A Reliable Data Spatial Intelligent Early Warning Method and System Based on Multi-Source Behavior Analysis

Abstract

This invention discloses an intelligent early warning method and system for trusted data spaces based on multi-source behavioral analysis, belonging to the field of data processing technology. The method includes: acquiring multi-source behavioral data generated by a target account entity within a trusted data space and extracting multi-dimensional behavioral features; configuring a series of stepped analysis windows with stepped time lengths, using the current time node as the analysis starting point, and combining entropy weight analysis to determine the dynamic feature weights under different stepped analysis windows, forming a stepped feature weight matrix; based on the sliding window method and a preset sliding step size, iteratively performing entropy weight analysis on the multi-dimensional behavioral features with time backtracking as the sliding direction, forming a backtracking stepped feature weight matrix series; combining the stepped feature weight matrix and the backtracking stepped feature weight matrix series to verify the behavioral consistency of the target account entity, and issuing an account warning based on the verification results. This invention achieves early and accurate early warning for trusted data spaces.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically to a reliable data space intelligent early warning method and system based on multi-source behavior analysis. Background Technology

[0002] As enterprises deepen their digital transformation, data platforms have become the core asset hubs of enterprises. System administrators, data engineers and other management accounts have high privileges such as access to and operation of sensitive data. As a result, they face increasing risks of internal threats such as privilege abuse and data theft, as well as external attacks such as account hijacking. Existing technologies mainly use fixed rules and threshold alarms, behavioral baseline analysis of single time windows, and machine learning anomaly detection models to carry out security protection and anomaly monitoring for high-privilege management accounts.

[0003] However, fixed rules and threshold-based alerting methods are rigid and cannot adapt to dynamic business scenarios. They are easily circumvented by attackers through slow penetration and have a high false alarm rate. Behavioral baseline analysis with a single time window is difficult to capture both instantaneous anomalies and long-term trend drifts. Fixed or subjectively set feature weights cannot reflect the dynamic changes in feature importance at different time scales. Machine learning anomaly detection models are mostly black-box models with poor interpretability and difficulty in locating the root cause of risks. They have limited effectiveness in detecting gradual, slow, and small-scale attack patterns, cannot take into account both short-term sudden and long-term latent risks, and lack sensitivity to key abnormal behavioral features, making it difficult to achieve early and accurate early warnings. Summary of the Invention

[0004] This invention provides a method and system for intelligent early warning of trusted data space based on multi-source behavior analysis, aiming to solve the technical problem that existing technologies are unable to achieve early and accurate early warning of trusted data space.

[0005] In view of the above problems, the present invention provides a reliable data space intelligent early warning method and system based on multi-source behavior analysis.

[0006] In a first aspect, the present invention provides a reliable data space intelligent early warning method based on multi-source behavior analysis, comprising: Acquire multi-source behavioral data generated by the target account subject within a trusted data space, and extract multi-dimensional behavioral features based on the multi-source behavioral data; Configure a series of step analysis windows with step time lengths, and take the current time node as the starting point of the analysis. Combine the entropy weight method to analyze and determine the dynamic feature weights based on the multidimensional behavioral features under different step analysis windows, and form a step feature weight matrix. Based on the sliding window method and a preset sliding step size, the multidimensional behavioral features are iteratively analyzed using the entropy weight method with time backtracking as the sliding direction to obtain multiple backtracking ladder feature weight matrices, forming a series of backtracking ladder feature weight matrices. By combining the aforementioned ladder feature weight matrix with the backtracking ladder feature weight matrix series, behavioral consistency verification of the target account subject is performed, and account warnings are issued based on the behavioral consistency verification results.

[0007] Secondly, this invention provides a trusted data space intelligent early warning system based on multi-source behavior analysis, comprising: The multi-source feature extraction module is used to acquire multi-source behavioral data generated by the target account subject in the trusted data space, and extract multi-dimensional behavioral features based on the multi-source behavioral data; The ladder weight matrix construction module is used to configure a series of ladder analysis windows with ladder time lengths, and takes the current time node as the analysis starting point. It combines entropy weight method to analyze and determine the dynamic feature weights based on the multidimensional behavioral features under different ladder analysis windows, forming a ladder feature weight matrix. The backtracking weight matrix generation module is used to perform entropy weight analysis on the multidimensional behavioral features iteratively with time backtracking as the sliding direction based on the sliding window method and a preset sliding step size, to obtain multiple backtracking ladder feature weight matrices and form a backtracking ladder feature weight matrix series. The consistency warning module is used to combine the ladder feature weight matrix and the backtracking ladder feature weight matrix series to verify the behavioral consistency of the target account subject, and to issue an account warning based on the behavioral consistency verification result.

[0008] One or more technical solutions provided in this invention have at least the following technical effects or advantages: This invention provides an intelligent early warning method and system for trusted data spaces based on multi-source behavioral analysis. By extracting multi-source behavioral features and dynamically assigning weights, a multi-timescale behavioral analysis framework combining a tiered analysis window and a sliding backtracking mechanism is constructed, realizing adaptive adjustment of feature weights and in-depth mining of historical behavioral trajectories. Furthermore, by comparing the consistency between the tiered weight matrix and the backtracking series matrix, behavioral pattern shifts and abnormal mutations are accurately identified, improving the sensitivity and accuracy of early warnings and effectively solving the problem of early warning lag caused by the dynamic evolution of behavior and the solidification of weights in trusted data spaces. Attached Figure Description

[0009] Figure 1 A flowchart illustrating the intelligent early warning method for trusted data space based on multi-source behavior analysis provided in an embodiment of the present invention; Figure 2 A schematic diagram of the structure of a trusted data space intelligent early warning system based on multi-source behavior analysis provided in an embodiment of the present invention; The components represented by each number in the attached diagram are explained below: Multi-source feature extraction module 11, ladder weight matrix construction module 12, backtracking weight matrix generation module 13, consistency warning module 14. Detailed Implementation

[0010] This invention provides a method and system for intelligent early warning of trusted data space based on multi-source behavior analysis, which is used to address the technical problem that existing technologies are unable to achieve early and accurate early warning of trusted data space.

[0011] Example 1, as Figure 1 As shown, this invention provides a reliable data space intelligent early warning method based on multi-source behavior analysis, including: S100: Obtain multi-source behavioral data generated by the target account subject within the trusted data space, and extract multi-dimensional behavioral features based on the multi-source behavioral data.

[0012] In this embodiment of the invention, multi-source behavioral data generated by the target account entity within a trusted data space is acquired, and multi-dimensional behavioral features are extracted based on the multi-source behavioral data. The behavioral data of the target account entity within the trusted data space is scattered across log systems of different business modules. The multi-source logs have inconsistent formats and high data redundancy; direct analysis would reduce computational efficiency and fail to guarantee accuracy. Furthermore, subsequent multi-scale behavioral analysis of the tiered analysis window requires sufficient historical behavioral data support; unbounded raw logs would cause subsequent window pruning and weight calculation to lose their data benchmark. In addition, without clear feature extraction criteria, the extracted behavioral features may be out of sync with account anomaly detection requirements, and feature data lacking temporal attributes cannot be adapted to subsequent time-based entropy weighting analysis and matrix construction. Therefore, it is necessary to extract multi-source behavioral logs through a unified data source hub, and after time-dimensional pruning and structuring, extract multi-dimensional behavioral features with time-series markers based on prior requirements. This lays a precise, time-series-based, and highly adaptable data source foundation for subsequent tiered analysis, weight calculation, and other steps.

[0013] Step S100 in the method provided in this embodiment of the invention includes: Through the data platform, extract multi-source behavior logs of the target account subject in the trusted data space, including at least: data access logs, API call logs, permission change logs and computing task logs; Combined with a preset behavior tracing window, the multi-source behavior logs are truncated, and the truncated data results are stored in a structured manner. In response to the prior feature list, the data cropping results are traversed to extract features and obtain the multidimensional behavioral features, wherein the multidimensional behavioral features are associated with time-series markers; The window length of the behavior tracing window is N times the longest of the series of ladder analysis windows, and N is greater than 1.

[0014] First, through the data platform, multi-source behavioral logs of the target account entity within the trusted data space are extracted, including at least: data access logs, API call logs, permission change logs, and computation task logs. The data platform serves as the core hub for enterprises to integrate and manage all business data within the trusted data space, possessing unified capabilities for collecting, retrieving, storing, and processing multi-source logs. It is the sole data entry point for obtaining comprehensive account behavioral data. Multi-source behavioral logs refer to structured or semi-structured data sets recording different operational behaviors of the target account entity within the trusted data space; logs from different sources correspond to different dimensions of the account's behavior.

[0015] The data access log records operations performed by an account on data resources within the Trusted Data Space, including querying, downloading, uploading, and browsing. It includes information such as the operation object, operation time, and operation result. The API call log records the number of times an account calls the Trusted Data Space / Data Platform interface, the type of interface called, the call result, and the call time. The permission change log records operations such as adding, modifying, deleting, and revoking permissions for the account itself or the permissions of the objects it operates on. The computation task log records the submission time, execution duration, task result, and data processing volume of data computation tasks submitted, executed, paused, or terminated by the account within the Trusted Data Space.

[0016] Specifically, relying on the log retrieval and filtering capabilities of the enterprise data platform, the unique identifier of the target account subject, such as account ID, employee number, or device number, is input. In the log storage module of the trusted data space, all data access logs, API call logs, permission change logs, and computing task logs generated by the account subject are filtered according to log type, realizing the unified extraction of multi-source behavior logs and forming an initial log dataset.

[0017] For example, taking the administrator account with target account ID admin_001 as an example, the enterprise data platform extracts all multi-source behavior logs generated by the account in the past 3 days from the log storage module of the trusted data space, using account ID admin_001 as the filter condition: Among them, the data access log records a total of 45 queries and 8 download operations of the account on two core datasets, customer information and transaction flow; the API call log records that the account called the data query API 56 times and the data export API 23 times, of which 3 calls failed; the permission change log records that the account has no permission-related operations in the past 3 days; the calculation task log records that the account submitted 2 big data statistical calculation tasks, 1 of which was completed and 1 was terminated midway.

[0018] Secondly, the multi-source behavior logs are truncated using a preset behavior tracing window, and the truncated data results are stored in a structured manner. The behavior tracing window has a length that is N times the longest window in the tiered analysis window series, where N is greater than 1. The behavior tracing window is a pre-defined log data truncating time range to support multi-scale analysis in subsequent tiered analysis windows. Its length is N times the longest window in the tiered analysis window series, and N>1, ensuring that the truncated log data fully covers the analysis needs of all subsequent time scales and eliminates redundant historical data. Data truncating refers to the operation of filtering the extracted multi-source behavior logs according to the preset behavior tracing window time range, removing log data exceeding the time range, and retaining valid data. Structured storage refers to the process of converting unstructured / semi-structured raw behavior logs into standardized structured data containing unified fields, such as two-dimensional data tables or JSON format, and saving it to a dedicated data storage medium according to time-series storage rules.

[0019] Specifically, first, determine the longest window length in the tiered analysis window series, and set the time range and time boundary of the behavior tracing window by N times (N>1); then, use the time boundary of the behavior tracing window as the filtering condition to prune the initial log dataset in the time dimension and remove redundant log data outside the window; finally, formulate a unified log structured field template, which should at least include account ID, behavior type, operation time, operation content, and operation result, convert the pruned multi-source behavior logs according to this template, and then store the converted structured log data in the time series database to ensure the time series correlation of the data.

[0020] For example, assuming the longest window in the tiered analysis window series configured for the admin_001 account is 8 hours, and N=3, then the behavior tracing window length is 24 hours, with a time boundary from 00:00 on 2026-01-20 to 24:00 on 2026-01-20. Using this time boundary as the filtering condition, the extracted multi-source behavior logs of the admin_001 account for the past 3 days are truncated, removing all log data before 00:00 on 2026-01-20, and only retaining the behavior logs within this 24-hour period. Subsequently, the truncated logs are converted to include account ID: admin_001, behavior type: data access, operation time: 09:05 on 2026-01-20, operation content: query customer information dataset, and operation result: JSON format structured data, and stored in the InfluxDB time-series database in chronological order of operation time.

[0021] Secondly, in response to the prior feature list, the data pruning results are traversed to extract features and obtain the multi-dimensional behavioral features, wherein the multi-dimensional behavioral features are associated with time-series markers. The prior feature list refers to a pre-defined list of behavioral features for extraction based on the account security anomaly detection requirements of the trusted data space, business scenario characteristics, and historical anomaly behavior analysis experience. The list contains multi-dimensional feature indicators highly correlated with abnormal account behavior, serving as a clear basis for feature extraction. Multi-dimensional behavioral features refer to feature indicators extracted from multi-source behavioral logs that can characterize account behavior patterns from different dimensions, covering four major behavioral dimensions: data access, API calls, permission changes, and computational tasks. These are the core data carriers for subsequent analysis of account behavior patterns. Time-series markers assign a corresponding operation timestamp to each extracted behavioral feature value, giving the feature data a time attribute and supporting subsequent multi-scale analysis based on time windows.

[0022] Specifically, firstly, a pre-defined list of prior features is retrieved to clarify the specific feature indicators and statistical granularity to be extracted for each behavioral dimension; then, using the structured and cropped logs stored in the time-series database as the data source, the log data is traversed, statistically analyzed, calculated, and extracted one by one according to the feature indicators in the prior feature list to obtain the specific values ​​of each feature indicator; finally, each extracted feature value is bound to a corresponding operation timestamp to form a multi-dimensional behavioral feature dataset with time-series labels, and the dataset is arranged in the order of timestamps.

[0023] For example, the prior feature list configured for the admin_001 account includes: data access dimension: number of data queries per minute, amount of data downloaded in a single transaction; API call dimension: number of API calls per minute, API call failure rate; permission change dimension: number of permission changes per hour; computation task dimension: number of computation tasks submitted per minute, execution time of computation tasks, with feature statistics granularity at the minute level. Using the 24-hour structured logs of the admin_001 account stored in InfluxDB as the data source, for example, by iterating through all logs for the account within one minute from 09:00 to 09:01 on January 20, 2026, the following statistics were extracted: number of data queries per minute = 5, single data download amount = 0MB, number of API calls per minute = 3, API call failure rate = 0%, number of permission changes per hour = 0, number of computation tasks submitted per minute = 0, and computation task execution time = 0min. All the above feature values ​​were uniformly assigned the time-series label 2026-01-20 09:00. The 24-hour structured logs of the account were iterated through minute by minute in chronological order, and the feature values ​​of each minute were extracted and bound to the corresponding time-series label, finally forming a multidimensional behavioral feature dataset of the admin_001 account with time-series labels.

[0024] In this embodiment of the invention, the problems of scattered, inconsistent, and redundant account behavior logs in the trusted data space are solved by unified extraction of multi-source behavior logs, time-based pruning of behavior tracing windows, and structured storage of logs. This improves the computational efficiency of subsequent data analysis. Furthermore, by setting a behavior tracing window N times larger than the longest step analysis window, it ensures that the pruned log data can fully support subsequent multi-scale window analysis and weight calculation. The multi-dimensional behavior features extracted based on the prior feature list are highly compatible with the requirements of account security anomaly detection, avoiding redundant extraction of invalid features. The assignment of time-series markers provides a crucial time-series attribute foundation for subsequent feature pruning of step analysis windows and dynamic weight calculation using the entropy weight method. The resulting multi-dimensional behavior feature dataset with time-series markers is structured and stored in chronological order, possessing the characteristics of being searchable, analyzable, and iterable, ensuring the accuracy and effectiveness of subsequent account behavior consistency verification and intelligent early warning from the source.

[0025] S200: Configure a series of step analysis windows with step time lengths, and take the current time node as the starting point of the analysis. Combine the entropy weight method to analyze and determine the dynamic feature weights based on the multidimensional behavioral features under different step analysis windows, and form a step feature weight matrix.

[0026] In this embodiment of the invention, a series of tiered analysis windows with tiered time lengths are configured, and the current time node is used as the starting point for analysis. The dynamic feature weights based on the multidimensional behavioral characteristics under different tiered analysis windows are determined using the entropy weight method, forming a tiered feature weight matrix. The business operations of different categories of target account subjects within the trusted data space exhibit periodic differences. If a unified and fixed analysis window is used, it cannot adapt to the actual business scenarios of the accounts, nor can it simultaneously capture both instantaneous and long-term latent behavioral anomalies. Furthermore, the value of multidimensional behavioral characteristics in characterizing account behavior patterns varies at different time scales, and fixed feature weights cannot objectively reflect the actual importance of features under different tiered windows. In addition, subsequent backtracking of the tiered feature weight matrix generation and behavioral consistency verification both require a multi-scale dynamic weight matrix as a reference. Therefore, a series of tiered analysis windows needs to be customized based on the account subject category and business periodicity. Then, feature data for the corresponding window is extracted starting from the current time, and the dynamic feature weights under each window are calculated using the entropy weight method, ultimately forming a structured tiered feature weight matrix. This provides a multi-scale, objective basis for behavioral pattern analysis in subsequent steps.

[0027] Step S200 in the method provided in this embodiment of the invention includes: The series of step analysis windows that configure the step time length includes: Based on the subject category of the target account, the corresponding account business characteristics are extracted, and business cycle analysis is performed based on the account business characteristics to obtain multiple typical business cycles; Based on multiple typical business cycles, define the serialized tiered time length and configure the corresponding tiered analysis window series.

[0028] First, based on the target account's subject category, corresponding account business characteristics are extracted. Then, a business cycle analysis is performed based on these characteristics to obtain multiple typical business cycles. Subject category refers to the account type categorized according to the target account's job function, operating permissions, and business scope within the trusted data space, such as system administrator, data engineer, and data analyst. Different account categories exhibit significant differences in their business operation characteristics. Account business characteristics refer to the regular operational behaviors of the target account subject based on its own category, encompassing dimensions such as operation frequency, operation type, and operation timescale. Typical business cycles are timescales that reflect the regularity of account business operations, extracted through statistical analysis of account business characteristics. They represent the account's operational cycles across different behavioral dimensions and serve as the basis for configuring tiered analysis windows.

[0029] Specifically, firstly, the target account's subject category is determined based on its job functions and operational permissions. Then, from the multidimensional behavioral feature data generated by S100, the account's business characteristics, such as operation frequency, operation type, and operation time distribution, are extracted. Subsequently, time series analysis is used to periodically mine the account's business characteristics, eliminate irregular operation noise, and extract multiple time scales that can reflect the core business operation patterns of the account, which serve as the account's typical business cycle.

[0030] For example, the target account admin_001 has the subject category of system administrator, and its functions are daily operation and maintenance of the data platform, data resource permission management, and computing task monitoring. From the multi-dimensional behavioral feature data of this account from 00:00 to 24:00 on January 20, 2026, the account business features extracted are: minute-level high-frequency data access and API calls, hour-level periodic permission inspection, and 8-hour-level all-day system operation and maintenance and computing task management. After periodically analyzing the above business features and removing irregular temporary operation noise, the typical business cycles of this account are obtained as 10 minutes, 1 hour, and 8 hours, which correspond to the time patterns of its instantaneous high-frequency operations, periodic inspection operations, and all-day operation and maintenance operations, respectively.

[0031] Secondly, based on multiple typical business cycles, a serialized tiered time length is defined, and the corresponding tiered analysis window series is configured. The tiered time length refers to an analysis time scale defined based on typical business cycles, exhibiting an increasing sequence, with each length corresponding one-to-one with a typical business cycle. The tiered analysis window series refers to a serialized set of time windows composed of multiple tiered time lengths. The window length increases with the sequence, enabling multi-scale coverage of account behavior. The window set is denoted as L={l1,l2,...,l...}k}(l1 <l2<...<l k ).

[0032] Specifically, typical business cycles are serialized and sorted in ascending order of time length, and the sorted typical business cycles are directly defined as tiered time lengths. Then, based on these tiered time lengths, corresponding time windows are configured, and all windows constitute a serialized tiered analysis window series. The number of window series is consistent with the number of typical business cycles.

[0033] For example, the typical business cycle of admin_001 is sorted by time length from shortest to longest as 10 minutes, 1 hour, and 8 hours, and this sequence is directly defined as the stepped time length. Based on this stepped time length, the corresponding stepped analysis window series L={l1=10min, l2=1h, l3=8h} is configured, which correspond to short time scale, medium time scale, and long time scale analysis windows, respectively, to achieve full-scale coverage of the transient, phased, and long-term behavior of this account.

[0034] Specifically, taking the current time point as the starting point of the analysis, and combining entropy weight method analysis, the dynamic feature weights based on the multidimensional behavioral features under different step analysis windows are determined, forming a step feature weight matrix, including: Taking the current time node as the starting point of analysis, based on each step time window in the step analysis window series, the behavioral feature data within the corresponding time window is extracted from the multidimensional behavioral features to obtain the step behavioral feature sequence. Traverse the ladder behavior features in the ladder behavior feature sequence and use the information entropy evaluation method to calculate the dynamic weight of multiple behavior feature items in each ladder time window. The dynamic weights under multiple tiered time windows are structured and stored to form the tiered feature weight matrix of the target account entity at the current time node; The first dimension of the stepped feature weight matrix corresponds to multiple stepped time windows, and the second dimension corresponds to multiple behavioral feature items.

[0035] First, taking the current time point as the starting point of the analysis, behavioral feature data within the corresponding time window is extracted from the multidimensional behavioral features based on each step of the stepped analysis window series, thus obtaining the stepped behavioral feature sequence. The current time point refers to the real-time point at which account behavior analysis is conducted, and is the time endpoint for extracting feature data from the stepped analysis window, denoted as t. c A laddered behavioral feature sequence refers to a set of serialized feature data formed by backtracking and extracting feature data for the corresponding time interval from multidimensional behavioral feature data, with the current time node as the endpoint and each window in the laddered analysis window series having a length corresponding to a subset of feature data.

[0036] Specifically, first, we set the current time point t for this behavior analysis. c Using this time point as the end point of the window, for each window in the ladder analysis window series... i The time interval is determined to be [t] c -l i ,t c Then, from the multidimensional behavioral feature data with time-series labels generated by S100, all feature data within each time interval are extracted and serialized in ascending order of window length to form a ladder behavioral feature sequence.

[0037] For example, set admin_001 to the current time node t for this analysis. c =2026-01-20 18:00:00. Taking this time as the endpoint, three time intervals for step analysis windows are determined: l1=10min window [2026-01-20 17:50:00, 2026-01-20 18:00:00], l2=1h window [2026-01-20 17:00:00, 2026-01-20 18:00:00], l3=8h window [2026-01-20 10:00:00, 2026-01-20 18:00:00]. From the 24-hour multidimensional behavioral feature data of this account, feature data within the above three time intervals are extracted and arranged into a step behavioral feature sequence according to the window order. The sequence contains feature data subsets corresponding to the 10-minute, 1-hour, and 8-hour windows, respectively.

[0038] Secondly, the tiered behavioral features in the tiered behavioral feature sequence are traversed, and the dynamic weights of multiple behavioral feature items under each tiered time window are calculated using the information entropy evaluation method. The information entropy evaluation method, also known as the entropy weight method, is an objective weighting method based on the degree of indicator variation. It determines the amount of information carried by calculating the information entropy value of a feature indicator; the smaller the entropy value, the greater the degree of feature variation and the more information, and the higher the corresponding weight. Dynamic weight refers to the behavioral feature weights calculated separately for different tiered analysis windows. The weight of the same feature under different windows changes dynamically with the degree of feature variation, objectively reflecting the actual importance of the feature at different time scales. Behavioral feature items are the specific indicators of the multi-dimensional behavioral features extracted in S100. In this embodiment, there are 7 items, including the number of data queries per minute, the amount of data downloaded in a single transaction, the number of API calls per minute, the API call failure rate, the number of permission changes per hour, the number of computation tasks submitted per minute, and the execution time of computation tasks.

[0039] Specifically, the process iterates through each window feature data subset in the ladder behavioral feature sequence and performs the entropy weight method calculation process for each subset in sequence: First, the feature data is standardized to eliminate dimensional differences; then, the probability value and information entropy value of each behavioral feature item are calculated; subsequently, the difference coefficient of the feature is calculated through the information entropy value; finally, the difference coefficient is normalized to obtain the dynamic weight of each behavioral feature item under that window; after completing the weight calculation of all windows, the feature weight vector corresponding to each ladder window is obtained.

[0040] For example, traversing the tiered behavioral feature sequence of admin_001, dynamic weights are calculated for the feature data of the three windows: 10-minute short window: During this interval, the account frequently performs data queries and API calls, with high variation and low information entropy values ​​for these two features. The weights for data query frequency per minute are calculated to be 0.28 and API call frequency per minute to be 0.25. Other features show no significant fluctuations, and their weights are all below 0.1, forming a 7-dimensional feature weight vector W1=[0.28,0.05,0.25,0.07,0.09,0.12,0.14] for the 10-minute window; 1-hour medium window: During this interval, the account submits periodic computational tasks, and the variation of task-related features is calculated. The weighting is increased, with a weight of 0.22 for the number of computation tasks submitted per minute and a weight of 0.20 for the execution time of computation tasks. The weighting of data query and API call is slightly reduced, forming a 7-dimensional feature weight vector W2=[0.22,0.06,0.20,0.08,0.10,0.22,0.20] for the 1-hour window. For the 8-hour long window: during this period, the account completes the system operation and maintenance throughout the day. The core operations are permission inspection and computation task operation and maintenance. The weighting is increased, with a weight of 0.21 for the number of permission changes per hour and a weighting of 0.26 for the execution time of computation tasks, forming a 7-dimensional feature weight vector W3=[0.15,0.07,0.13,0.09,0.21,0.19,0.26] for the 8-hour window.

[0041] Furthermore, the dynamic weights under multiple tiered time windows are structured and stored to form the tiered feature weight matrix of the target account entity at the current time node. The first dimension of the tiered feature weight matrix corresponds to multiple tiered time windows, and the second dimension corresponds to multiple behavioral feature items. The tiered feature weight matrix is ​​a two-dimensional matrix formed by stacking the feature weight vectors of each tiered analysis window row by row. It has a dimension of k×m, where k is the number of tiered windows and m is the number of behavioral feature items. The first dimension (rows) corresponds to different tiered time windows, and the second dimension (columns) corresponds to different behavioral feature items.

[0042] Specifically, the feature weight vectors of each step window are arranged in the serialized order of the step analysis window series as the rows of the matrix, and the behavioral feature items are arranged as the columns of the matrix. All dynamic weights are structured and stored. Finally, a step feature weight matrix with the dimension of number of windows × number of feature items is formed. Each element in the matrix represents the weight value of a certain behavioral feature item at the corresponding time scale.

[0043] For example, the three step window weight vectors W1, W2, and W3 of admin_001 are stacked row by row, with the seven behavioral feature items as columns, and after being structured and stored, a 3×7 step feature weight matrix W is formed. current The first row of the matrix represents the weights for a 10-minute window, the second row represents the weights for a 1-hour window, and the third row represents the weights for an 8-hour window. The columns represent the weights of the seven features.

[0044] In this embodiment of the invention, by combining account subject category and business characteristics to analyze typical business cycles, the configuration of the tiered analysis window is highly adapted to the actual business operation rules of the account, avoiding the subjective and universal defects of window settings, and achieving multi-scale accurate coverage of transient, phased, and long-term account behavior. Based on the information entropy evaluation method of entropy weight, the dynamic weight of behavioral features is calculated independently for each tiered window, objectively reflecting the actual importance of each feature at different time scales, solving the problem that traditional fixed weights cannot adapt to multi-scale analysis, and effectively improving the objectivity and accuracy of behavioral feature analysis. The resulting tiered feature weight matrix condenses and characterizes the multi-scale behavioral pattern of the target account at the current time node from the two-dimensional dimensions of time scale and feature importance. The matrix structure is standardized and the data is traceable, providing a unified calculation template for the subsequent generation of the backtracking tiered feature weight matrix series, and also establishing a multi-scale weight benchmark for behavioral consistency verification.

[0045] S300: Based on the sliding window method and a preset sliding step size, the multidimensional behavioral features are iteratively analyzed using the entropy weight method with time backtracking as the sliding direction to obtain multiple backtracking ladder feature weight matrices, forming a series of backtracking ladder feature weight matrices.

[0046] In this embodiment of the invention, based on the sliding window method and a preset sliding step size, the multidimensional behavioral features are iteratively analyzed using entropy weighting with time backtracking as the sliding direction. This yields multiple backtracking ladder feature weight matrices, forming a series of backtracking ladder feature weight matrices. Subsequent behavioral consistency verification of the target account entity requires historical behavioral patterns as a reference benchmark. A single historical time node's behavioral weight matrix cannot reflect the temporal patterns and overall characteristics of the account's historical behavior, thus having limited reference value. Furthermore, to ensure the effectiveness of comparing the historical matrix with the current ladder feature weight matrix, a unified entropy weighting calculation logic and ladder analysis window system are required. In addition, irregular historical data extraction leads to a lack of continuity in the reference system, making it difficult to accurately identify gradual anomalies in behavioral patterns. Therefore, based on the sliding window method, the analysis starting point is iteratively updated with a fixed sliding step size using time backtracking. A unified entropy weighting method and ladder window system are used to calculate the backtracking ladder feature weight matrix for each historical starting point, ultimately serializing it to form a series of backtracking ladder feature weight matrices with a temporal index. This constructs a continuous, standardized, and highly referential historical behavioral pattern library for behavioral consistency verification.

[0047] Step S300 in the method provided in this embodiment of the invention includes: Starting from the current time point, update the analysis starting point based on the sliding direction and the sliding step size; Based on the updated analysis starting point, multi-window feature extraction is performed on the multi-dimensional behavioral features in combination with the ladder analysis window series to obtain the backtracking ladder behavioral feature sequence. The backtracking ladder behavior feature sequence is analyzed by entropy weight method, and the backtracking ladder feature weight matrix is ​​determined based on the analysis results of entropy weight method. Based on the sliding direction and the sliding step size, the starting point of the analysis is iteratively updated and entropy weight method analysis is performed to obtain multiple backtracking ladder feature weight matrices. Using the timestamp of the associated analysis starting point as an index, multiple backtracking ladder feature weight matrices are serialized to obtain the backtracking ladder feature weight matrix series.

[0048] First, starting from the current time point, the analysis starting point is updated based on the sliding direction and the sliding step size. The sliding step size refers to a pre-set time offset when updating the analysis starting point in each iteration. It is a fixed time length and determines the time density of historical analysis starting points and the number of samples in the matrix series. First, the preset sliding step size and the sliding direction of time backtracking are determined, using the current time point t set in S200. cStarting from the initial point, following the time backtracking direction, subtract a sliding step from the current time node to obtain the first updated historical analysis starting point. This starting point serves as the time benchmark for subsequent historical stage step behavior feature extraction and weight calculation, consistent with the role of the current time node in S200. The updated analysis starting point is denoted as t. q .

[0049] For example, the current time point t of the target account admin_001 c =2026−01−20 18:00:00, preset sliding step size is 30 minutes, sliding direction is time backtracking; from t c The first historical analysis starting point t1 is obtained by updating according to the rules, which is 2026-01-20 17:30. This time point is the end point of the calculation of the ladder feature weight of the first historical stage.

[0050] Secondly, based on the updated analysis starting point, multi-window feature extraction is performed on the multi-dimensional behavioral features using the aforementioned ladder analysis window series to obtain a retrospective ladder behavioral feature sequence. The retrospective ladder behavioral feature sequence refers to a set of feature data formed by extracting feature data from the multi-dimensional behavioral feature data within the corresponding window, using the updated historical analysis starting point as the time endpoint and adhering to the ladder analysis window series configured in S200. This set is serialized according to the window length and is completely consistent with the structure and dimensions of the ladder behavioral feature sequence in S200. Multi-window feature extraction refers to the operation of sequentially extracting feature data from each window in the ladder analysis window series based on the same analysis starting point, ensuring a unified time reference for the feature data in each window.

[0051] Specifically, the updated historical analysis starting point is used as the time end point, and the stepped analysis window series configured in S200 is used entirely to determine the corresponding time interval for each stepped window [t]. q -l i ,t q Then, from the multidimensional behavioral feature data with time-series markers generated in S100, feature data within each time interval are extracted and serialized in ascending order of window length to form a backtracking ladder behavioral feature sequence, ensuring that the extraction logic and data structure are completely consistent with the ladder behavioral feature sequence in S203.

[0052] For example, taking the first historical analysis starting point t1=2026−01−20 17:30:00 as the time endpoint, and using the ladder analysis window series, the time intervals of each window are determined as follows: l1 is [2026−01−20 17:20:00, 2026−01−20 17:30:00], l2 is [2026−01−20 16:30:00, 2026−01−20 17:30:00], and l3 is [2026−01−20 09:30:00, 2026−01−20 17:30:00]. From the 24-hour multidimensional behavioral characteristic data of this account, seven minute-level characteristic data items are extracted from the above three intervals and arranged in window order to form the first retrospective ladder behavioral characteristic sequence. The data structure is the same as t in S200. c The corresponding sequences are completely identical.

[0053] Next, the backtracking ladder behavioral feature sequence is analyzed using the entropy weight method, and the backtracking ladder feature weight matrix is ​​determined based on the analysis results. The backtracking ladder feature weight matrix refers to the ladder feature weight matrix calculated using the entropy weight method on the backtracking ladder behavioral feature sequence, with the historical analysis starting point as the benchmark. It is completely consistent with the ladder feature weight matrix in S200 in terms of dimension, structure, and calculation logic, reflecting the multi-scale behavioral patterns of the account at the corresponding historical time point. The calculation process of the entropy weight method in S200 is completely followed, and the backtracking ladder behavioral feature sequence is analyzed traversally: first, the feature data of each window is standardized to eliminate dimensional differences; then, the probability value, information entropy value, and difference coefficient of each behavioral feature item are calculated sequentially; finally, the difference coefficient is normalized to obtain the dynamic feature weight vector of each window, and the weight vectors are stacked row-wise to form the backtracking ladder feature weight matrix corresponding to the historical analysis starting point.

[0054] For example, the entropy weight method is used to calculate the backtracking ladder behavior feature sequence corresponding to the first historical analysis starting point t1 of admin_001. Using the setting of 7 behavior feature items, the weight vector of each window is obtained: 10-minute window weight vector W 1−1 =[0.27,0.06,0.26,0.08,0.08,0.13,0.12], 1-hour window weight vector W 1−2 =[0.23,0.05,0.21,0.07,0.09,0.21,0.14], 8-hour window weight vector W 1−3 =[0.16,0.06,0.14,0.08,0.22,0.18,0.26]; Stack the three weight vectors row-wise to form a 3×7 backtracking ladder feature weight matrix W. hist(1) This is the historical behavior pattern matrix of the account at 17:30, with dimensions W corresponding to the current time point. currentTotally consistent.

[0055] Then, based on the sliding direction and the sliding step size, the analysis starting point is iteratively updated and entropy weight analysis is performed to obtain multiple backtracking ladder feature weight matrices. Using the calculated historical analysis starting point as a benchmark, new historical analysis starting points are iteratively generated according to the time backtracking direction and the preset sliding step size. For each newly generated analysis starting point, the above operation is repeated sequentially to complete the extraction of backtracking ladder behavioral feature sequences and the calculation of entropy weights, obtaining the corresponding backtracking ladder feature weight matrix. This iteration continues until Q backtracking ladder feature weight matrices are generated, at which point the iteration stops.

[0056] For example, the preset historical review quantity Q=6 for admin_001, with a sliding step size of 30 minutes, continues iteratively updating the analysis starting point based on t1, successively obtaining t2=2026−01−20 17:00:00, t3=2026−01−20 16:30:00, t4=2026−01−20 16:00:00, t5=2026−01−20 15:30:00, t6=2026−01−20 15:00:00; for each time point, feature sequence extraction and entropy weight method calculation are repeated sequentially to obtain the backtracking ladder feature weight matrix W. hist(2) W hist(3) W hist(4) W hist(5) W hist(6) All of them are 3×7 matrix structures, resulting in 6 historical backtracking matrices.

[0057] Finally, using the timestamp of the associated analysis starting point as an index, multiple backtracking ladder feature weight matrices are serialized to obtain the backtracking ladder feature weight matrix series. The backtracking ladder feature weight matrix series refers to a set of matrices formed by serializing multiple backtracking ladder feature weight matrices in chronological order from newest to oldest, using the timestamp of the corresponding historical analysis starting point as an index. This set is denoted as {W}. hist(1) W hist(2) ,...,W hist(Q) This is a complete set of recent historical multi-scale behavioral patterns of an account. All backtracking ladder feature weight matrices are bound one-to-one with their corresponding historical analysis starting timestamps, and all matrices are serialized and arranged in ascending order of time. The resulting set of matrices is defined as a backtracking ladder feature weight matrix series, where each element contains a unique timestamp index, enabling rapid retrieval and retrieval by time dimension.

[0058] For example, the weight matrices of the six backtracking ladder features of admin_001 are bound to the corresponding timestamps: W hist(1) -17:30, W hist(2)-17:00, W hist(3) -16:30, W hist(4) -16:00, W hist(5) -15:30, W hist(6) -15:00; Serialized and arranged in chronological order from newest to oldest, forming a backtracking ladder feature weight matrix series {W} hist(1) W hist(2) W hist(3) W hist(4) W hist(5) W hist(6) The retrospective ladder feature weight matrix series is a multi-scale behavior pattern library for this account from 15:00 to 17:30 on January 20, 2026, and each matrix is ​​indexed with a timestamp.

[0059] In this embodiment of the invention, a continuous and uniform historical analysis starting point is generated through a fixed sliding step size and an iterative update method of time backtracking. This avoids the randomness of historical data truncation and ensures the temporal continuity and sample representativeness of the backtracking matrix series. The entire process uses the same ladder analysis window system and entropy weight method calculation logic as the current ladder feature weight matrix, ensuring the uniformity of the historical matrix and the current matrix in terms of structure, dimension, and calculation standards. This fundamentally guarantees the fairness and accuracy of subsequent behavior consistency verification. Multiple backtracking ladder feature weight matrices generated through iterative calculation construct a multi-scale behavior pattern library for the recent history of accounts, solving the problem of single historical benchmarks and limited reference value in traditional methods. Finally, the serialized matrix series indexed by timestamps has clear temporal attributes and searchability, adapting to the temporal analysis needs of subsequent weighted information entropy. This provides a standardized, highly referential, and continuous historical benchmark for behavior consistency verification, effectively improving the ability of subsequent anomaly detection to identify gradual, slow, and small behavioral anomalies.

[0060] S400: Combine the ladder feature weight matrix with the backtracking ladder feature weight matrix series to perform behavioral consistency verification of the target account subject, and issue an account warning based on the behavioral consistency verification result.

[0061] In this embodiment of the invention, the behavioral consistency verification of the target account subject is performed by combining the stepped feature weight matrix and the backtracked stepped feature weight matrix series, and an account warning is issued based on the behavioral consistency verification results. Simply comparing the current stepped feature weight matrix with the historical backtracked matrix cannot eliminate the interference of normal fluctuations in historical behavior, easily mistaking deviations from normal business practices as anomalies. Furthermore, different time scales and behavioral features have varying importance for anomaly detection; unweighted matrix difference analysis weakens deviation signals in key dimensions, resulting in insufficient sensitivity to complex abnormal behaviors. In addition, the lack of standardized statistics and confidence thresholds makes the behavioral consistency verification results subjective, failing to provide a quantitative and scientific basis for account warnings. Therefore, it is necessary to first construct a unified benchmark for historical behavior by fusing weight matrices, then construct a difference analysis system with reference and comparison paths, obtain standardized statistics through weighting and information entropy transformation, and finally achieve objective and quantitative behavioral consistency verification based on pre-set confidence thresholds and residual analysis, providing an accurate basis for account warnings.

[0062] Step S400 in the method provided in this embodiment of the invention includes: Based on the aforementioned backtracking ladder feature weight matrix series, calculate the fusion weight matrix based on the arithmetic mean; By combining the backtracking ladder feature weight matrix series with the fusion weight matrix, the reference information entropy sequence is calculated and obtained, and the corresponding reference statistics are analyzed and obtained. By combining the backtracking ladder feature weight matrix series, the ladder feature weight matrix and the fusion weight matrix, the comparative information entropy sequence is calculated and the corresponding comparative statistics are obtained through analysis. The behavioral consistency verification is performed by comparing the reference statistic with the comparison statistic, and the behavioral consistency verification result is obtained.

[0063] First, based on the aforementioned backtracking ladder feature weight matrix series, a fusion weight matrix based on the arithmetic mean is calculated. The fusion weight matrix is ​​the weight matrix obtained by arithmetically averaging the elements at corresponding positions in all matrices within the backtracking ladder feature weight matrix series. It serves as a comprehensive quantitative benchmark for historical behavior patterns, reflecting the normal feature weight distribution of the target account's historical behavior. Its dimensions are completely consistent with the backtracking matrix and the current ladder matrix. The arithmetic mean is calculated by summing all elements in the same row and column of the backtracking matrix series and then dividing by the number of backtracking matrices.

[0064] Specifically, determine the number Q and dimension k×m of the matrices in the backtracking ladder feature weight matrix series; traverse every position [r, c] of all matrices in the matrix series, where: r is the row index, corresponding to the ladder window; c is the column index, corresponding to the row feature. Summate the elements of all matrices in [r, c]; divide the sum by the number of matrices Q to obtain the element value of the fused weight matrix at that position; after completing the calculation for all positions, form the fused weight matrix W. fused .

[0065] For example, the backtracking ladder feature weight matrix series for the target account admin_001 contains Q = 6 3×7 matrices, k = 3 ladder windows, and m = 7 behavioral features. Traversing all matrix positions [1,1] yields 6 matrix elements with values ​​of 0.27, 0.26, 0.28, 0.27, 0.26, and 0.27. Their arithmetic average is calculated as Wfused[1,1] = (0.27 + 0.26 + 0.28 + 0.27 + 0.26 + 0.27) / 6 ≈ 0.27. This method is used to complete the calculation for all 3×7 positions, ultimately forming the fused weight matrix W for admin_001. fused It has a dimension of 3×7 and is completely consistent with the historical backtracking matrix and the current ladder matrix.

[0066] Secondly, by combining the backtracking ladder feature weight matrix series with the fusion weight matrix, the reference information entropy sequence is calculated and obtained, and the corresponding reference statistics are analyzed and obtained.

[0067] Specifically, by combining the backtracking ladder feature weight matrix series with the fusion weight matrix, a reference information entropy sequence is calculated and obtained, and corresponding reference statistics are analyzed and obtained, including: The difference matrix between the fused weight matrix and each backtracking step feature weight matrix in the backtracking step feature weight matrix series is calculated to obtain the reference difference matrix series. Using the fusion weight matrix, the reference difference matrix series is iterated and weighted to obtain the first weighted difference matrix series; Calculate the matrix information entropy corresponding to each weighted difference matrix to obtain the reference information entropy sequence, and calculate the mean and standard deviation of the reference information entropy sequence as the reference statistic.

[0068] First, the difference matrix between the fused weight matrix and each retrospective step feature weight matrix in the series of retrospective step feature weight matrices is calculated to obtain a series of reference difference matrices. The reference difference matrix is ​​the matrix obtained by performing an absolute value difference operation between the corresponding elements of the fused weight matrix and a single retrospective step feature weight matrix, reflecting the degree of deviation of a single historical behavior pattern from the historical norm benchmark. The series of reference difference matrices is a set of serialized matrices formed by calculating the reference difference matrix for each matrix in the series of retrospective step feature weight matrices, with the same number as the retrospective matrix series.

[0069] Specifically, iterate through each backtracking matrix W in the backtracking ladder feature weight matrix series. hist(q) The fusion weight matrix W fused Perform the absolute difference operation at the corresponding positions with the backtracking matrix, i.e., D ref(q) =∣W hist(q) -W fused |, to obtain a single reference difference matrix; according to the order of the backtracking matrix series, serialize and arrange all the single reference difference matrices to form a reference difference matrix series.

[0070] For example, take W from the admin_001 backtracking matrix series. hist(1) With the fusion weight matrix W fused Perform absolute difference calculations, such as for position [1,1]: |0.27−0.27|=0, and for position [1,3]: |0.26−0.25|=0.01; after completing the calculations for all 3×7 positions, the reference difference matrix D is obtained. ref(1) ; calculate W sequentially using this method. hist(2) To W hist(6) The corresponding reference difference matrix ultimately forms a series of reference difference matrices {D} containing six 3×7 matrices. ref(1) D ref(2) ,...,D ref(6)}

[0071] Secondly, using the fusion weight matrix, the reference difference matrix series is iterated and weighted to obtain the first weighted difference matrix series. The first weighted difference matrix is ​​the matrix obtained by performing a Hadamard product operation between the reference difference matrix and the fusion weight matrix. Historical normal weights are used to weight the difference values, strengthening the deviation signals of key features and time scales while weakening irrelevant fluctuations in secondary dimensions. The first weighted difference matrix series refers to the set of sequential matrices formed by weighting all matrices in the reference difference matrix series, corresponding one-to-one with the reference difference matrix series. The Hadamard product is the direct element-wise multiplication of two matrices of the same dimension; it is an element-wise weighted operation, not matrix multiplication.

[0072] Specifically, iterate through each reference difference matrix D in the series of reference difference matrices. ref(q) The reference difference matrix and the fusion weight matrix W fused Perform the Hadamard product operation, i.e., D w−ref(q) =D ref(q) ⊙W fused , where ⊙ represents the Hadamard product operation, resulting in a single first weighted difference matrix; according to the order of the reference difference matrix series, all the single weighted matrices are serialized and arranged to form the first weighted difference matrix series.

[0073] For example, take the reference difference matrix D of admin_001. ref(1) With the fusion weight matrix W fused Perform the Hadamard product operation. For example, at position [1,1]: 0 × 0.27 = 0, at position [1,3]: 0.01 × 0.25 = 0.0025. After completing the calculation for all positions, the first weighted difference matrix D is obtained. w−ref(1) ; Process all reference difference matrices sequentially to form the first weighted difference matrix series {D}, which contains six 3×7 matrices. w−ref(1) D w−ref(2) ,...,D w−ref(6)}

[0074] Next, the matrix information entropy corresponding to each weighted difference matrix is ​​calculated to obtain the reference information entropy sequence. The mean and standard deviation of this reference information entropy sequence are then calculated as the reference statistics. Matrix information entropy refers to the entropy value calculated using the information entropy formula after flattening the matrix into a one-dimensional vector, normalizing it to obtain a probability distribution, and then applying it to the matrix. It quantifies the disorder of the matrix element distribution; a higher entropy value indicates a more irregular deviation and more significant fluctuation. The reference information entropy sequence is a one-dimensional numerical sequence formed by sequentially representing the information entropy values ​​corresponding to all matrices in the first weighted difference matrix series. It reflects the change in disorder of historical behavior patterns relative to the normal baseline. The reference statistics are the mean and standard deviation calculated from the reference information entropy sequence. They serve as a quantitative benchmark for determining the historical normal fluctuation range. The mean reflects the average level of historical disorder, and the standard deviation reflects the historical fluctuation amplitude.

[0075] Specifically, iterate through each matrix in the first weighted difference matrix series, performing the following steps in sequence: flatten the matrix into a one-dimensional vector; sum all elements of the vector and then normalize the result to obtain a probability distribution; calculate the matrix information entropy value using the information entropy formula; arrange all entropy values ​​in order to form a reference information entropy sequence; and calculate the arithmetic mean μ of this sequence. ref With standard deviation σ ref Both are used as reference statistics.

[0076] For example, the D of admin_001 w−ref(1)Flattened into a 21-dimensional one-dimensional vector, after normalization, a probability distribution is obtained, and the information entropy value H is calculated. ref(1) =1.86; The entropy values ​​of the remaining 5 weighted matrices are calculated using the same method to be 1.82, 1.88, 1.85, 1.83, and 1.87, forming the reference information entropy sequence [1.86, 1.82, 1.88, 1.85, 1.83, 1.87]; the mean μ of this sequence is calculated. ref =1.85, standard deviation σ ref =0.02, meaning the reference statistic for admin_001 is (1.85, 0.02).

[0077] Furthermore, by combining the backtracking ladder feature weight matrix series, the ladder feature weight matrix, and the fusion weight matrix, a comparative information entropy sequence is calculated and obtained, and corresponding comparative statistics are analyzed and obtained.

[0078] Specifically, by combining the backtracking ladder feature weight matrix series, the ladder feature weight matrix, and the fusion weight matrix, a comparative information entropy sequence is calculated and obtained, and corresponding comparative statistics are analyzed and obtained, including: The difference matrix between the ladder feature weight matrix and each backtracking ladder feature weight matrix in the backtracking ladder feature weight matrix series is calculated to obtain the comparison difference matrix series. Using the fusion weight matrix, the series of comparison difference matrices are iterated and weighted to obtain the second weighted difference matrix series; Calculate the matrix information entropy corresponding to each weighted difference matrix to obtain the contrast information entropy sequence, and calculate the mean and standard deviation of the contrast information entropy sequence as the contrast statistics.

[0079] First, the difference matrix between the current step feature weight matrix and each backtracking step feature weight matrix in the backtracking step feature weight matrix series is calculated to obtain a series of comparison difference matrices. The comparison difference matrix is ​​the matrix obtained by performing an absolute value difference operation between the corresponding elements of the current step feature weight matrix and a single backtracking step feature weight matrix, reflecting the degree of deviation between the current behavior pattern and a single historical behavior pattern. The series of comparison difference matrices is a set of serialized matrices formed by calculating the comparison difference matrix between the current step matrix and each matrix in the backtracking step feature weight matrix series, with the same number as the backtracking matrix series.

[0080] Specifically, extract the current step feature weight matrix W obtained from S200. current ; Traverse each backtracking matrix W in the backtracking ladder feature weight matrix series hist(q) Perform the absolute difference operation between the current echelon matrix and the backtracking matrix at corresponding positions, i.e., D comp(q) =∣W current -Whist(q) |, to obtain a single contrast difference matrix; according to the order of the backtracking matrix series, serialize and arrange all the single contrast difference matrices to form a contrast difference matrix series.

[0081] For example, take the current step feature weight matrix W of admin_001. current With the backtracking matrix W hist(1) Perform absolute difference calculations, such as for position [1,1]: |0.28−0.27|=0.01, and for position [1,3]: |0.25−0.26|=0.01; after completing the calculations for all positions, the contrast difference matrix D is obtained. comp(1) ; calculate sequentially with W hist(2) To W hist(6) The contrast difference matrix forms a series of contrast difference matrices {D} consisting of six 3×7 matrices. comp(1) D comp(2) ,...,Dc omp(6)}

[0082] Secondly, using the fusion weight matrix, the series of contrast difference matrices is iterated and weighted to obtain a second weighted difference matrix series. The second weighted difference matrix is ​​the matrix obtained by performing a Hadamard product operation between the contrast difference matrix and the fusion weight matrix. Historical normal weights are used to weight the current difference values ​​compared to historical values, highlighting abnormal deviation signals in key dimensions. The second weighted difference matrix series is a sequential set of matrices formed by weighting all matrices in the contrast difference matrix series, corresponding one-to-one with the contrast difference matrix series.

[0083] Specifically, iterate through each contrast difference matrix D in the contrast difference matrix series. comp(q) The comparison difference matrix and the fusion weight matrix W fused Perform the Hadamard product operation, i.e., D w−comp(q) =D comp(q) ⊙W fused This yields a single second-weighted difference matrix; then, following the order of the difference matrix series, all the single weighted matrices are serialized and arranged to form the second-weighted difference matrix series.

[0084] For example, take the contrast difference matrix D of admin_001. comp(1) With the fusion weight matrix W fused Perform the Hadamard product operation. For example, at position [1,1]: 0.01 × 0.27 = 0.0027, and at position [1,3]: 0.01 × 0.25 = 0.0025. After completing the calculation for all positions, the second weighted difference matrix D is obtained. w−comp(1) ; Process all contrast difference matrices sequentially to form a second weighted difference matrix series {D} containing six 3×7 matrices. w−comp(1) D w−comp(2),...,D w−comp(6)}

[0085] Next, the matrix information entropy corresponding to each weighted difference matrix is ​​calculated to obtain a comparative information entropy sequence. The mean and standard deviation of the comparative information entropy sequence are then calculated as the comparative statistics. The comparative information entropy sequence refers to a one-dimensional numerical sequence formed by sequentially generating the information entropy values ​​corresponding to all matrices in the second weighted difference matrix series, reflecting the change in disorder of the current behavioral pattern relative to historical behavioral patterns. The comparative statistics refer to the arithmetic mean and standard deviation calculated from the comparative information entropy sequence, which are indicators that quantify the degree of deviation between the current behavioral pattern and historical patterns.

[0086] Specifically, following the calculation process of matrix information entropy, each matrix in the second weighted difference matrix series is traversed, flattened, normalized, and its information entropy value is calculated sequentially; all entropy values ​​are arranged in order to form a comparative information entropy sequence; the arithmetic mean μ of this sequence is calculated. comp With standard deviation σ comp Both are used together as comparative statistics.

[0087] For example, the D of admin_001 w−comp(1) The information entropy value H is calculated after flattening and normalization. comp(1) =2.58; The entropy values ​​of the remaining 5 weighted matrices are calculated using the same method: 2.61, 2.59, 2.63, 2.60, and 2.62, forming the contrastive information entropy sequence [2.58, 2.61, 2.59, 2.63, 2.60, 2.62]; the mean μ of this sequence is calculated. comp =2.60, standard deviation σ comp =0.018, meaning the comparative statistic for admin_001 is (2.60, 0.018).

[0088] Finally, the reference statistic and the comparison statistic are compared to verify behavioral consistency, and the behavioral consistency verification result is obtained.

[0089] The process of comparing the reference statistic with the comparison statistic to verify behavioral consistency and obtaining the behavioral consistency verification result includes: Based on validated historical multidimensional behavioral samples, establish statistical thresholds under pre-set reliability. Calculate the residual between the reference statistic and the comparison statistic. If the residual meets the threshold of the statistic, output the behavior consistency verification result; otherwise, output behavior inconsistency.

[0090] First, based on validated historical multidimensional behavioral samples, statistical thresholds are established under pre-set reliability. These statistical thresholds, constructed based on validated historical multidimensional behavioral samples and under pre-set reliability, serve as a residual judgment threshold, a quantitative standard distinguishing between normal fluctuations and abnormal deviations in behavior, and are typically set in conjunction with the 3σ principle. Based on a large number of validated historical multidimensional account behavioral samples, statistical thresholds are established under pre-set reliability, incorporating the 3σ principle, such as the mean residual threshold 3σ. ref Standard deviation, residual threshold, 3σ ref For example, based on validated historical behavior samples, a statistic threshold of 3σ is set at a 99.73% confidence level. ref =0.06.

[0091] Secondly, the residuals of the reference statistic and the comparison statistic are calculated. If the residuals meet the statistic threshold, the behavioral consistency verification result is output; otherwise, behavioral inconsistency is output. Behavioral consistency verification: By comparing the residuals with the statistic threshold, it is determined whether the current behavioral pattern is consistent with the historical normal behavioral pattern. If consistent, it is normal behavior; if inconsistent, it is abnormal behavior. The mean residual and standard deviation residuals of the comparison statistic and the reference statistic are calculated respectively. It is determined whether the residuals meet the statistic threshold, i.e., residual ≤ statistic threshold. If all residuals meet the threshold, the behavioral consistency verification result is output; if any residual exceeds the threshold, the behavioral inconsistency verification result is output. For example, the mean residual Δμ = 2.60 − 1.85 = 0.75 and the standard deviation residual Δσ = 0.018 − 0.02 = −0.002 are calculated for admin_001. The mean residual 0.75 > 0.06, which exceeds the statistic threshold. Therefore, the behavioral consistency verification result for admin_001 is output as inconsistent behavior.

[0092] Finally, account alerts are issued based on the behavior consistency verification results. Upon receiving the behavior consistency verification results, a mapping relationship is established between the results and alert actions: if the verification result indicates consistent behavior, the alert is silenced, and continuous behavior monitoring of the target account continues; if the verification result indicates inconsistent behavior, an account alert is immediately triggered. Depending on the actual scenario, alert information can be pushed to the security management platform, and alarm notifications can be sent to security operations personnel. Simultaneously, auxiliary security measures such as account operation auditing and temporary permission restrictions can be implemented.

[0093] For example, the behavior consistency verification result of admin_001 is inconsistent, which immediately triggers an account alert: a red alert work order is generated on the enterprise data platform security management platform, which includes information such as account ID, anomaly detection time, and the core deviation dimension between current and historical behavior; at the same time, SMS and in-site alarm notifications are sent to the work terminals of security operations personnel; and real-time operation auditing is started for the account to record all subsequent data access, API calls and other behaviors, providing a basis for security investigation.

[0094] In this embodiment of the invention, an arithmetic mean fusion weight matrix is ​​used to construct a unified and objective normal benchmark for historical behavior patterns, effectively eliminating the interference of individual fluctuations in historical behavior and solving the problem of lacking a unified reference in traditional comparisons. Through the calculation of the difference matrix using both reference and comparison paths, historical normal fluctuations and historical deviations from current behavior are characterized respectively, forming a two-dimensional analysis system of normal fluctuation benchmark and current deviation detection, which can accurately distinguish between normal business deviations and abnormal behavior deviations. By leveraging the Hadamard product weighting of the fusion weight matrix, deviation signals at key time scales and behavioral characteristics are strengthened, while the irrelevance of secondary dimensions is weakened. The fluctuations enhance sensitivity to complex, nonlinear anomalies. By converting matrix differences into information entropy values ​​and calculating statistics, a quantitative representation of behavioral deviations is achieved. Combined with validated historical samples and pre-set reliability, statistical thresholds are established, freeing behavioral consistency verification from subjective judgment and providing a scientific quantitative standard. Ultimately, based on the verification results, precise linkage between silent and account alerts is achieved. This not only promptly detects and triggers alarms for abnormal behaviors such as account privilege abuse, data theft, and account hijacking, but also avoids false alarms caused by normal business fluctuations, effectively improving the accuracy and reliability of account security alerts in the trusted data space. Furthermore, each step of the verification process is based on explicit matrix operations and statistical principles, and all intermediate results are traceable and analyzable, providing clear clues for security operations personnel to investigate the root causes of anomalies and improving the interpretability of alerts.

[0095] Through the specific implementation methods described above, the embodiments of the present invention achieve the following technical effects: This invention provides a reliable data space intelligent early warning method and system based on multi-source behavior analysis. By collecting multi-source behavior logs and extracting time-series features, it solves the problems of data dispersion and redundancy, laying a precise time-series data foundation for full-process analysis. Combining account business cycle configuration with tiered time windows, it achieves dynamic and objective weighting of features at different time scales through entropy weighting, overcoming the shortcomings of traditional single window and static weights, and accurately characterizing multi-scale behavior patterns. Based on the sliding window method, iteratively generating a series of backtracking weight matrices, it constructs a continuous and standardized historical behavior pattern library, providing a highly referenced historical benchmark for consistency verification. By establishing a historical normal benchmark through the fusion of weight matrices, and obtaining standardized statistics through weighted difference matrices and information entropy transformation, it achieves dual statistical verification by combining the 3σ principle, which not only strengthens the abnormal signals of key dimensions, but also effectively distinguishes between normal business fluctuations and real anomalies, reducing false alarm and false negative rates. Overall, it achieves multi-scale and all-dimensional monitoring of account behavior, is highly sensitive to complex nonlinear abnormal behaviors, and the analysis process is based on clear matrix operation and statistical principles, which makes it highly interpretable, efficient and easy to implement. It can adapt to the concurrent monitoring needs of a large number of high-privilege accounts in enterprise data platforms, and can accurately warn of security risks such as abuse of permissions, account hijacking, and data theft, thus building a proactive and intelligent security defense line for the trusted data space.

[0096] Example 2, as Figure 2 As shown, this invention provides a trusted data space intelligent early warning system based on multi-source behavior analysis, comprising: The multi-source feature extraction module 11 is used to acquire multi-source behavioral data generated by the target account subject in the trusted data space, and extract multi-dimensional behavioral features based on the multi-source behavioral data. The ladder weight matrix construction module 12 is used to configure a series of ladder analysis windows with ladder time length, and take the current time node as the analysis starting point. It combines the entropy weight method to analyze and determine the dynamic feature weights based on the multidimensional behavioral features under different ladder analysis windows, and forms a ladder feature weight matrix. The backtracking weight matrix generation module 13 is used to perform entropy weight analysis on the multidimensional behavioral features iteratively with time backtracking as the sliding direction based on the sliding window method and a preset sliding step size, to obtain multiple backtracking ladder feature weight matrices and form a backtracking ladder feature weight matrix series. The consistency warning module 14 is used to combine the ladder feature weight matrix and the backtracking ladder feature weight matrix series to perform behavioral consistency verification of the target account subject, and to issue an account warning based on the behavioral consistency verification result.

[0097] In one embodiment, the multi-source feature extraction module 11 is further configured to: Through the data platform, extract multi-source behavior logs of the target account subject in the trusted data space, including at least: data access logs, API call logs, permission change logs and computing task logs; Combined with a preset behavior tracing window, the multi-source behavior logs are truncated, and the truncated data results are stored in a structured manner. In response to the prior feature list, the data cropping results are traversed to extract features and obtain the multidimensional behavioral features, wherein the multidimensional behavioral features are associated with time-series markers; The window length of the behavior tracing window is N times the longest of the series of ladder analysis windows, and N is greater than 1.

[0098] In one embodiment, the ladder weight matrix construction module 12 is further configured to: The series of step analysis windows that configure the step time length includes: Based on the subject category of the target account, the corresponding account business characteristics are extracted, and business cycle analysis is performed based on the account business characteristics to obtain multiple typical business cycles; Based on multiple typical business cycles, define the serialized tiered time length and configure the corresponding tiered analysis window series.

[0099] Specifically, taking the current time point as the starting point of the analysis, and combining entropy weight method analysis, the dynamic feature weights based on the multidimensional behavioral features under different step analysis windows are determined, forming a step feature weight matrix, including: Taking the current time node as the starting point of analysis, based on each step time window in the step analysis window series, the behavioral feature data within the corresponding time window is extracted from the multidimensional behavioral features to obtain the step behavioral feature sequence. Traverse the ladder behavior features in the ladder behavior feature sequence and use the information entropy evaluation method to calculate the dynamic weight of multiple behavior feature items in each ladder time window. The dynamic weights under multiple tiered time windows are structured and stored to form the tiered feature weight matrix of the target account entity at the current time node; The first dimension of the stepped feature weight matrix corresponds to multiple stepped time windows, and the second dimension corresponds to multiple behavioral feature items.

[0100] In one embodiment, the backtracking weight matrix generation module 13 is further configured to: Starting from the current time point, update the analysis starting point based on the sliding direction and the sliding step size; Based on the updated analysis starting point, multi-window feature extraction is performed on the multi-dimensional behavioral features in combination with the ladder analysis window series to obtain the backtracking ladder behavioral feature sequence. The backtracking ladder behavior feature sequence is analyzed by entropy weight method, and the backtracking ladder feature weight matrix is ​​determined based on the analysis results of entropy weight method. Based on the sliding direction and the sliding step size, the starting point of the analysis is iteratively updated and entropy weight method analysis is performed to obtain multiple backtracking ladder feature weight matrices. Using the timestamp of the associated analysis starting point as an index, multiple backtracking ladder feature weight matrices are serialized to obtain the backtracking ladder feature weight matrix series.

[0101] In one embodiment, the consistency warning module 14 is further configured to: Based on the aforementioned backtracking ladder feature weight matrix series, calculate the fusion weight matrix based on the arithmetic mean; By combining the backtracking ladder feature weight matrix series with the fusion weight matrix, the reference information entropy sequence is calculated and obtained, and the corresponding reference statistics are analyzed and obtained. By combining the backtracking ladder feature weight matrix series, the ladder feature weight matrix and the fusion weight matrix, the comparative information entropy sequence is calculated and the corresponding comparative statistics are obtained through analysis. The behavioral consistency verification is performed by comparing the reference statistic with the comparison statistic, and the behavioral consistency verification result is obtained.

[0102] Specifically, by combining the backtracking ladder feature weight matrix series with the fusion weight matrix, a reference information entropy sequence is calculated and obtained, and corresponding reference statistics are analyzed and obtained, including: The difference matrix between the fused weight matrix and each backtracking step feature weight matrix in the backtracking step feature weight matrix series is calculated to obtain the reference difference matrix series. Using the fusion weight matrix, the reference difference matrix series is iterated and weighted to obtain the first weighted difference matrix series; Calculate the matrix information entropy corresponding to each weighted difference matrix to obtain the reference information entropy sequence, and calculate the mean and standard deviation of the reference information entropy sequence as the reference statistic.

[0103] Specifically, by combining the backtracking ladder feature weight matrix series, the ladder feature weight matrix, and the fusion weight matrix, a comparative information entropy sequence is calculated and obtained, and corresponding comparative statistics are analyzed and obtained, including: The difference matrix between the ladder feature weight matrix and each backtracking ladder feature weight matrix in the backtracking ladder feature weight matrix series is calculated to obtain the comparison difference matrix series. Using the fusion weight matrix, the series of comparison difference matrices are iterated and weighted to obtain the second weighted difference matrix series; Calculate the matrix information entropy corresponding to each weighted difference matrix to obtain the contrast information entropy sequence, and calculate the mean and standard deviation of the contrast information entropy sequence as the contrast statistics.

[0104] The process of comparing the reference statistic with the comparison statistic to verify behavioral consistency and obtaining the behavioral consistency verification result includes: Based on validated historical multidimensional behavioral samples, establish statistical thresholds under pre-set reliability. Calculate the residual between the reference statistic and the comparison statistic. If the residual meets the threshold of the statistic, output the behavior consistency verification result; otherwise, output behavior inconsistency.

[0105] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A reliable data space intelligent early warning method based on multi-source behavior analysis, characterized in that, include: Acquire multi-source behavioral data generated by the target account subject within a trusted data space, and extract multi-dimensional behavioral features based on the multi-source behavioral data; Configure a series of step analysis windows with step time lengths, and take the current time node as the starting point of the analysis. Combine the entropy weight method to analyze and determine the dynamic feature weights based on the multidimensional behavioral features under different step analysis windows, and form a step feature weight matrix. Based on the sliding window method and a preset sliding step size, the multidimensional behavioral features are iteratively analyzed using the entropy weight method with time backtracking as the sliding direction to obtain multiple backtracking ladder feature weight matrices, forming a series of backtracking ladder feature weight matrices. By combining the aforementioned ladder feature weight matrix with the backtracking ladder feature weight matrix series, behavioral consistency verification of the target account subject is performed, and account warnings are issued based on the behavioral consistency verification results.

2. The method as described in claim 1, characterized in that, Acquire multi-source behavioral data generated by the target account entity within a trusted data space, and extract multi-dimensional behavioral features based on the multi-source behavioral data, including: Through the data platform, extract multi-source behavior logs of the target account subject in the trusted data space, including at least: data access logs, API call logs, permission change logs and computing task logs; Combined with a preset behavior tracing window, the multi-source behavior logs are truncated, and the truncated data results are stored in a structured manner. In response to the prior feature list, the data cropping results are traversed to extract features and obtain the multidimensional behavioral features, wherein the multidimensional behavioral features are associated with time-series markers; The window length of the behavior tracing window is N times the longest of the series of ladder analysis windows, and N is greater than 1.

3. The method as described in claim 1, characterized in that, A series of step analysis windows for configuring step time lengths include: Based on the subject category of the target account, the corresponding account business characteristics are extracted, and business cycle analysis is performed based on the account business characteristics to obtain multiple typical business cycles; Based on multiple typical business cycles, define the serialized tiered time length and configure the corresponding tiered analysis window series.

4. The method as described in claim 1, characterized in that, Taking the current time point as the starting point of the analysis, and combining the entropy weight method, the dynamic feature weights based on the multidimensional behavioral features under different step analysis windows are determined, forming a step feature weight matrix, including: Taking the current time node as the starting point of analysis, based on each step time window in the step analysis window series, the behavioral feature data within the corresponding time window is extracted from the multidimensional behavioral features to obtain the step behavioral feature sequence. Traverse the ladder behavior features in the ladder behavior feature sequence and use the information entropy evaluation method to calculate the dynamic weight of multiple behavior feature items in each ladder time window. The dynamic weights under multiple tiered time windows are structured and stored to form the tiered feature weight matrix of the target account entity at the current time node; The first dimension of the stepped feature weight matrix corresponds to multiple stepped time windows, and the second dimension corresponds to multiple behavioral feature items.

5. The method as described in claim 1, characterized in that, Based on the sliding window method and a preset sliding step size, the multidimensional behavioral features are iteratively analyzed using entropy weighting with time backtracking as the sliding direction. This yields multiple backtracking ladder feature weight matrices, forming a series of backtracking ladder feature weight matrices, including: Starting from the current time point, update the analysis starting point based on the sliding direction and the sliding step size; Based on the updated analysis starting point, multi-window feature extraction is performed on the multi-dimensional behavioral features in combination with the ladder analysis window series to obtain the backtracking ladder behavioral feature sequence. The backtracking ladder behavior feature sequence is analyzed by entropy weight method, and the backtracking ladder feature weight matrix is ​​determined based on the analysis results of entropy weight method. Based on the sliding direction and the sliding step size, the starting point of the analysis is iteratively updated and entropy weight method analysis is performed to obtain multiple backtracking ladder feature weight matrices. Using the timestamp of the associated analysis starting point as an index, multiple backtracking ladder feature weight matrices are serialized to obtain the backtracking ladder feature weight matrix series.

6. The method as described in claim 1, characterized in that, Combining the aforementioned ladder feature weight matrix with the backtracking ladder feature weight matrix series, behavioral consistency verification of the target account entity is performed, including: Based on the aforementioned backtracking ladder feature weight matrix series, calculate the fusion weight matrix based on the arithmetic mean; By combining the backtracking ladder feature weight matrix series with the fusion weight matrix, the reference information entropy sequence is calculated and obtained, and the corresponding reference statistics are analyzed and obtained. By combining the backtracking ladder feature weight matrix series, the ladder feature weight matrix and the fusion weight matrix, the comparative information entropy sequence is calculated and the corresponding comparative statistics are obtained through analysis. The behavioral consistency verification is performed by comparing the reference statistic with the comparison statistic, and the behavioral consistency verification result is obtained.

7. The method as described in claim 6, characterized in that, By combining the backtracking ladder feature weight matrix series with the fusion weight matrix, a reference information entropy sequence is calculated and obtained, and corresponding reference statistics are analyzed and obtained, including: The difference matrix between the fused weight matrix and each backtracking step feature weight matrix in the backtracking step feature weight matrix series is calculated to obtain the reference difference matrix series. Using the fusion weight matrix, the reference difference matrix series is iterated and weighted to obtain the first weighted difference matrix series; Calculate the matrix information entropy corresponding to each weighted difference matrix to obtain the reference information entropy sequence, and calculate the mean and standard deviation of the reference information entropy sequence as the reference statistic.

8. The method as described in claim 6, characterized in that, By combining the backtracking ladder feature weight matrix series, the ladder feature weight matrix, and the fusion weight matrix, a comparative information entropy sequence is calculated and obtained, and corresponding comparative statistics are analyzed and obtained, including: The difference matrix between the ladder feature weight matrix and each backtracking ladder feature weight matrix in the backtracking ladder feature weight matrix series is calculated to obtain the comparison difference matrix series. Using the fusion weight matrix, the series of comparison difference matrices are iterated and weighted to obtain the second weighted difference matrix series; Calculate the matrix information entropy corresponding to each weighted difference matrix to obtain the contrast information entropy sequence, and calculate the mean and standard deviation of the contrast information entropy sequence as the contrast statistics.

9. The method as described in claim 6, characterized in that, The behavior consistency verification is performed by comparing the reference statistic with the comparison statistic, and the behavior consistency verification result is obtained, including: Based on validated historical multidimensional behavioral samples, establish statistical thresholds under pre-set reliability. Calculate the residual between the reference statistic and the comparison statistic. If the residual meets the threshold of the statistic, output the behavior consistency verification result; otherwise, output behavior inconsistency.

10. A trusted data spatial intelligent early warning system based on multi-source behavior analysis, characterized in that, The method for implementing the trusted data space intelligent early warning method based on multi-source behavior analysis as described in any one of claims 1-9 includes: The multi-source feature extraction module is used to acquire multi-source behavioral data generated by the target account subject in the trusted data space, and extract multi-dimensional behavioral features based on the multi-source behavioral data; The ladder weight matrix construction module is used to configure a series of ladder analysis windows with ladder time lengths, and takes the current time node as the analysis starting point. It combines entropy weight method to analyze and determine the dynamic feature weights based on the multidimensional behavioral features under different ladder analysis windows, forming a ladder feature weight matrix. The backtracking weight matrix generation module is used to perform entropy weight analysis on the multidimensional behavioral features iteratively with time backtracking as the sliding direction based on the sliding window method and a preset sliding step size, to obtain multiple backtracking ladder feature weight matrices and form a backtracking ladder feature weight matrix series. The consistency warning module is used to combine the ladder feature weight matrix and the backtracking ladder feature weight matrix series to verify the behavioral consistency of the target account subject, and to issue an account warning based on the behavioral consistency verification result.

Images