuations in group emotions and extreme deviations in individual emotions. Indicator functions are also included. As a condition, the existence of an emotional state is determined by conditions; when an emotional state exists or meets specific conditions, it is considered to exist. The value is 1 otherwise the value is 0. The specific manifestation of the above calculation logic is as follows: and ; Used to control the strength of the influence of emotional changes on emotional ambiguity, with a value range of [0.1, 5]; Used to determine the degree of influence of the magnitude of emotional change on emotional ambiguity over different time periods, with a value range of [0,1]. Used to regulate the effect of emotional fluctuations on mood volatility, with a value range of [0.5, 5]. Used to distinguish between significant and minor emotional changes, with a value range of [0.1, 2]. Used to control the impact of cumulative emotional changes on mood volatility, with a value range of [2,5]. This is used to moderate the impact of differences in the emotions of group members on the overall coordination, with a value range of [0.5, 5]. Used to control the degree of influence of emotional fluctuations on coordination, with a value range of [0.1, 3]; Used to moderate the impact of overall group emotional changes on emotional harmony, with a value range of [0.01, 1]. The magnification effect is used to adjust the degree of deviation, and the value range is [0,5]. The calculated deviation is used to control the exponential inhibition effect and has a value range of [0,10]. Based on a dynamic sentiment analysis model with complex emotional features, it fully considers the interaction of multiple factors such as emotional state, changes, and the external environment, exhibiting high accuracy and robustness. A comprehensive sentiment score is calculated based on sentiment synchronicity, sentiment ambiguity, sentiment volatility, sentiment consistency, and sentiment deviation. The calculation logic for the comprehensive sentiment score is as follows: ,in, , , , and These are the weighting coefficients for the sentiment parameters; specifically, the comprehensive sentiment score comprehensively evaluates a given moment by considering multiple sentiment dimensions. The overall emotional state can help the system accurately judge the emotional state of an individual or group; , , , and These factors are used to determine the influence weight of each of the above sentiment dimensions on the overall sentiment score, with a value range of [0,1], and the sum of all weight coefficients is 1. By reasonably adjusting the weights, the influence of different dimensions can be flexibly emphasized according to specific needs, meeting the sentiment analysis needs of different application scenarios.

[0023] The present invention further specifies that the spatiotemporal trajectory features include a spatiotemporal correlation increasing exponent, a spatiotemporal trajectory anomalous offset, spatiotemporal density cross-entropy, spatiotemporal nonlinear oscillation value, and a spatiotemporal adaptive jump threshold; the present invention further specifies that the calculation logic of the spatiotemporal correlation increasing exponent is as follows: ,in, For the spatiotemporal correlation increasing index, For time point i, The spatial location of time point i, To adjust the exponent of temporal and spatial change rates, the calculation logic for the anomalous offset of the spatiotemporal trajectory is as follows: ,in, For spatiotemporal trajectory anomalous offset, For the trajectory start time, For the starting spatial position of the trajectory, and For exponential coefficients, As a moderating factor for anomalous behavior; the calculation logic for time density entropy is as follows: ,in, For time density entropy, For the user's behavioral density in time i and spatial region j, and The edge density in time period i and spatial region j are respectively. and These are the discretized components of time and space, respectively; the calculation logic for the spatiotemporal nonlinear dynamic oscillation value is as follows: ,in, For spatiotemporal nonlinear dynamic oscillation values, To control the frequency of time oscillation, Spatial location at the previous time point, For the maximum possible spatial deviation, To control the oscillation sensitivity parameter, the calculation logic for the spatiotemporal adaptive jump threshold is as follows: ,in, For spatiotemporal adaptive jump threshold, and Parameters to control the impact of jump amplitude To control the decay factor of time volume jumps; specifically, the spatiotemporal correlation increasing index measures the spatiotemporal correlation by combining the rate of change of time and space, and is used to measure the relationship between the time difference and spatial location difference between different time points; the spatiotemporal trajectory anomalous offset is used to identify abnormal offsets in user trajectories; the spatiotemporal density cross-entropy is used to measure the entropy value of the user's behavior distribution in time and space; the spatiotemporal nonlinear turbulence oscillation value is used to describe the nonlinear fluctuation of user behavior; and the spatiotemporal adaptive jump threshold is used to measure the "jump" behavior at a series of time and space points; Used to adjust the influence of the rate of change of time and space on the spatiotemporal correlation, controlling the weighting degree of the rate of change of time and space, with a value range of [0,3]; Used to control the degree of influence of time offset, with a value range of [0.5, 2]; Used to control the degree of influence of spatial offset, with a value range of [0.5, 2]; Used to adjust the overall impact of abnormal behavior on spatiotemporal offset according to specific scenarios, with a value range of [0.5, 2]. Used to adjust the periodicity of time oscillation, with a value range of [0.5, 2]; Used to control the degree of influence of spatial deviation on oscillation, with a value range of [0,2]; Used to control the effect of time variation on the jump amplitude, with a value range of [0.5, 2]; Used to control the intensity of the influence of spatial changes on the jump amplitude, with a value range of [0.5, 1.5]. Used to control the rate at which the effect of time difference on jump decays over time, with a value range of [0.2,1]. The above spatiotemporal trajectory features can capture complex dynamic behaviors in spatiotemporal data in detail. Different parameter settings can flexibly adjust the sensitivity to time, space, rate of change and abnormal behavior according to different application scenarios. Reasonable selection and adjustment of these parameters can help to make accurate monitoring and prediction in dynamic environments, and improve the real-time response capability and analysis accuracy of the system. A comprehensive spatiotemporal score is calculated based on the increasing spatiotemporal correlation index, anomalous spatiotemporal trajectory offset, spatiotemporal density cross-entropy, spatiotemporal nonlinear oscillation value, and spatiotemporal adaptive jump threshold. The calculation logic for the comprehensive spatiotemporal score is as follows: ,in, , , , and These are the weighting coefficients for spatiotemporal parameters. Specifically, the comprehensive spatiotemporal score is used to evaluate the overall performance of a spatiotemporal trajectory or dynamic behavior. , , , and These are used to represent the importance of each spatiotemporal feature to the comprehensive spatiotemporal score, with values ​​ranging from [0,1] and a combined weighting coefficient of 1. By combining features such as the spatiotemporal correlation increasing index, trajectory anomalous offset, and nonlinear dynamic oscillation value, the comprehensive spatiotemporal score can identify possible abnormal behaviors in the spatiotemporal trajectory.

[0024] The present invention further specifies that the abnormal data characteristics include a generated data fuzziness factor, a generated data fluctuation factor, a script periodic anomaly intensity, and an automated behavior disorder degree; the present invention further specifies that the calculation logic for the generated data fuzziness factor is as follows: ,in, To generate data fuzzy factors, For the i-th feature, Features The second gradient, Features Information entropy To adjust the ambiguity sensitivity parameter of the i-th feature, the feature Information entropy The calculation logic is as follows: ,in, Features specific value probability, Features specific value The logarithm of the probability; the calculation logic for the data volatility factor is as follows: ,in, To generate data volatility factor, Features Changes over time Features Changes in spatial dimensions Features Changes in the semantic dimension For the standardized feature quantities, , and To adjust the sensitivity constant for dimensional changes, the calculation logic for the script cycle anomaly intensity is as follows: ,in, For abnormal strength of the script cycle, The characteristics of the behavioral sequence at time t, The equilibrium value of the behavior over the entire time span, For time period range, To adjust the periodicity sensitivity constant of behavioral changes, the calculation logic for the disorder degree of automated behavior is as follows: ,in, For the disorder of automated behavior, For the state sequence of the i-th action, For the entropy value of the behavior sequence, Duration of the behavior Entropy is a sensitivity constant to the randomness of behavior; the entropy value of the behavior sequence. The calculation logic is as follows: ,in, For state probability of occurrence The total number of different states in the behavioral sequence For state The logarithm of the probability of occurrence; specifically, the generated data fuzziness factor is used to measure the uncertainty of the generated data; the generated data volatility factor is used to assess the stability of the generated data in multiple dimensions; the script periodic anomaly intensity is used to measure periodic behavioral anomalies in automated systems; and the degree of disorder in automated behavior is used to measure the degree of random behavior in the generated data. Used to control the influence of features in the calculation of fuzzy factors in generated data, with a value range of [0,5]; Used to adjust the influence of the time dimension on the volatility factor, with a value range of [0,10]; Used to adjust the influence of spatial dimension on the contribution of volatility factor, with a value range of [0.5, 20]; Used to adjust the influence of semantic dimension on the contribution of volatility factor, with a value range of [0.1, 15]; Used to adjust the impact of behavioral changes on the intensity of periodic anomalies, with a value range of [0.5, 2]. Used to adjust the influence of behavioral entropy on disorder, with a value range of [0,5]; by combining the generated data fuzziness factor, generated data fluctuation factor, script cycle anomaly intensity, and automated behavioral disorder measurement, it is possible to comprehensively analyze data anomalies from multiple dimensions, which facilitates the identification of potential fluctuations or irregular patterns. A comprehensive generated data score is calculated based on the generated data fuzziness factor, generated data fluctuation factor, script cycle anomaly intensity, and disorder of automated behavior; the calculation logic for the comprehensive generated data score is as follows: ,in, , , and These are weighting coefficients; specifically, the comprehensive data score is used to assess the degree of anomaly or quality of the data. , , and These factors are used to adjust the importance of the generated data fuzziness factor, generated data fluctuation factor, script cycle anomaly intensity, and automated behavior disorder in the comprehensive generated data score, respectively. The value range is [0,1], and the total weight coefficient is 1. By weighting and summing the four key anomaly indicators, a comprehensive evaluation index can be provided, which helps to improve the accuracy of data quality detection and anomaly detection capabilities, and optimize system performance and decision support.

[0025] The present invention is further configured to: perform threshold judgment on the comprehensive sentiment score; generate a first abnormal signal when the comprehensive sentiment score is greater than a preset comprehensive sentiment score threshold; perform threshold judgment on the comprehensive spatiotemporal score; generate a second abnormal signal when the comprehensive spatiotemporal score is greater than a preset comprehensive spatiotemporal score threshold; and perform threshold judgment on the comprehensive generated data score; generate a third abnormal signal when the comprehensive generated data score is greater than a preset comprehensive generated data score threshold. Specifically, when the comprehensive sentiment score is greater than the preset comprehensive sentiment score threshold, it indicates that the user's sentiment has changed and there is a potential risk, thus generating the first abnormal signal; when the comprehensive spatiotemporal score is greater than the preset comprehensive spatiotemporal score threshold, it indicates that the user's behavior is abnormal, thus generating the second abnormal signal; and when the comprehensive generated data score is greater than the preset comprehensive generated data score threshold, it indicates that the generated data or automated behavior is abnormal, thus generating the third abnormal signal.

[0026] The present invention is further configured such that the construction logic of the anomaly detection model includes: Acquire historical user behavior data and corresponding labels, construct sentiment features, spatiotemporal trajectory features, and abnormal data features based on the historical user behavior data, set as a dataset, and label it as normal and abnormal; specifically, the labels are used for supervised learning, and the model is trained through known normal and abnormal data samples to enable it to classify and predict new data; Frequency correlation analysis is performed on emotional features, spatiotemporal trajectory features, and abnormal data features. The feature corresponding to the calculated maximum value is set as the construction feature of the decision tree. Specifically, the feature corresponding to the calculated maximum value is the most effective in distinguishing between normal and abnormal behavior, which helps to improve model performance. Features are constructed based on decision trees, and an anomaly detection model is built according to the decision tree algorithm. Specifically, a decision tree is a machine learning algorithm based on a tree structure, which is suitable for classification and regression problems. Through feature selection and recursive data partitioning, input data is mapped to different categories, ultimately forming a flowchart-like structure. This is an existing technology and will not be elaborated on here.

[0027] The dataset is divided into training and testing sets. The anomaly detection model is trained using the training set and validated using the validation set. After successful validation, user behavior data is input into the anomaly detection model to perform anomaly analysis. When anomaly behavior is detected, a fourth anomaly signal is generated. Specifically, 70% of the dataset is used as the training set to train the model, and 30% is used as the testing set to evaluate the model. After successful validation, the validated anomaly detection model is applied to real-time data analysis to monitor and classify user behavior data. When anomaly behavior is detected, an anomaly warning mechanism is triggered, generating a fourth anomaly signal.

[0028] The present invention further specifies that the calculation logic for frequency correlation analysis is as follows: ,in, For frequency association statistics, For observation frequency, The expected frequency; specifically, frequency correlation analysis is used to measure the influence of each feature on anomaly detection, and the frequency correlation statistic is... It is used to measure the difference between actual observations and expected values; the larger the value, the stronger the correlation. By calculating the contribution of different features to anomaly detection, the features that can best distinguish between normal and abnormal data are selected to improve model performance.

[0029] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0030] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0031] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0032] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0033] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0034] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0035] In the several embodiments provided in this application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0036] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0037] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0038] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0039] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A big data-based data behavior control and anomaly detection system, characterized in that, include: Data acquisition module: used to acquire user behavior data, including user interaction data, spatiotemporal trajectory data, and generated data; Feature construction module: used to preprocess user behavior data and construct sentiment features, spatiotemporal trajectory features and abnormal data features based on the preprocessed user behavior data; Calculation module: used to calculate a comprehensive sentiment score based on sentiment characteristics, a comprehensive spatiotemporal score based on spatiotemporal trajectory characteristics, and a comprehensive generated data score based on abnormal data characteristics; Threshold judgment module: used to judge the threshold of the comprehensive sentiment score. When the threshold condition is exceeded, the first abnormal signal is generated. Threshold judgment is performed on the comprehensive spatiotemporal score. When the threshold condition is exceeded, the second abnormal signal is generated. Threshold judgment is performed on the comprehensive generated data score. When the threshold condition is exceeded, the third abnormal signal is generated. Model building module: used to build an anomaly detection model based on sentiment features, spatiotemporal trajectory features and abnormal data features, perform anomaly detection based on the anomaly detection model, and generate a fourth anomaly signal when an anomaly is detected.

2. The data behavior prevention and anomaly detection system based on big data according to claim 1, characterized in that, Emotional characteristics include emotional synchronicity, emotional ambiguity, emotional volatility, emotional consistency, and emotional deviation. A comprehensive emotional score is calculated based on emotional synchronicity, emotional ambiguity, emotional volatility, emotional coordination, and emotional deviation.

3. The data behavior prevention and anomaly detection system based on big data according to claim 2, characterized in that, The computational logic for emotional synchronicity is as follows: ,in, For the emotional synchronicity at time t, For the emotional state of i users at all times, The emotional state of the external environment at any given moment, including systems, groups, and social media. for and Difference in emotional perspective For indicator functions, The size of the time window; The calculation logic for sentiment ambiguity is as follows: ,in, For the emotional ambiguity at time t, and For emotional changes, For regulatory factors, It is an exponential decay factor; The calculation logic for sentiment volatility is as follows: ,in, Let be the emotional volatility at time t. To control the sensitivity coefficient of emotional fluctuations, For threshold, As a regulating factor; The calculation logic for emotional coordination is as follows: ,in, For the emotional coordination at time t, Let i be the emotional state of the k-th member in the group at time i. For the number of group members, To adjust the parameters affecting emotional compatibility, To adjust the parameters affecting emotional fluctuations, Parameters to control the impact of emotional changes on coordination; The calculation logic for emotional deviation is as follows: ,in, The degree of emotional deviation at time t For the time-to-time i system and social expected emotional state, For the nonlinear amplification factor of emotional deviation, To control for the impact of emotional differences on the degree of deviation, sensitivity was assessed. The calculation logic for the comprehensive sentiment score is as follows: ,in, , , , and These are the weighting coefficients for the sentiment parameters.

4. The data behavior prevention and anomaly detection system based on big data according to claim 1, characterized in that, Spatiotemporal trajectory features include the spatiotemporal correlation increasing exponent, spatiotemporal trajectory anomalous offset, spatiotemporal density cross-entropy, spatiotemporal nonlinear oscillation value, and spatiotemporal adaptive jump threshold; A comprehensive spatiotemporal score is calculated based on the spatiotemporal correlation increasing index, spatiotemporal trajectory anomalous offset, spatiotemporal density cross-entropy, spatiotemporal nonlinear turbulence oscillation value, and spatiotemporal adaptive jump threshold.

5. The data behavior prevention and anomaly detection system based on big data according to claim 4, characterized in that, The calculation logic for the spatiotemporal correlation increasing index is as follows: ,in, For the spatiotemporal correlation increasing index, For time point i, The spatial location of time point i, To adjust the rate of change in time and space; The calculation logic for the spatiotemporal trajectory anomalous offset is as follows: ,in, For spatiotemporal trajectory anomalous offset, For the trajectory start time, For the starting spatial position of the trajectory, and For exponential coefficients, It serves as a regulator of anomalous behavior; The calculation logic for time density entropy is as follows: ,in, For time density entropy, For the user's behavioral density in time i and spatial region j, and The edge density in time period i and spatial region j are respectively. and These are the discretized components of time and space, respectively; The calculation logic for the spatiotemporal nonlinear dynamic oscillation value is as follows: ,in, For spatiotemporal nonlinear dynamic oscillation values, To control the frequency of time oscillation, Spatial location at the previous time point, For the maximum possible spatial deviation, To control the oscillation sensitivity parameter; The calculation logic for the spatiotemporal adaptive jump threshold is as follows: ,in, For spatiotemporal adaptive jump threshold, and Parameters to control the impact of jump amplitude A decay factor to control time jumps; The calculation logic for the comprehensive spatiotemporal score is as follows: ,in, , , , and These are the weighting coefficients for the spatiotemporal parameters.

6. The data behavior prevention and anomaly detection system based on big data according to claim 1, characterized in that, Abnormal data characteristics include generated data fuzziness factor, generated data fluctuation factor, script periodic anomaly intensity, and disorder of automated behavior; A comprehensive score for the generated data is calculated based on the fuzziness factor, fluctuation factor, script cycle anomaly intensity, and disorder of automated behavior.

7. The data behavior prevention and anomaly detection system based on big data according to claim 6, characterized in that, The calculation logic for generating the data fuzziness factor is as follows: ,in, To generate data fuzzy factors, For the i-th feature, Features The second gradient, Features Information entropy To adjust the ambiguity sensitivity parameter of the i-th feature, the feature Information entropy The calculation logic is as follows: ,in, Features specific value probability, Features specific value The logarithm of the probability; The calculation logic for generating the data volatility factor is as follows: ,in, To generate data volatility factor, Features Changes over time Features Changes in spatial dimensions Features Changes in the semantic dimension For the standardized feature quantities, , and To adjust the sensitivity constant for dimensional changes; The calculation logic for the script cycle anomaly strength is as follows: ,in, For abnormal strength of the script cycle, The characteristics of the behavioral sequence at time t, The equilibrium value of the behavior over the entire time span, For time period range, To adjust the sensitivity constant for periodic behavioral changes; The calculation logic for the disorder degree of automated behavior is as follows: ,in, For the disorder of automated behavior, For the state sequence of the i-th action, For the entropy value of the behavior sequence, Duration of the behavior Entropy is a sensitivity constant to the randomness of behavior; the entropy value of the behavior sequence. The calculation logic is as follows: ,in, For state probability of occurrence The total number of different states in the behavioral sequence For state The logarithm of the probability of occurrence; The calculation logic for the comprehensive generated data score is as follows: ,in, , , and These are the weighting coefficients.

8. The data behavior prevention and anomaly detection system based on big data according to claim 1, characterized in that, A threshold judgment is made on the comprehensive sentiment score. When the comprehensive sentiment score is greater than the preset comprehensive sentiment score threshold, a first abnormal signal is generated. A threshold judgment is made on the comprehensive spatiotemporal score. When the comprehensive spatiotemporal score is greater than the preset comprehensive spatiotemporal score threshold, a second abnormal signal is generated. A threshold judgment is made on the comprehensive generated data score. When the comprehensive generated data score is greater than the preset comprehensive generated data score threshold, a third abnormal signal is generated.

9. The data behavior prevention and anomaly detection system based on big data according to claim 1, characterized in that, The construction logic of the anomaly detection model includes: Acquire historical user behavior data and corresponding tags, construct sentiment features, spatiotemporal trajectory features, and abnormal data features based on historical user behavior data, set them as a dataset, and include normal and abnormal tags; Frequency correlation analysis was performed on sentiment features, spatiotemporal trajectory features, and abnormal data features, and the feature corresponding to the calculated maximum value was set as the construction feature of the decision tree. Based on the features constructed by the decision tree, an anomaly detection model is built according to the decision tree algorithm. The dataset is divided into a training set and a test set. The anomaly detection model is trained using the training set and validated using the validation set. After validation, user behavior data is input into the anomaly detection model to perform anomaly analysis on user behavior. Once anomaly behavior is detected, a fourth anomaly signal is generated.

10. The data behavior prevention and anomaly detection system based on big data according to claim 9, characterized in that, The calculation logic for frequency correlation analysis is as follows: ,in, For frequency association statistics, For observation frequency, The desired frequency.

Images