Computer application behavior analysis method and system based on deep learning

Abstract

The application provides a kind of computer application behavior analysis method and system based on deep learning, it is related to computer application analysis technical field, first, the behavior evolution sequence set in the whole running period of computer application is acquired;Behavior evolution trajectory model is constructed based on the behavior evolution sequence set;The behavior evolution trajectory model is interactively inferred in two directions by calling the pre-trained deep learning bidirectional inference model, and the behavior inference result is obtained;Abnormal behavior verification module combination is constructed based on the behavior inference result, and the abnormal behavior verification result is output;Computer application behavior dynamic analysis report is generated according to the abnormal behavior verification result.The application can comprehensively and deeply analyze the behavior of computer application in the whole running period, and accurately identify abnormal behavior.

Description

Technical Field

[0001] This invention relates to the field of computer application analysis technology, and more specifically, to a method and system for analyzing computer application behavior based on deep learning. Background Technology

[0002] In the field of computer applications, as application functions become increasingly rich and complex, their behavior during operation also becomes increasingly complex and diverse. Accurate and comprehensive analysis of computer application behavior is crucial for ensuring system security, optimizing application performance, and improving user experience.

[0003] Currently, traditional methods for analyzing computer application behavior have certain limitations. On the one hand, these methods often only allow for isolated analysis of application behavior at specific stages or for specific types of behavior. For example, they may focus only on resource consumption during application startup or only on data interaction behavior during application operation, lacking a comprehensive consideration of the application's behavioral evolution throughout its entire lifecycle. This makes it difficult for the analysis results to fully reflect the application's behavioral characteristics and patterns of change, and to identify potential problems in a timely manner.

[0004] On the other hand, existing analytical methods, when dealing with complex behavioral data, typically employ simple rule matching or statistical analysis, making it difficult to delve into the intrinsic relationships and potential trends between behaviors. For example, for abnormal behaviors that occur during application feature iteration, traditional methods may only be able to identify surface-level anomalies, without being able to trace their causes or predict their future development trends. Furthermore, traditional methods also struggle to accurately analyze and judge behaviors involving the collaborative interaction of multiple application modules. Summary of the Invention

[0005] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a computer application behavior analysis method based on deep learning, the method comprising: Obtain a set of behavior evolution sequences generated by a computer application throughout its entire operating cycle. The set of behavior evolution sequences includes operation behavior evolution sequences, resource call evolution sequences, and data interaction evolution sequences generated by the application during the initial startup phase, function iteration phase, dynamic resource allocation phase, and process termination phase. Each behavior evolution sequence carries information such as behavior evolution time period, behavior-associated application module identifier, behavior target, and behavior evolution direction. A behavior evolution trajectory model is constructed based on the set of behavior evolution sequences. The behavior evolution trajectory model is divided into forward evolution trajectory, backward backtracking trajectory and branch evolution trajectory according to the direction of behavior evolution. Each trajectory contains the behavior evolution unit in the corresponding evolution direction and the evolution relationship between the units. The pre-trained deep learning bidirectional reasoning model is invoked to perform bidirectional interactive reasoning processing on the behavior evolution trajectory model to obtain behavior reasoning results. The behavior reasoning results include behavior trend features obtained from forward evolution reasoning, behavior source features obtained from backward backtracking reasoning, and behavior abnormal branch features obtained from branch evolution reasoning. Based on the behavioral reasoning results, an abnormal behavior verification module combination is constructed. The abnormal behavior verification module combination includes a trend feature verification module, a source tracing feature verification module, a branch feature verification module, a cross-module collaborative verification module, and a verification result feedback module. Each module collaboratively outputs the abnormal behavior verification results. A dynamic analysis report of computer application behavior is generated based on the abnormal behavior verification results. The report includes details of the behavior evolution corresponding to the abnormal behavior branch features, the correlation between forward and backward reasoning features, the propagation path of the abnormal behavior in the evolution trajectory, and the application operating environment information at the stage of the abnormal occurrence.

[0006] Furthermore, embodiments of the present invention also provide a computer application behavior analysis system based on deep learning, characterized in that it includes: A processor; a machine-readable storage medium for storing machine-executable instructions of the processor; wherein the processor is configured to execute the aforementioned deep learning-based computer application behavior analysis method by executing the machine-executable instructions.

[0007] In another aspect, embodiments of the present invention also provide a computer program product, the computer program product including machine-executable instructions stored in a computer-readable storage medium, the processor of the deep learning-based computer application behavior analysis system reading the machine-executable instructions from the computer-readable storage medium, the processor executing the machine-executable instructions, causing the deep learning-based computer application behavior analysis system to perform the aforementioned deep learning-based computer application behavior analysis method.

[0008] Based on the above, by acquiring a set of behavioral evolution sequences generated by a computer application throughout its entire operational cycle, encompassing various types of behavioral evolution sequences generated at key stages of the application and carrying rich behavioral information, a behavioral evolution trajectory model is constructed based on this set of sequences. This model is divided according to different evolution directions, and the behavioral evolution units within each trajectory and the relationships between these units are recorded. This presents the evolution path and patterns of application behavior, facilitating a deeper understanding of the internal logic and development patterns of application behavior. Next, a pre-trained deep learning bidirectional inference model is invoked to perform bidirectional interactive inference processing on the behavioral evolution trajectory model. This enables comprehensive mining of application behavior characteristics from both forward and reverse directions, predicting future trends and tracing the origins of behavior. It also accurately identifies abnormal behavior branches. Based on the behavioral inference results, an abnormal behavior verification module is constructed. These modules work collaboratively to verify abnormal behavior from multiple perspectives, significantly improving the accuracy and reliability of abnormal behavior judgment. The final generated dynamic analysis report of computer application behavior records detailed information about abnormal behavior and the relationships between behavioral inference features, contributing to improved overall performance and security of the computer application. Attached Figure Description

[0009] Figure 1 This is a schematic diagram of the execution flow of the computer application behavior analysis method based on deep learning provided in an embodiment of the present invention.

[0010] Figure 2 This is a schematic diagram of exemplary hardware and software components of a deep learning-based computer application behavior analysis system provided in an embodiment of the present invention. Detailed Implementation

[0011] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a deep learning-based computer application behavior analysis method according to an embodiment of the present invention. The following is a detailed description of this deep learning-based computer application behavior analysis method.

[0012] Step S110: Obtain the set of behavior evolution sequences generated by the computer application throughout its entire operating cycle. The set of behavior evolution sequences includes operation behavior evolution sequences, resource call evolution sequences, and data interaction evolution sequences generated by the application during the initial startup phase, function iteration phase, resource dynamic allocation phase, and process termination phase. Each behavior evolution sequence carries behavior evolution time period, behavior-associated application module identifier, behavior target, and behavior evolution direction information.

[0013] In this embodiment, a computer application related to an intelligent office collaboration system is used as an example for illustration. This intelligent office collaboration system generates multiple behavioral evolution sequences throughout its entire operating cycle. In the initial startup phase, this embodiment performs a series of initialization operations, such as loading configuration files and establishing database connections, thereby generating an operational behavior evolution sequence. The behavioral evolution period carried by this sequence is the time interval from system startup to startup completion. The application module associated with the behavior is identified as the "Startup Module," the target of the behavior is the system configuration file and database, and the evolution direction is forward startup. In the function iteration phase, when the system undergoes version updates or function module upgrades, an operational behavior evolution sequence related to function iteration is generated. The behavioral evolution period is from the start to the end of the iteration, the associated module is identified as the "Iteration Update Module," the target is the function module code to be upgraded, and the evolution direction is functional enhancement. In the dynamic resource allocation phase, resources such as CPU, memory, and network bandwidth can be dynamically allocated according to different user access requests and task load, generating a resource call evolution sequence. The behavioral evolution period is from the start to the completion of resource allocation, the associated module is identified as the "Resource Management Module," the target is various hardware resources, and the evolution direction is resource optimization allocation. During the process termination phase, this embodiment performs operations such as closing the process, releasing resources, and saving data, generating a sequence of process termination-related operational behaviors. The evolution period is from the issuance of the termination command to the complete closure of the process. The associated module is identified as the "Process Management Module," and its target is the system process and related data. The evolution direction is the process termination direction. Simultaneously, at each stage, data interaction evolution sequences may also occur with external devices and other application systems, such as data interaction with a printer or data synchronization with a mail server. These sequences also carry corresponding time periods, module identifiers, target objects, and evolution direction information. When acquiring these sets of behavioral evolution sequences, comprehensive collection of system operation logs, network communication records, and resource monitoring data is required. For data involving user privacy, such as user login information and personal file operation records, data anonymization technology is used to replace the user's real identity information with an anonymous identifier and encrypt sensitive fields to ensure that user privacy is not leaked during data collection and subsequent processing.

[0014] Step S120: Construct a behavior evolution trajectory model based on the set of behavior evolution sequences. The behavior evolution trajectory model is divided into forward evolution trajectory, backward backtracking trajectory and branch evolution trajectory according to the behavior evolution direction. Each trajectory contains the behavior evolution unit in the corresponding evolution direction and the evolution relationship between the units.

[0015] Step S121: Decompose each behavior evolution sequence in the behavior evolution sequence set into units, and divide each behavior evolution sequence into independent behavior evolution units that include behavior evolution triggering conditions, behavior evolution execution instructions, behavior evolution target, behavior evolution feedback information and subsequent behavior evolution direction. Each independent behavior evolution unit carries an evolution direction identifier.

[0016] For the behavioral evolution sequence set of an intelligent office collaboration system, the resource call evolution sequence is taken as an example for unit decomposition. Assume that this resource call evolution sequence describes the process of the system dynamically allocating memory resources according to user task requests within a certain time period. First, the behavioral evolution trigger condition is determined, namely, the memory requirement in the user-submitted task request exceeds the currently available memory threshold. The behavioral evolution execution instruction is the memory allocation instruction issued by the system memory management module, including operations such as releasing memory occupied by inactive processes from the cache and calling virtual memory. The behavioral evolution targets the system's physical memory and virtual memory space. The behavioral evolution feedback information includes the status information of whether the memory allocation was successful or not, the size of the allocated memory, and the process identifier of the released memory, etc., after the memory allocation is completed. The subsequent direction of the behavioral evolution is to continue monitoring the usage of other resources or respond to the user's next task request. The above information is integrated into an independent behavioral evolution unit, and based on the fact that this resource call behavior is a positive resource allocation to meet task requirements, its evolution direction is marked as a positive evolution direction. In the same way, the operational behavior evolution sequence and the data interaction evolution sequence are decomposed to obtain multiple independent behavior evolution units. Each unit contains the above information and the corresponding evolution direction identifier.

[0017] Step S122: Based on the evolution direction identifier of the independent behavior evolution unit, assign all independent behavior evolution units to the corresponding trajectory type. Independent behavior evolution units in the forward evolution direction are assigned to the forward evolution trajectory, those in the reverse backtracking direction are assigned to the reverse backtracking trajectory, and those in the branch evolution direction are assigned to the branch evolution trajectory.

[0018] In intelligent office collaboration systems, numerous independent behavioral evolution units are obtained after unit decomposition. For example, a behavioral evolution unit that loads the core module upon startup is identified as having a forward evolution direction and is assigned to a forward evolution trajectory. A behavioral evolution unit that performs error log review and locates the root cause of an error after it occurs has a reverse backtracking direction and is assigned to a reverse backtracking trajectory. During file processing, the main file processing flow is forward-evolving, while the concurrent processing flows such as file backup and format conversion are triggered, resulting in a branch evolution direction, which is assigned to a branch evolution trajectory. Through this method, all independent behavioral evolution units are accurately categorized into different trajectory types.

[0019] Step S123: Analyze the progressive relationship between independent behavioral evolution units within the forward evolution trajectory, extract the behavioral evolution feedback information of the previous independent behavioral evolution unit and the behavioral evolution triggering conditions of the next independent behavioral evolution unit, compare the progressive matching relationship between the two, and generate progressive matching results.

[0020] Taking file creation and file saving as two independent behavioral evolution units in the forward evolution trajectory of an intelligent office collaboration system as examples. The first independent behavioral evolution unit is the file creation unit, whose behavioral evolution feedback information includes a successful file creation identifier, the created file path, and the file's initial attributes. The second independent behavioral evolution unit is the file saving unit, whose behavioral evolution trigger condition is the detection of file content modification and the user performing a save operation. The file path and file identifier in the feedback information of the file creation unit are extracted and compared with the file path and file identifier in the trigger condition of the file saving unit to see if they are the same file. If the file paths and identifiers are consistent, it indicates that the file saving behavior is an operation following the file creation behavior, and there is a progressive relationship; the progressive matching result is a successful match. If the file path in the trigger condition of the file saving unit does not exist in the feedback information of the file creation unit, the progressive matching result is a failed match. By performing the above comparative analysis on all adjacent independent behavioral evolution units within the forward evolution trajectory, a complete progressive matching result is generated, clarifying the progressive relationship between each unit.

[0021] Step S124: Based on the progressive matching result, define the evolutionary association relationship between independent behavior evolutionary units within the forward evolutionary trajectory. If the progressive matching result is a complete progressive match, define the first type of evolutionary association relationship. If the progressive matching result is a partial progressive match, define the second type of evolutionary association relationship. If the progressive matching result is no progressive match, mark it as a progressive break unit.

[0022] In the forward evolution trajectory of the intelligent office collaboration system, for cases where the progressive matching result is a complete progressive match—for example, where all key parameters (file path, file type, creator permissions, etc.) in the feedback information of the file creation unit perfectly match the triggering conditions of the file editing unit—this is defined as a first-type evolutionary association, indicating a close and complete progressive relationship between the two units. If the progressive matching result is a partial progressive match—for example, where the file path in the triggering conditions of the file editing unit matches the feedback information of the file creation unit, but the editing permissions required by the file editing unit are not explicitly included in the feedback information of the file creation unit, and only some parameters match—this is defined as a second-type evolutionary association, indicating a certain degree of progressive association, but not a completely close one. When the progressive matching result is no progressive match—for example, where a system update unit unrelated to file processing appears before the file printing unit, and the feedback information of this system update unit does not match any associated parameters with the triggering conditions of the file printing unit—this system update unit is marked as a progressive break unit, indicating an interruption in its progressive relationship with the preceding and following units in the forward evolution trajectory.

[0023] Step S125: Analyze the backtracking relationship between independent behavioral evolution units within the reverse backtracking trajectory, extract the behavioral evolution feedback information of the next independent behavioral evolution unit and the behavioral evolution triggering condition of the previous independent behavioral evolution unit, compare the backtracking matching relationship between the two, and generate backtracking matching results.

[0024] In intelligent office collaboration systems, when data synchronization fails, a reverse backtracking trajectory is triggered. For example, the latter independent behavior evolution unit is the data synchronization failure handling unit, whose behavior evolution feedback information includes the file identifier of the synchronization failure, the reason for failure (such as network timeout), and the failure time. The former independent behavior evolution unit is the data synchronization initiation unit, whose behavior evolution triggering conditions include user-triggered synchronization commands, a list of files to be synchronized, and a preset synchronization time window. The file identifier and synchronization time from the feedback information of the data synchronization failure handling unit are extracted and compared with the list of files to be synchronized and the preset synchronization time window from the triggering conditions of the data synchronization initiation unit. If the file identifier matches and the failure time is within the preset synchronization time window, it indicates that the data synchronization failure was caused by the synchronization behavior triggered by this synchronization initiation unit, the backtracking match is established, and a successful backtracking match result is generated. If the file identifier does not exist in the list of files to be synchronized, or the failure time is not within the preset synchronization time window, the backtracking match result is a failure. Through this type of comparison of each unit within the reverse backtracking trajectory, a backtracking match result is generated.

[0025] Step S126: Based on the backtracking matching result, define the evolutionary association relationship between independent behavioral evolutionary units within the reverse backtracking trajectory. If the backtracking matching result is a complete backtracking match, define the third type of evolutionary association relationship. If the backtracking matching result is a partial backtracking match, define the fourth type of evolutionary association relationship. If the backtracking matching result is no backtracking match, mark it as a backtracking break unit.

[0026] For independent behavioral evolution units in the reverse backtracking trajectory of an intelligent office collaboration system, if the backtracking matching result is a complete backtracking match—for example, all key backtracking parameters (file identifier, synchronization command ID, network environment parameters, etc.) in the feedback information of the data synchronization failure handling unit can completely correspond to the triggering conditions of the data synchronization initiating unit—then the relationship between the two is defined as the third type of evolutionary association, indicating that the behavior of the latter unit can be accurately traced back to the former unit. If the backtracking matching result is a partial backtracking match—for example, the file identifier in the feedback information of the data synchronization failure handling unit matches the triggering conditions of the data synchronization initiating unit, but the synchronization command ID cannot be matched due to missing log records, and only some parameters correspond—then it is defined as the fourth type of evolutionary association. When the backtracking matching result is no backtracking match—for example, if the feedback information of a system error alarm unit cannot find matching parameters with the triggering conditions of any preceding error detection unit—then the system error alarm unit is marked as a backtracking break unit.

[0027] Step S127: Analyze the branch relationships between independent behavior evolution units within the branch evolution trajectory, extract the subsequent direction of behavior evolution of the main branch independent behavior evolution unit and the triggering conditions of behavior evolution of the sub-branch independent behavior evolution unit, compare the branch matching relationship between the two, and generate branch matching results.

[0028] When batch file processing is performed in an intelligent office collaboration system, a branching evolution trajectory is generated. The main branch's independent behavior evolution unit is the main workflow unit for batch file processing. Its subsequent behavior evolution directions include format conversion of files that meet the conditions, marking files that do not meet the conditions, and triggering an exception handling branch. The sub-branch's independent behavior evolution unit is the file format conversion branch unit. Its behavior evolution trigger condition is receiving the list of files to be converted and the target format parameters sent by the main workflow unit. The list of files to be converted and the target format information in the subsequent directions of the main workflow unit are extracted and compared with the corresponding parameters in the trigger conditions of the sub-branch format conversion unit. If the file lists of the two are completely identical and the target format parameters are the same, the branch matching relationship is established, and a branch matching success result is generated. If the file lists are partially identical or the target format parameters are different, the branch matching result is partial matching or non-matching.

[0029] Step S128: Based on the branch matching result, define the evolutionary association relationship between independent behavior evolutionary units within the branch evolution trajectory. If the branch matching result is a complete branch matching, define the fifth type of evolutionary association relationship. If the branch matching result is a partial branch matching, define the sixth type of evolutionary association relationship. If the branch matching result is no branch matching, mark it as a branch break unit.

[0030] When the branch matching result of the main branch and sub-branch unit in the branch evolution trajectory of the intelligent office collaboration system is a complete branch match, such as when all parameters related to format conversion (number of files, file type, target format, conversion priority, etc.) in the subsequent direction of the batch file processing main workflow unit are completely consistent with the triggering conditions of the file format conversion branch unit, the relationship between the two is defined as the fifth type of evolutionary association. If the branch matching result is a partial branch match, such as when the number of files and the target format match, but the conversion priority parameter is not explicitly received in the sub-branch triggering conditions, it is defined as the sixth type of evolutionary association. If the branch matching result is no branch match, such as when there is no relevant information for triggering a certain sub-branch unit in the subsequent direction of the main branch, but the sub-branch unit is triggered unexpectedly, and its triggering conditions are not related to the subsequent direction of the main branch, then the sub-branch unit is marked as a branch break unit.

[0031] Step S129: Calculate the evolution association strength corresponding to each evolution association relationship. The calculation of the evolution association strength is based on the matching frequency of independent behavior evolution units within the same trajectory and the cross association frequency of independent behavior evolution units between different trajectories. The higher the matching frequency and the higher the cross association frequency, the greater the evolution association strength.

[0032] In intelligent office collaboration systems, for the first type of evolutionary association defined in the forward evolutionary trajectory, when calculating its evolutionary association strength, the number of matches between the preceding independent behavior evolutionary unit and the following independent behavior evolutionary unit within a certain time period is counted, i.e., the matching frequency. For example, the file creation unit and the file editing unit have 100 consecutive progressive matching behaviors within a week, which is a high matching frequency. Simultaneously, it is examined whether these two units have cross-associations with other units in the reverse backtracking trajectory or the branch evolutionary trajectory. For example, does the behavior of the file editing unit trigger the log recording unit in the reverse backtracking trajectory, or the file backup unit in the branch evolutionary trajectory? The number of these cross-associations is counted, i.e., the cross-association frequency. If the cross-association frequency is also high, such as triggering log recording 20 times and file backup 15 times after file editing, then a higher evolutionary association strength value is calculated by combining the matching frequency and the cross-association frequency. For other types of evolutionary associations, such as the second and third types, the evolutionary association strength is calculated in the same way based on the matching frequency and cross-association frequency. The higher the values ​​of the matching frequency and cross-association frequency, the stronger the final evolutionary association strength.

[0033] Step S1210: Integrate the independent behavioral evolution units, evolutionary relationships, and evolutionary relationship strengths of each trajectory type to form an initial behavioral evolution trajectory model. Then, perform fracture unit repair processing on the initial behavioral evolution trajectory model. Based on the evolutionary relationship of adjacent independent behavioral evolution units, supplement the missing behavioral evolution information of the fracture units to obtain an optimized behavioral evolution trajectory model.

[0034] Step S1210: Integrate the independent behavioral evolution units, evolutionary relationships, and evolutionary relationship strengths of each trajectory type to form an initial behavioral evolution trajectory model. Then, perform fracture unit repair processing on the initial behavioral evolution trajectory model. Based on the evolutionary relationship of adjacent independent behavioral evolution units, supplement the missing behavioral evolution information of the fracture units to obtain an optimized behavioral evolution trajectory model.

[0035] Step S12101: Extract the progressive fracture units, backtracking fracture units, and branch fracture units from the initial behavior evolution trajectory model to form a fracture unit list, and record the location information of each fracture unit and the identifier of adjacent independent behavior evolution units.

[0036] A comprehensive scan of the initial behavioral evolution trajectory model was performed to identify all independent behavioral evolution units (IMUs) marked as progressive fracture units in the forward evolution trajectory, retrograde fracture units in the reverse backtracking trajectory, and branch fracture units in the branching evolution trajectory. A unique identifier was assigned to each identified fracture unit, and its specific position index within its respective trajectory was recorded, for example, between the m-th and (m+1)-th units in the forward evolution trajectory. Simultaneously, the identifiers of the preceding and following adjacent IMUs for each fracture unit were accurately recorded. If the fracture unit was located at the beginning or end of the trajectory, only the corresponding following or preceding adjacent unit identifiers were recorded. This information was systematically organized into a fracture unit list, ensuring that the basic information of each fracture unit was complete and readily available.

[0037] Step S12102: For the progressive fracture units in the fracture unit list, extract the behavioral evolution feedback information of their predecessor independent behavioral evolution units and the behavioral evolution triggering conditions of their successor independent behavioral evolution units, analyze the characteristic differences between the two, and determine the direction for supplementing the missing behavioral evolution triggering conditions and feedback information of the fracture unit.

[0038] For each progressive fracture unit in the fracture unit list, the complete behavioral evolution feedback information of its preceding independent behavioral evolution units is obtained by querying the behavioral evolution trajectory model. This information covers all output parameters, status identifiers, and result descriptions generated after the preceding unit completes execution. Simultaneously, the behavioral evolution triggering conditions necessary for the execution of its subsequent independent behavioral evolution units are obtained, including various input parameters, prerequisite state requirements, and condition judgment criteria. A dimensional feature comparison is performed on the extracted preceding feedback information and subsequent triggering conditions to identify feature dimensions present in the subsequent triggering conditions but missing in the preceding feedback information, as well as logical conflicts or numerical deviations in shared feature dimensions. Based on these feature differences, it is determined which specific condition items need to be supplemented in terms of behavioral evolution triggering conditions and which result parameters need to be supplemented in terms of behavioral evolution feedback information. This determines the overall information supplementation direction, ensuring that the supplemented fracture units can effectively connect with preceding and subsequent units.

[0039] Step S12103: Based on the supplementary direction, call the behavior evolution information supplementary library, filter the behavior evolution information that matches the features of the preceding and subsequent independent behavior evolution units, and generate the progressive fracture unit supplementary information.

[0040] For example, step S121031: extract the behavior evolution triggering conditions, behavior evolution execution instructions, behavior evolution objects, behavior evolution feedback information and evolution correlation strength of the preceding independent behavior evolution units of the progressive fracture unit to form the feature set of the preceding unit.

[0041] The preceding independent behavioral evolution units of the progressive fracture unit are broken down in detail. Each sub-condition of its behavioral evolution triggering condition, the specific operational steps of the behavioral evolution execution instruction, the type and attributes of the object affected by the behavioral evolution, and all output fields of the behavioral evolution feedback information, along with the evolutionary correlation strength values ​​between the preceding unit and the next preceding unit, are integrated into a structured feature set of the preceding unit. Each feature item in this set retains its original data type and semantic description, ensuring a comprehensive reflection of the behavioral characteristics of the preceding unit.

[0042] Step S121032: Extract the behavioral evolution triggering conditions, behavioral evolution execution instructions, behavioral evolution objects, behavioral evolution feedback information, and evolution correlation strength of the subsequent independent behavioral evolution units of the progressive fracture unit to form a feature set of the subsequent unit.

[0043] In the same way, the subsequent independent behavioral evolution units of the progressive fracture unit are decomposed, and all necessary conditions, operational flow of behavioral evolution execution instructions, specific targets of behavioral evolution, and possible output content of behavioral evolution feedback information are extracted from the behavioral evolution trigger conditions. Combined with the evolutionary correlation strength between the subsequent unit and the next subsequent unit, a feature set of the subsequent unit is constructed to ensure that the set can fully characterize the behavioral requirements and characteristics of the subsequent unit.

[0044] Step S121033: Input the feature set of the preceding unit and the feature set of the following unit into the feature matching engine of the behavior evolution information supplementary library, and set the feature matching threshold.

[0045] The constructed feature sets of preceding and succeeding units are used as input data and fed into the feature matching engine of the behavior evolution information supplementary library. In the engine, a feature matching threshold is pre-set. This threshold measures the overall matching degree between the standard behavior evolution information and the feature sets of preceding and succeeding units. Only when the matching degree reaches or exceeds this threshold will the corresponding standard behavior evolution information be included in the candidate range.

[0046] Step S121034: The feature matching engine of the behavior evolution information supplement library traverses the standard behavior evolution information stored in the library. For each piece of standard behavior evolution information, it calculates the attribute matching degree with the feature set of the preceding unit and the attribute matching degree with the feature set of the following unit, and calculates the comprehensive matching degree based on the attribute matching degree.

[0047] After the feature matching engine starts, it visits each piece of standard behavior evolution information stored in the behavior evolution information supplementary library one by one according to a preset traversal order. For the currently processed standard behavior evolution information, each of its attributes is compared with the corresponding attributes in the feature set of the preceding unit, and the attribute matching degree is calculated. This matching degree comprehensively considers the existence of attributes, data type consistency, and semantic similarity. The attribute matching degree between the standard behavior evolution information and the feature set of the following unit is calculated in the same way. Subsequently, based on the preceding and following attribute matching degrees, a preset weighted algorithm is used to calculate the comprehensive matching degree, where the weight allocation can be adjusted according to the degree of influence of the preceding and following units on the supplementary information of the fracture unit.

[0048] Step S121035: Filter the standard behavior evolution information that reaches the feature matching threshold to form a candidate supplementary information list.

[0049] After calculating the overall matching degree for all standard behavior evolution information, the feature matching engine filters out all standard behavior evolution information with an overall matching degree greater than or equal to a preset feature matching threshold, and sorts them in descending order of overall matching degree to form a candidate supplementary information list. Each candidate information in this list is accompanied by its corresponding preceding attribute matching degree, subsequent attribute matching degree, and overall matching degree value for further filtering.

[0050] Step S121036: For each piece of candidate supplementary information in the candidate supplementary information list, analyze its matching dimension with the feature set of the preceding unit and its matching dimension with the feature set of the following unit, and determine the coverage of the matching dimension.

[0051] For each piece of candidate supplementary information in the list, a thorough analysis is conducted to determine its specific feature dimensions that match the feature set of the preceding unit. Examples include a condition item in the behavior evolution triggering condition or a certain attribute of the object affected by the behavior evolution. These matching dimensions are recorded. Simultaneously, the feature dimensions that match the candidate supplementary information with the feature set of the following unit are also analyzed and recorded. Based on the recorded matching dimensions, the coverage of matching dimensions for each candidate supplementary information across the feature sets of the preceding and following units is determined; that is, which key feature dimensions of the preceding unit and which key feature dimensions of the following unit are covered.

[0052] Step S121037: Prioritize the candidate supplementary information with the widest coverage of matching dimensions and mark it as the optimal supplementary information.

[0053] For each candidate piece of information in the candidate supplementary information list, it is evaluated based on its coverage of matching dimensions. The sum of the number of preceding and following unit feature dimensions covered by each candidate piece of information is calculated, and this sum is used as an indicator of coverage breadth. The candidate supplementary information with the highest indicator value is selected and marked as the optimal supplementary information. If multiple candidate pieces of information have the same coverage breadth indicator, the process proceeds to the next step for further filtering.

[0054] Step S121038: If there are multiple candidate supplementary information with the same matching dimension coverage, compare their comprehensive matching degree with the feature sets of the preceding and following units, and select the candidate supplementary information with the highest comprehensive matching degree as the optimal supplementary information.

[0055] When two or more candidate supplementary information entries with the same matching dimension coverage appear in the candidate supplementary information list, compare the comprehensive matching degree values ​​of these candidate information entries. Select the candidate supplementary information entry with the highest comprehensive matching degree value as the optimal supplementary information. If there are still multiple candidate supplementary information entries with the highest comprehensive matching degree (in cases where the values ​​are exactly the same), further compare their attribute matching degree with the feature set of the preceding unit, and select the candidate supplementary information entry with the higher matching degree value to ensure the accuracy of the selection of the optimal supplementary information.

[0056] Step S121039: Extract the behavior evolution triggering conditions, behavior evolution execution instructions, behavior evolution target, and behavior evolution feedback information from the optimal supplementary information, as the core content of the progressive fracture unit supplementary information.

[0057] From the selected optimal supplementary information, all conditional elements included in the behavioral evolution triggering conditions, detailed operational steps and parameter settings of the behavioral evolution execution instructions, specific descriptions of the behavioral evolution target, and various output parameters of the behavioral evolution feedback information are precisely extracted. This extracted content constitutes the core of the supplementary information for the progressive fracture unit, directly used to fill the gaps in these key behavioral evolution elements of the fracture unit.

[0058] Step S1210310: Combine the evolution correlation strength of the preceding and following independent behavior evolution units, adjust the evolution correlation strength parameter of the supplementary information of the progressive fracture unit, so that the evolution correlation strength of the supplemented progressive fracture unit is logically consistent with that of the preceding and following units.

[0059] The system queries the expected values ​​of the original evolutionary correlation strength between preceding independent behavioral evolutionary units and fracture units, as well as the expected values ​​of the evolutionary correlation strength between subsequent independent behavioral evolutionary units and fracture units. Based on the characteristics of the optimal supplementary information and referring to the evolutionary correlation strength settings of similar behavioral units in the behavioral evolution information supplementary library, the evolutionary correlation strength parameters in the supplementary information of the progressive fracture unit are initially set. Then, the initial set value is compared with the expected values ​​of the evolutionary correlation strength of preceding and subsequent units, and the initial set value is fine-tuned through a preset adjustment algorithm (such as weighted average or proportional scaling) to ensure that the evolutionary correlation strength between the supplemented progressive fracture unit and the preceding unit, as well as the evolutionary correlation strength between the preceding and subsequent units, are within a reasonable range, and maintain logical continuity and consistency with the overall evolutionary correlation strength level of the preceding and following units.

[0060] Step S1210311: Integrate the core content with the adjusted evolution correlation strength parameters to generate supplementary information for progressive fracture elements.

[0061] The extracted core content (behavioral evolution triggering conditions, behavioral evolution execution instructions, behavioral evolution targets, and behavioral evolution feedback information) is organically integrated with the adjusted evolutionary correlation strength parameters. Following the preset data structure and format requirements, complete supplementary information for progressive fracture units is constructed. This ensures that all content in the supplementary information is conflict-free and complete, and that the parameter settings are reasonable, accurately reflecting the behavioral evolution characteristics that fracture units should possess.

[0062] Step S1210312: Perform logical verification on the supplementary information of the progressive fracture unit, correct any mismatches found in the logical verification, update the supplementary information of the progressive fracture unit, and generate the final supplementary information document of the progressive fracture unit.

[0063] A comprehensive check is performed on the supplementary information of the progressive fracture units using preset logical verification rules. Verification includes: the logical connection between the behavioral evolution trigger conditions and the feedback information of the preceding units, ensuring that the trigger conditions can be satisfied by the feedback information of the preceding units; the feasibility of the behavioral evolution execution instructions and their adaptability to the target object; the degree of matching between the behavioral evolution feedback information and the trigger conditions of the subsequent units; and the rationality of the evolution correlation strength parameters. If any logical mismatch, unreasonable parameters, or content conflicts are found during the verification process, targeted corrections are immediately made according to the verification prompts. After correction, logical verification is performed again until all issues are resolved, ultimately generating a verified supplementary information document for the progressive fracture units.

[0064] Step S12104: Fill the progressive fracture unit with the supplementary information of the progressive fracture unit, update the behavior evolution triggering condition, behavior evolution execution instruction and behavior evolution feedback information of the progressive fracture unit, and generate the repaired progressive unit.

[0065] Open the attribute configuration interface for the corresponding progressive fracture unit in the behavior evolution trajectory model. Enter each behavior evolution trigger condition from the supplementary information document for the progressive fracture unit into the trigger condition field of the fracture unit, ensuring the accuracy of the description and parameter settings for each condition. Similarly, enter the behavior evolution execution command and behavior evolution feedback information into their respective fields. During the entry process, simultaneously update the evolution association strength attribute of the fracture unit, setting it to the adjusted evolution association strength parameter value from the supplementary information. After completing all information entry, update the status flag of the fracture unit from "fractured" to "repaired," thus generating the repaired progressive unit.

[0066] Step S12105: For the retrospective fracture units in the fracture unit list, extract the behavioral evolution feedback information of their subsequent independent behavioral evolution units and the behavioral evolution triggering conditions of their preceding independent behavioral evolution units, analyze the characteristic differences between the two, and determine the direction for supplementing the missing behavioral evolution triggering conditions and feedback information of the fracture unit.

[0067] For each backtracking fracture unit in the fracture unit list, the behavioral evolution feedback information generated after the execution of its subsequent independent behavioral evolution units is extracted from the behavioral evolution trajectory model. This information includes all output results and state descriptions of the subsequent units. Simultaneously, the behavioral evolution triggering conditions upon which the execution of its preceding independent behavioral evolution units depends are extracted, covering various input requirements and preconditions. A detailed feature comparison analysis is performed on these two sets of information to identify feature dimensions present in the preceding triggering conditions but not included in the subsequent feedback information, as well as logical contradictions or missing information in shared feature dimensions. Based on the analysis results, the specific content of the behavioral evolution triggering conditions that need to be supplemented for the backtracking fracture unit and the necessary parameters of the behavioral evolution feedback information are clarified, and the direction of information supplementation is determined to ensure that the repaired backtracking fracture unit can correctly achieve the backtracking association between subsequent units and preceding units.

[0068] Step S12106: Based on the supplementary direction, call the behavior evolution information supplementary library, filter the behavior evolution information that matches the features of the preceding and subsequent independent behavior evolution units, and generate the backtracking fracture unit supplementary information.

[0069] Step S121061: Extract the behavioral evolution triggering conditions, behavioral evolution execution instructions, behavioral evolution objects, behavioral evolution feedback information, and evolution correlation strength of the subsequent independent behavioral evolution units of the retrospective fracture unit to form a feature set of the subsequent unit.

[0070] Referring to the method of extracting the feature sets of preceding and succeeding units during the generation of supplementary information for progressive fracture units, feature extraction is performed on the succeeding independent behavioral evolution units of the retrospective fracture unit. This involves extracting various elements of its behavioral evolution triggering conditions, the specific content of the behavioral evolution execution instructions, a detailed description of the behavioral evolution's target object, all output items of the behavioral evolution feedback information, and the evolutionary correlation strength between the succeeding unit and the next succeeding unit. This information is then integrated into a feature set for the succeeding unit.

[0071] Step S121062: Extract the behavior evolution triggering conditions, behavior evolution execution instructions, behavior evolution objects, behavior evolution feedback information, and evolution correlation strength of the preceding independent behavior evolution units of the retrospective fracture unit to form a feature set of the preceding unit.

[0072] Extract the behavioral evolution triggering conditions, behavioral evolution execution instructions, behavioral evolution objects, behavioral evolution feedback information, and evolution correlation strength of the preceding independent behavioral evolution units of the retrospective fracture unit in the same way, and construct the feature set of the preceding unit to ensure that the set can comprehensively reflect the behavioral characteristics of the preceding unit.

[0073] Step S121063: Subsequent steps refer to steps S121033 to S1210312 in the process of generating supplementary information for progressive fracture units, including inputting the feature matching engine, calculating the matching degree, filtering candidate information, determining the optimal supplementary information, extracting core content, adjusting the evolutionary correlation strength, integrating information and performing logical verification, etc., and finally generating a retrospective fracture unit supplementary information document.

[0074] Step S12107: Fill the backtracking fracture unit with the supplementary information of the backtracking fracture unit, update the behavior evolution triggering condition, behavior evolution execution instruction and behavior evolution feedback information of the backtracking fracture unit, and generate the repaired backtracking unit.

[0075] Fill in the corresponding information from the supplementary information document for the backtracking fracture unit into the attribute fields of the backtracking fracture unit in the behavior evolution trajectory model. This includes the behavior evolution triggering conditions, behavior evolution execution instructions, and behavior evolution feedback information. Also, update the evolution correlation strength parameters. After the update is complete, mark the fracture unit's status as "repaired" and generate the repaired backtracking unit.

[0076] Step S12108: For the branch fracture units in the fracture unit list, extract the subsequent direction of behavior evolution of the main branch independent behavior evolution unit and the triggering condition of behavior evolution of the sub-branch independent behavior evolution unit, analyze the characteristic differences between the two, and determine the missing behavior evolution triggering condition and the supplementary direction of the subsequent direction of the fracture unit.

[0077] For each branch fracture unit in the fracture unit list, identify its corresponding main branch independent behavior evolution unit and its corresponding sub-branch independent behavior evolution unit. Extract the subsequent behavior evolution direction information of the main branch unit, which describes the various branch directions that may be led to after the main branch unit is completed and the corresponding branch conditions. Simultaneously, extract the behavior evolution trigger conditions of the sub-branch unit, which specify the specific conditions from the main branch that must be met for the sub-branch unit to start. Analyze the characteristic differences between the subsequent directions of the main branch and the trigger conditions of the sub-branch, identifying the missing branch identifiers, parameter conditions, etc., required in the sub-branch trigger conditions, or inconsistencies in the branch logic between the two. Based on these differences, determine the behavior evolution trigger conditions and subsequent behavior evolution direction information that need to be supplemented for the branch fracture unit to achieve an effective association between the main branch and the sub-branch.

[0078] Step S12109: Based on the supplementary direction, call the behavior evolution information supplementary library, filter the behavior evolution information that matches the characteristics of the independent behavior evolution units of the main branch and sub-branch, and generate supplementary information for the branch break unit.

[0079] Step S121091: Extract the behavior evolution triggering conditions, behavior evolution execution instructions, behavior evolution target, behavior evolution feedback information, subsequent behavior evolution direction and evolution correlation strength of the main branch independent behavior evolution unit of the branch fracture unit to form the feature set of the main branch unit.

[0080] A comprehensive feature extraction is performed on the main branch independent behavioral evolution units of the branch fracture unit. In addition to the behavioral evolution triggering conditions, execution instructions, action objects, feedback information and evolution correlation strength, the focus is on extracting detailed information on the subsequent direction of behavioral evolution, including the identifier of each possible branch, branch conditions, target branch unit type, etc. All this information is integrated into the main branch unit feature set.

[0081] Step S121092: Extract the behavior evolution triggering conditions, behavior evolution execution instructions, behavior evolution objects, behavior evolution feedback information, and evolution correlation strength of the sub-branch independent behavior evolution units of the branch fracture unit to form a feature set of the sub-branch unit.

[0082] Extract various behavioral features of the sub-branch independent behavioral evolution units of the branch fracture unit, including behavioral evolution triggering conditions, execution instructions, target objects, feedback information, and evolution correlation strength, and construct a feature set of sub-branch units, paying particular attention to the parts of the triggering conditions that are related to the subsequent direction of the main branch.

[0083] Step S121093: Subsequent steps refer to steps S121033 to S1210312 in the process of generating supplementary information for progressive fracture units. The standard behavioral evolution information that matches the feature set of the main branch and sub-branch units is filtered through the feature matching engine. After multiple rounds of filtering, the optimal supplementary information is determined, the core content is extracted and the evolution correlation strength is adjusted, and finally the supplementary information document for branch fracture units is generated.

[0084] Step S121010: Fill the supplementary information of the branch fracture unit into the branch fracture unit, update the behavior evolution triggering condition, behavior evolution execution instruction and behavior evolution subsequent direction of the branch fracture unit, and generate the repaired branch unit.

[0085] Fill the corresponding attribute fields of the branch fracture unit in the behavior evolution trajectory model with the information from the supplementary information document of the branch fracture unit. Focus on updating the behavior evolution triggering conditions to match the subsequent direction of the main branch, updating the subsequent direction of behavior evolution to clarify the extension path of the sub-branch, and setting the adjusted evolution association strength. After completing the update, mark the fracture unit as "repaired" and generate the repaired branch unit.

[0086] Step S121011: Replace the corresponding fracture unit in the initial behavior evolution trajectory model with the repaired progressive unit, the repaired backtracking unit, and the repaired branch unit to generate the repaired behavior evolution trajectory model.

[0087] The process iterates through the list of fracture elements. For each fracture element for which a repair element has been generated, its location is determined in the initial behavioral evolution trajectory model. The original fracture element is then replaced with a repaired progressive element, backtracking element, or branching element. During the replacement process, it is ensured that the connection relationship between the repaired element and its adjacent elements is correctly established, and that the evolutionary association strength parameters are accurately set. After all fracture elements have been replaced, the overall repaired behavioral evolution trajectory model is generated.

[0088] Step S121012: Recalculate the evolutionary association relationships for the independent behavioral evolutionary units of each trajectory type in the repaired behavioral evolutionary trajectory model, and update the evolutionary association strength of each evolutionary association relationship.

[0089] For the forward evolution trajectory, backward regression trajectory, and branch evolution trajectory in the repaired behavioral evolution trajectory model, the evolutionary association relationships between independent behavioral evolution units within each trajectory are recalculated. For the forward evolution trajectory, the progressive matching relationship between each unit and its subsequent units is re-analyzed, and the evolutionary association strength is adjusted based on the new matching results and matching frequency. For the backward regression trajectory, the backward matching relationship between units is re-evaluated, and the backward evolutionary association strength is updated. For the branch evolution trajectory, the branch matching relationship between the main branch and sub-branch units is recalculated, and the branch evolutionary association strength is adjusted. All calculations of evolutionary association strength are based on the unit characteristics and matching situation in the current repaired model, ensuring that the strength values ​​accurately reflect the actual degree of association between units.

[0090] Step S121013: Extract the unit integrity index and correlation integrity index of the repaired behavior evolution trajectory model, compare them with the preset model integrity standard, and confirm the model repair effect.

[0091] Unit integrity indicators are extracted from the repaired behavioral evolution trajectory model. These indicators include the total number of independent behavioral evolution units in each trajectory type, the proportion of effective units (non-fractured units), and the coverage rate of each unit type. Simultaneously, correlation integrity indicators are extracted, covering the total number of evolutionary correlations in each trajectory type, the proportion of effective correlations (non-fractured correlations), and the evenness of distribution of various evolutionary correlations. These extracted indicator values ​​are then compared one by one with preset model integrity standards to check whether each indicator meets or exceeds the standard requirements. For example, whether the proportion of effective units is not lower than a preset threshold, and whether the proportion of effective correlations meets the standard.

[0092] Step S121014: If the model repair effect meets the preset standard, it is determined to be the optimized behavior evolution trajectory model; if it does not meet the standard, repeat the above fracture unit repair steps until the model repair effect meets the standard.

[0093] Based on the indicator comparison results, determine whether the repair effect of the corrected behavior evolution trajectory model meets the preset model integrity standard. If all indicators meet or exceed the standard requirements, the current corrected model is identified as the optimized behavior evolution trajectory model. If some indicators fail to meet the standard, analyze the reasons for the failure, which may be due to unrepaired broken units or insufficient supplementary information for some repaired units. For these reasons, return to the corresponding steps of broken unit repair and reprocess the non-compliant parts, such as re-screening supplementary information or adjusting correlation strength parameters. Repeat the repair process until both the unit integrity index and the correlation integrity index of the model meet the preset standard.

[0094] Step S1211: Extract the unit distribution information and evolutionary association distribution information of each trajectory type in the optimized behavior evolution trajectory model, and generate a trajectory model structure document. The trajectory model structure document is used to record the number of units of each trajectory type, the type of evolutionary association, and the distribution of evolutionary association strength.

[0095] After the optimized intelligent office collaboration system behavior evolution trajectory model is formed, the unit distribution information for each trajectory type is extracted. For example, the forward evolution trajectory includes startup-related units, file processing-related units, and resource allocation-related units, etc., and the specific number of each type of unit is counted, such as 5 startup-related units, 20 file processing-related units, and 15 resource allocation-related units. Regarding the distribution information of evolutionary relationships, the forward evolution trajectory shows 30 first-type evolutionary relationships and 10 second-type relationships; the reverse backtracking trajectory shows 15 third-type evolutionary relationships and 5 fourth-type relationships; and the branch evolution trajectory shows 25 fifth-type evolutionary relationships and 8 sixth-type relationships, etc. Simultaneously, the distribution of different evolutionary relationship strengths is recorded, such as the number of relationships in the high range (assumed to be 0.8-1.0), the medium range (0.4-0.8), and the low range (0-0.4). The above information on the number of units, the types of relationships, and the intensity distribution is compiled into a trajectory model structure document, which presents the overall structural features of the model.

[0096] Step S130: Call the pre-trained deep learning bidirectional reasoning model to perform bidirectional interactive reasoning processing on the behavior evolution trajectory model to obtain behavior reasoning results. The behavior reasoning results include behavior trend features obtained from forward evolution reasoning, behavior source features obtained from backward backtracking reasoning, and behavior abnormal branch features obtained from branch evolution reasoning.

[0097] Step S131: Convert the independent behavioral evolution units of each trajectory type in the behavioral evolution trajectory model into feature vectors. Convert the independent behavioral evolution units of the forward evolution trajectory into forward evolution feature vectors, the reverse backtracking trajectory into reverse backtracking feature vectors, and the branch evolution trajectory into branch evolution feature vectors.

[0098] In intelligent office collaboration systems, for the "file creation unit," an independent behavioral evolution unit in the forward evolution trajectory, its included behavioral evolution triggering conditions, execution instructions, target objects, and feedback information are vectorized. For example, the "user operation instruction" in the behavioral evolution triggering conditions can be converted into a vector value of a specific dimension, the "file path" can be converted into a vector through string mapping, and the "success status" in the behavioral evolution feedback information can be represented by 0 or 1 in a certain dimension. After the above processing, the file creation unit is converted into a multi-dimensional forward evolution feature vector. Similarly, for the "data synchronization failure handling unit" in the reverse backtracking trajectory, the failure reasons and related file identifiers in its feedback information are extracted and converted into a reverse backtracking feature vector; the "file format conversion branch unit" in the branch evolution trajectory is converted into a branch evolution feature vector. The dimension of each feature vector is determined according to the information dimension contained in that type of unit, ensuring that the characteristics of the independent behavioral evolution unit can be comprehensively represented.

[0099] Step S132: Input the forward evolution feature vector, the backward backtracking feature vector, and the branch evolution feature vector into the trajectory feature input layer of the deep learning bidirectional inference model, and convert the feature vectors of each trajectory type into a trajectory feature matrix of a unified dimension through feature mapping operation.

[0100] The forward evolution feature vectors, backward backtracking feature vectors, and branch evolution feature vectors obtained from the intelligent office collaboration system are input into the trajectory feature input layer of the deep learning bidirectional inference model. The trajectory feature input layer first checks the dimensionality of different types of feature vectors, finding that the forward evolution feature vectors are 200-dimensional, the backward backtracking feature vectors are 180-dimensional, and the branch evolution feature vectors are 220-dimensional. Then, through feature mapping operations, these feature vectors of different dimensions are mapped to a unified dimension, such as 300 dimensions. For feature vectors with insufficient dimensionality, they are expanded by adding zero vectors in specific dimensions or supplementing relevant feature values ​​based on semantic associations; for feature vectors with excessive dimensionality, dimensionality reduction is performed using methods such as principal component analysis to retain key feature information. After the above feature mapping operations, the three types of feature vectors are converted into 300-row (representing feature dimension) and N-column (representing the number of units) forward evolution feature matrices, backward backtracking feature matrices, and branch evolution feature matrices, respectively, achieving dimensionality unification of the feature matrices.

[0101] Step S133: Call the forward inference module of the deep learning bidirectional inference model, perform progressive trend inference operation on the forward evolution feature matrix in the trajectory feature matrix, predict the feature change direction of subsequent independent behavior evolution units based on the feature vector of the preceding independent behavior evolution unit, and generate a forward evolution trend feature sequence.

[0102] After receiving the forward evolution feature matrix of the intelligent office collaboration system, the forward inference module of the deep learning bidirectional inference model begins to execute progressive trend inference operations. Using the feature vectors of preceding independent behavior evolution units as input, such as the forward evolution feature vectors of the "file creation unit" and the "file editing unit," the model processes them through internal neural network layers. First, the feature vectors of the preceding units are input into an LSTM (Long Short-Term Memory) layer, which captures long-term dependencies in sequence data and analyzes feature change patterns from file creation to file editing. Then, a fully connected layer performs a non-linear transformation on the output of the LSTM layer to extract higher-level feature representations. Based on these feature representations, the model predicts the direction of change in each dimension of the feature vector of subsequent independent behavior evolution units, such as the "file saving unit." For example, the value of the "file size" dimension may increase, and the value of the "modification time" dimension may be updated to the current time. The predicted feature change directions of multiple subsequent units are arranged in chronological order to generate a forward evolution trend feature sequence.

[0103] Step S134: Through the reverse inference module of the deep learning bidirectional inference model, perform source tracing inference operation on the reverse backtracking feature matrix in the trajectory feature matrix, and infer the feature source of the preceding independent behavior evolution unit based on the feature vector of the subsequent independent behavior evolution unit to generate the reverse backtracking source tracing feature sequence.

[0104] The reverse inference module of the deep learning bidirectional inference model performs source tracing inference on the reverse backtracking feature matrix of the intelligent office collaboration system. Taking the reverse backtracking feature vector of the subsequent independent behavior evolution unit "data synchronization failure handling unit" as an example, this reverse backtracking feature vector contains features related to synchronization failure. The reverse inference module inputs this feature vector into the GRU (Gated Recurrent Unit) layer. The GRU layer can effectively process sequential data and capture key temporal features, analyzing the correlation between the features of failure handling behavior and the features of preceding units. Then, through the attention mechanism layer, different weights are assigned to features at different positions in the reverse backtracking feature matrix, focusing on feature dimensions related to the cause of failure. Based on these processes, the source of features of the preceding independent behavior evolution unit "data synchronization initiation unit" is inferred. For example, the "network parameter" feature dimension of the synchronization initiation unit may have anomalies, leading to synchronization failure. The source features of multiple preceding units are arranged in reverse chronological order to generate a reverse backtracking source feature sequence.

[0105] Step S135: Call the branch inference module of the deep learning bidirectional inference model, perform branch anomaly inference operation on the branch evolution feature matrix in the trajectory feature matrix, analyze the feature differences of the independent behavior evolution units of the main branch and sub-branch, identify branch features that deviate from the normal branch feature range, and generate a branch anomaly feature sequence.

[0106] When processing the branch evolution feature matrix of the intelligent office collaboration system, the branch reasoning module first separates the feature matrix of the main branch's independent behavior evolution unit and the feature matrix of each sub-branch unit. For example, the main branch's feature matrix is ​​the "batch file processing main workflow unit," and the sub-branches include feature matrices for "file format conversion branch units," "file compression branch units," etc. Then, it calculates the difference between the main branch feature matrix and each sub-branch feature matrix across various feature dimensions, such as differences in the number of files or processing time. These differences are compared to a preset normal branch feature range, which is statistically derived from the feature differences between the main branch and sub-branches during the system's historical normal operation. If the feature difference value of a sub-branch unit exceeds the normal range—for example, the processing time difference value of the file format conversion branch unit is much greater than the normal range—this feature is identified as an abnormal branch feature deviating from the normal branch feature range. All identified abnormal branch features are arranged in the order of branch appearance to generate a branch abnormal feature sequence.

[0107] Step S136: Activate the bidirectional interaction module of the deep learning bidirectional inference model, compare the forward evolution trend feature sequence with the reverse backtracking source feature sequence, extract the feature intersection region of the two, and generate a bidirectional interactive feature set.

[0108] Step S1361: Convert the forward evolution trend feature sequence and the reverse backtracking source feature sequence into feature lists with the same data structure. Each feature list contains a feature identifier, a feature value, and an identifier of the independent behavioral evolution unit corresponding to the feature.

[0109] In intelligent office collaboration systems, the forward evolution trend feature sequence was originally stored as an array, with each element containing multiple feature values. This is converted into a feature list format, where each list item contains a feature identifier, such as "file size change trend" or "processing time trend"; a feature value, i.e., the specific value of the feature in the sequence; and an identifier for the corresponding independent behavioral evolution unit, such as "file editing unit-001" or "file saving unit-002". Similarly, the reverse backtracking feature sequence is also converted into a feature list with the same structure, featuring identifiers such as "failure cause tracing" or "data source identifier," feature values ​​that are the corresponding tracing feature values, and independent behavioral evolution unit identifiers such as "data synchronization failure handling unit-003" or "log recording unit-004". This conversion gives the two feature sequences a unified data structure, facilitating subsequent interactive comparison operations.

[0110] Step S1362: Based on the independent behavior evolution unit identifier corresponding to the feature, align the unit identifiers of the two feature lists, group the positive evolution trend features and the reverse backtracking source features corresponding to the same independent behavior evolution unit identifier into one group, and generate a feature grouping list.

[0111] For the transformed forward evolution trend feature list and reverse backtracking source feature list in the intelligent office collaboration system, iterate through the independent behavioral evolution unit identifiers corresponding to the features. For example, if a feature item in the forward evolution trend feature list has a unit identifier of "File Editing Unit-001", search the reverse backtracking source feature list for a matching unit identifier. If found, group these two feature items together. Assuming the reverse backtracking source feature list also has a feature item with the unit identifier "File Editing Unit-001", this feature item might be a source feature associated with the file editing unit during the reverse backtracking process. Combine these two feature items from different sequences but with the same unit identifier to form a feature group. Perform the above operation on all feature list items, classifying all feature items with the same unit identifier, generating a feature grouping list. Each group contains both forward and reverse features for the same unit identifier.

[0112] Step S1363: For each feature group in the feature grouping list, calculate the numerical similarity between the forward evolution trend feature and the reverse backtracking source feature, record the feature groups whose similarity reaches a preset threshold, and generate a target feature group list.

[0113] For each feature group in the feature grouping list of the intelligent office collaboration system, such as a group containing the forward evolution trend feature and the reverse backtracking feature of "File Editing Unit-001", the numerical similarity between the two is calculated. During the calculation, for each corresponding feature dimension of the forward and reverse features in the feature group, the degree of difference in their values ​​is calculated, using methods such as cosine similarity or Euclidean distance. Assuming the value of the "File Modification Frequency" dimension of the forward feature is 0.8 (after normalization), and the value of the same dimension of the reverse feature is 0.75, the similarity between these two values ​​is calculated. The similarity of all dimensions is combined to obtain the overall numerical similarity of the feature group. A preset similarity threshold, such as 0.7, is set. Feature groups with a similarity of 0.7 or higher are recorded. For example, the similarity of the "File Editing Unit-001" feature group is 0.85, reaching the threshold, and is then added to the target feature group list.

[0114] Step S1364: Extract the common feature dimension of each group of features in the target feature group list, determine the dimension range of the feature intersection region, and generate a feature intersection dimension table.

[0115] In the target feature group list of the intelligent office collaboration system, each feature group is selected for common feature dimension analysis. For example, in a high-similarity feature group, the positive evolution trend feature includes three feature dimensions: "file size," "processing time," and "operation frequency." The reverse backtracking feature also includes these three feature dimensions; these three dimensions are the common feature dimensions. The above analysis is performed on all high-similarity feature groups to identify the most frequently occurring common feature dimensions, such as "file size," "processing time," "operation frequency," and "resource utilization." The dimensional range of these common feature dimensions is determined, i.e., the dimensional range of the feature intersection region. For example, dimensions 1 to 10 correspond to the aforementioned common feature dimensions. These common feature dimensions and their corresponding dimensional ranges are recorded to generate a feature intersection dimension table. This table clarifies which dimensions are the intersection regions of positive and negative features.

[0116] Step S1365: Based on the feature intersection dimension table, extract the feature values ​​of the corresponding dimensions from the high similarity feature groups to form a feature intersection value set.

[0117] Based on the feature intersection dimension table of the intelligent office collaboration system, for example, "file size" corresponds to dimension 1, "processing time" corresponds to dimension 2, and "operation frequency" corresponds to dimension 3. Iterate through each feature group in the target feature group list. For each feature group, extract the feature values ​​of dimension 1, dimension 2, and dimension 3 from the forward evolution trend features and the backward tracing source features. For example, in a certain feature group, the dimension 1 value of the forward feature is A1, dimension 2 is A2, and dimension 3 is A3, and the dimension 1 value of the backward feature is B1, dimension 2 is B2, and dimension 3 is B3. Extract these values ​​A1, A2, A3, B1, B2, and B3 as the feature values ​​of this feature group in the feature intersection region. Summarize the feature values ​​extracted from all highly similar feature groups to form a feature intersection value set.

[0118] Step S1366: Perform deduplication on the feature values ​​in the feature intersection value set, retain the unique feature values, and generate the deduplicated feature intersection set.

[0119] The feature intersection set of an intelligent office collaboration system may contain duplicate feature values. For example, two different high-similarity feature groups may both extract the value 500 (assuming the unit is KB) in the "file size" dimension (dimension 1), and these two values ​​are duplicates. The system iterates through all feature values ​​in the feature intersection set, comparing whether each value already exists in a temporary set. If it does not exist, it is added to the temporary set; if it already exists, it is skipped. After this deduplication process, the temporary set contains only unique feature values. This temporary set is then determined as the deduplicated feature intersection set, avoiding redundant calculations caused by duplicate values ​​in subsequent analysis.

[0120] Step S1367: Assign a corresponding feature identifier and an independent behavior evolution unit identifier to each feature value in the deduplicated feature intersection set to form a structured bidirectional interactive feature set.

[0121] In intelligent office collaboration systems, for each feature value in the deduplicated feature intersection set, a corresponding feature identifier and independent behavior evolution unit identifier are determined based on the high similarity feature group from which it originates. For example, if a feature value originates from the "file size" dimension of the "file editing unit-001" feature group, then the feature identifier "file size" and the independent behavior evolution unit identifier "file editing unit-001" are assigned to that value. Combining this information with the feature value forms a structured data item containing the feature identifier, independent behavior evolution unit identifier, and feature value. Integrating all these data items forms a structured bidirectional interactive feature set, where each element has clear identification information, facilitating subsequent correlation analysis and processing.

[0122] Step S1368: Sort the features in the two-way interaction feature set, arrange the features in the chronological order of the independent behavior evolution units, and generate an ordered two-way interaction feature set.

[0123] Extract the identification of the independent behavior evolution unit corresponding to each feature in the two-way interaction feature set of the intelligent office collaboration system. Query the behavior evolution period of this independent behavior evolution unit during the system operation according to this identification, and obtain its start time. Then, sort all the features in the two-way interaction feature set according to the chronological order of the start time. For example, the start time of the "file creation unit - 005" is t1, and the start time of the "file editing unit - 001" is t2, and t1 < t2, then the feature corresponding to the "file creation unit - 005" is arranged before the feature corresponding to the "file editing unit - 001". Through the above sorting operation, an ordered two-way interaction feature set is generated, making the features in the feature set arranged in the chronological order of the system behavior occurrence, which is more in line with the logical order of behavior evolution.

[0124] Step S1369: Extract the feature association relationships in the ordered two-way interaction feature set, record the numerical change trends between adjacent features, and generate a feature change trend table.

[0125] In the ordered two-way interaction feature set of the intelligent office collaboration system, analyze the association relationships between adjacent features. For example, the previous feature is the "file size" feature of the "file creation unit - 005", and the value is A; the next feature is the "file size" feature of the "file editing unit - 001", and the value is B. Compare the sizes of A and B to determine whether the numerical change trend is increasing, decreasing or remaining unchanged. If B > A, the change trend is increasing; if B < A, it is decreasing; if B = A, it is remaining unchanged. For all adjacent feature pairs in the ordered two-way interaction feature set, perform the above numerical change trend analysis, and record the feature identification, the value of the previous feature, the value of the subsequent feature and the change trend of each feature pair. Organize the above records into a feature change trend table, which can show the change situation of features in the time series.

[0126] Step S13610: Integrate the ordered two-way interaction feature set and the feature change trend table to form a two-way interaction feature set document; check the integrity of the features in the two-way interaction feature set document, and supplement the missing feature identification and independent behavior evolution unit identification information to make each feature have associated information.

[0127] The ordered two-way interactive feature set and feature change trend table of the intelligent office collaboration system are integrated into a single document to form a two-way interactive feature set document. This document contains both feature data arranged in chronological order and analysis of the changing trends between features. Then, a completeness check is performed on the features in the document, traversing each feature to check if it contains complete feature identifiers and independent behavioral evolution unit identifiers. If a feature is found to be missing an identifier, it is supplemented by querying the feature's source feature group and feature intersection dimension table. If an independent behavioral evolution unit identifier is missing, the corresponding unit identifier is determined and supplemented based on its position in the ordered set and its relationship with other features. This ensures that each feature in the document has complete association information, improving the document's usability and accuracy.

[0128] Step S137: Perform correlation analysis between the bidirectional interaction feature set and the branch anomaly feature sequence to determine the corresponding position of the branch anomaly feature in the bidirectional interaction feature set and mark the anomaly correlation feature unit.

[0129] A correlation analysis is performed between the bidirectional interaction feature set and the branch anomaly feature sequence of the intelligent office collaboration system. Each branch anomaly feature in the branch anomaly feature sequence is traversed, and its feature identifier, feature value, and corresponding independent behavior evolution unit identifier are extracted. Then, features with the same independent behavior evolution unit identifier are searched in the bidirectional interaction feature set. For example, if a feature in the branch anomaly feature sequence corresponds to the unit identifier "file format conversion branch unit-006", the feature item corresponding to this unit identifier is found in the bidirectional interaction feature set. Next, the feature values ​​of the branch anomaly feature and the feature item of this unit identifier in the bidirectional interaction feature set are compared to determine the specific position of the branch anomaly feature in the bidirectional interaction feature set, i.e., the index position of this feature item in the ordered set. After finding the corresponding position, the feature unit at that position is marked as an anomaly-related feature unit, indicating that this unit is associated with the branch anomaly feature.

[0130] Step S138: Through the feature enhancement module of the deep learning bidirectional inference model, perform feature enhancement operation on the abnormal association feature unit to enhance the feature expression of the abnormal association feature unit and generate enhanced abnormal association features.

[0131] After receiving anomaly-related feature units marked in the intelligent office collaboration system, the feature enhancement module of the deep learning bidirectional inference model performs feature enhancement operations on them. First, it analyzes the distribution of the anomaly-related feature unit in the feature space to determine its differences from other normal feature units. Then, by increasing the weight of the anomaly-related feature unit on key feature dimensions, such as "abnormality level" and "impact range," its features become more prominent in the overall feature set. Simultaneously, by combining the anomaly information related to the unit in the branch anomaly feature sequence, the feature values ​​of the anomaly-related feature unit are adjusted to enhance its anomalous feature expression. For example, if the branch anomaly features indicate that the unit has a "processing timeout" anomaly, the feature value of the unit on the "processing time" feature dimension is adjusted to a value that better reflects the timeout level. After the above feature enhancement operations, enhanced anomaly-related features are generated, with more obvious anomalous characteristics, facilitating subsequent feature fusion and extraction.

[0132] Step S139: Call the feature fusion module of the deep learning bidirectional inference model to fuse the forward evolution trend feature sequence, the reverse backtracking source feature sequence and the enhanced abnormal correlation features to generate a fused feature matrix.

[0133] The feature fusion module begins processing the forward evolution trend feature sequence, the reverse backtracking source feature sequence, and the enhanced anomaly correlation features of the intelligent office collaboration system. First, the forward evolution trend feature sequence and the reverse backtracking source feature sequence are converted into feature matrix forms, namely the forward trend matrix and the reverse backtracking source matrix, respectively. The enhanced anomaly correlation features are single enhanced feature vectors, which are expanded into a single-column matrix. Then, a concatenation method is used for fusion processing, concatenating the forward trend matrix, the reverse backtracking source matrix, and the enhanced anomaly feature matrix column-wise to form a new fused feature matrix. During concatenation, it is ensured that the three matrices maintain a consistent number of rows, i.e., the same feature dimension, by arranging the column vectors of the three matrices sequentially along the column direction of the matrix to achieve feature fusion. For example, if the forward trend matrix is ​​300 rows and 50 columns, the reverse backtracking source matrix is ​​300 rows and 40 columns, and the enhanced anomaly feature matrix is ​​300 rows and 5 columns, the resulting fused feature matrix is ​​300 rows and 95 columns, integrating the feature information of the three sequences.

[0134] Step S1310: Through the feature extraction module of the deep learning bidirectional reasoning model, extract the behavioral trend features corresponding to forward evolution reasoning, the behavioral source features corresponding to backward reasoning, and the behavioral abnormal branch features corresponding to branch evolution reasoning from the fused feature matrix.

[0135] The feature extraction module of the deep learning bidirectional inference model processes the fusion feature matrix of the intelligent office collaboration system. This feature extraction module contains multiple convolutional layers and pooling layers. First, a convolutional kernel is used to perform a convolution operation on the fusion feature matrix to extract local feature information. For example, the first convolutional layer uses a 3x3 convolutional kernel to perform a sliding window calculation on the fusion feature matrix, generating multiple convolutional feature maps, and each convolutional feature map corresponds to a different local feature pattern. Then, the pooling layer downsamples the convolutional feature maps to retain key features and reduce the data volume. After being processed by multiple convolutional and pooling layers, the obtained high-level features are input into the fully connected layer. The fully connected layer extracts the behavior trend features related to forward evolution inference, the behavior traceability features related to backward traceback inference, and the behavior anomaly branch features related to branch evolution inference respectively according to the preset task objectives. The behavior trend features are mainly extracted from the region related to the forward evolution trend in the fusion feature matrix, reflecting the development direction of the system behavior; the behavior traceability features are extracted from the region related to backward traceback, used to trace the source of the behavior; and the behavior anomaly branch features are extracted from the region containing enhanced anomaly association features to identify the features of the anomaly branch.

[0136] Step S1311: Perform a consistency verification operation on the features obtained from different inference directions in the time dimension and the module association dimension, and generate a behavior inference result that passes the verification.

[0137] In the intelligent office collaboration system, consistency verification is performed on the extracted behavior trend features, behavior traceability features, and behavior anomaly branch features. In the time dimension, check whether the predicted subsequent behavior time in the behavior trend features is coherent on the time axis with the inferred previous behavior time in the behavior traceability features and whether there are time conflicts. For example, the behavior trend features predict that the "file saving unit" will execute at time t5, while the behavior traceability features infer that the previous "file editing unit" of this file saving behavior ends at time t6, and t5 < t6, resulting in a time conflict. At this time, this inconsistent point needs to be marked. In the module association dimension, check whether the module corresponding to the behavior anomaly branch features has a reasonable association relationship with the relevant modules in the behavior trend features or the behavior traceability features. For example, the behavior anomaly branch features belong to the "file format conversion module", while the "file format conversion module" is not triggered during this period in the behavior trend features, and the module association between the two is inconsistent. Analyze and correct the discovered inconsistent points, and剔除 the relevant features if they cannot be corrected. After the consistency verification, retain the features that pass the verification and generate a behavior inference result that passes the verification.

[0138] Step S1312: Extract the feature association relationships in the behavior inference result that passes the verification, and generate a feature association graph document, which is used to record the association paths between the behavior trend features, the behavior traceability features, and the behavior anomaly branch features.

[0139] From the behavioral reasoning results validated by the intelligent office collaboration system, the relationships between behavioral trend features, behavioral source features, and behavioral anomaly branch features are extracted. For example, the behavioral anomaly branch feature "format conversion timeout" is associated with the behavioral trend feature "drastic increase in file size," because excessively large files may cause conversion timeouts. Simultaneously, this anomaly branch feature is also associated with the behavioral source feature "original file source module A," because files provided by source module A may have format incompatibility issues. These relationships are recorded in the form of a graph, with each feature as a node and the relationships between features as edges between nodes, and the type of relationship is labeled (e.g., causal relationship, dependency relationship, etc.). A feature association graph document is generated, which displays the complex association paths between features in different reasoning directions.

[0140] Step S140: Construct an abnormal behavior verification module combination based on the behavior reasoning results. The abnormal behavior verification module combination includes a trend feature verification module, a source feature verification module, a branch feature verification module, a cross-module collaborative verification module, and a verification result feedback module. Each module collaboratively outputs the abnormal behavior verification results.

[0141] Step S141: Extract the behavioral trend features from the behavioral reasoning results, input them into the trend feature verification module of the abnormal behavior verification module combination, the trend feature verification module loads the preset normal behavior trend feature library, compares the input behavioral trend features with the features in the normal behavior trend feature library, and generates trend feature comparison results.

[0142] In intelligent office collaboration systems, behavioral trend features in behavioral reasoning results include multiple features such as "file processing speed trend" and "resource utilization trend." These behavioral trend features are input into the trend feature verification module. The trend feature verification module loads a pre-set normal behavioral trend feature library, which stores trend feature data for various behaviors under normal system operation, such as "normal range of file processing speed" and "normal fluctuation range of CPU utilization." For the input "file processing speed trend" feature, the module compares its speed value at each time point with the normal range of file processing speed for the same file type and operating scenario in the normal behavioral trend feature library to determine whether the speed value at each time point is within the normal range. Similarly, a similar comparison is performed for other behavioral trend features such as "resource utilization trend." The comparison results are recorded; feature points within the normal range are marked as "normal," and those outside the range are marked as "abnormal," generating trend feature comparison results.

[0143] Step S142: Based on the trend feature comparison results, mark abnormal trend features that deviate from the normal trend feature range, record the independent behavior evolution unit identifier and time period information corresponding to the abnormal trend features, and generate trend anomaly verification sub-results.

[0144] Based on the trend feature comparison results of the intelligent office collaboration system, feature points marked as "abnormal" are selected. The behavioral trend features corresponding to these feature points are abnormal trend features that deviate from the normal trend feature range. For example, if the speed value of "file processing speed trend" is consistently lower than the lower limit of the normal range during the time period t10-t15, the behavioral trend feature corresponding to this time period is an abnormal trend feature. Then, the independent behavioral evolution unit identifier corresponding to this abnormal trend feature is extracted. By querying the mapping relationship between behavioral trend features and unit identifiers, it is determined that "file compression unit-007" caused this abnormal trend. At the same time, the time period information of the occurrence of this abnormal trend feature, i.e., t10-t15, is recorded. The description of the abnormal trend feature, the corresponding independent behavioral evolution unit identifier, and the time period information are integrated together to generate a trend anomaly verification sub-result.

[0145] Step S143: Extract the behavioral source traceability features from the behavioral reasoning results, input them into the source traceability feature verification module of the abnormal behavior verification module combination, the source traceability feature verification module loads the preset normal behavior source traceability feature library, compares the input behavioral source traceability features with the features in the normal behavior source traceability feature library, and generates source traceability feature comparison results.

[0146] Behavioral tracing features, such as "data synchronization failure tracing features" and "error log tracing features," are extracted from the behavioral reasoning results of the intelligent office collaboration system and input into the tracing feature verification module. The tracing feature verification module loads a pre-set normal behavior tracing feature library, which contains tracing feature templates for various behaviors during normal system operation, such as "source path of normal data synchronization" and "log recording format of common errors." For "data synchronization failure tracing features," the module compares the failed data source path and node information during the synchronization process it contains with the "source path of normal data synchronization" template in the normal behavior tracing feature library to check whether the path conforms to the specifications and whether the node information is complete and normal. For "error log tracing features," the module compares whether the log format and error code are within the normal expected range. Based on the comparison results, a tracing feature comparison result is generated, marking whether each tracing feature is normal.

[0147] Step S144: Based on the source tracing feature comparison results, mark abnormal source tracing features that deviate from the normal source tracing feature range, record the independent behavior evolution unit identifier and module association information corresponding to the abnormal source tracing features, and generate source tracing anomaly verification sub-results.

[0148] Based on the source tracing feature comparison results of the intelligent office collaboration system, abnormal source tracing features that deviate from the normal source tracing feature range are marked. For example, in the "data synchronization failure source tracing feature," the data source path contains an unauthorized external IP address, which does not match the path template in the normal behavior source tracing feature library; this source tracing feature is therefore an abnormal source tracing feature. The independent behavior evolution unit identifier "Data Synchronization Unit-008" corresponding to this abnormal source tracing feature, as well as the module association information, namely the "Network Communication Module" and "Access Verification Module" associated with this data synchronization unit, are recorded. The detailed description of the abnormal source tracing feature, the independent behavior evolution unit identifier, and the module association information are integrated to generate a source tracing anomaly verification sub-result.

[0149] Step S145: Extract the abnormal branch features from the behavior reasoning results, input them into the branch feature verification module of the abnormal behavior verification module combination, the branch feature verification module loads the preset normal behavior branch feature library, compares the input abnormal branch features with the features in the normal behavior branch feature library, and generates branch feature comparison results.

[0150] Extract abnormal branch features from the behavioral reasoning results of the intelligent office collaboration system, such as "abnormal branch features for file format conversion" and "abnormal branch features for parallel task processing," and input them into the branch feature verification module. The branch feature verification module loads a pre-set normal behavior branch feature library, which stores feature parameters of normal branch behaviors in the system, such as "normal time range for file format conversion" and "normal resource allocation ratio for parallel tasks." Compare the time consumption and conversion power parameters in the "abnormal branch features for file format conversion" with the corresponding parameter ranges in the normal behavior branch feature library to determine if they are within the normal range. A similar comparison is performed on the resource allocation of the "abnormal branch features for parallel task processing," generating branch feature comparison results and marking abnormal parameters.

[0151] Step S146: Based on the branch feature comparison results, confirm the degree of abnormality of the abnormal branch features, record the main branch and sub-branch unit identifiers and branch association strengths corresponding to the abnormal branch features, and generate a branch anomaly verification sub-result.

[0152] Based on the branch feature comparison results of the intelligent office collaboration system, the degree of abnormality of the abnormal branch features is confirmed. For example, if the time consumption of the "file format conversion abnormal branch feature" exceeds the normal range by 50%, its degree of abnormality is assessed as "moderate abnormality"; if the conversion success rate is 0%, it is assessed as "severe abnormality". The overall degree of abnormality of the abnormal branch feature is determined by combining various parameters. Then, the main branch unit identifier corresponding to the abnormal branch feature is recorded, such as "batch file processing main process unit-009", the sub-branch unit identifier "file format conversion branch unit-006", and the branch association strength value between them, which is obtained from the previously calculated evolutionary association strength. The abnormality assessment results, the main branch and sub-branch unit identifiers, and the branch association strength are integrated to generate a branch abnormality verification sub-result.

[0153] Step S147: Activate the cross-module collaborative verification module of the abnormal behavior verification module combination, cross-correlate the trend abnormal verification sub-result, the source abnormal verification sub-result, and the branch abnormal verification sub-result, extract the common abnormal unit identifier in the trend abnormal verification sub-result, the source abnormal verification sub-result, and the branch abnormal verification sub-result, and generate a cross-correlated abnormal unit list.

[0154] Step S1471: Extract the independent behavior evolution unit identifiers corresponding to the abnormal trend features from the trend anomaly verification sub-results, form a trend anomaly unit list, and record the abnormal time period information corresponding to each unit identifier.

[0155] In the intelligent office collaboration system, the trend anomaly verification sub-result contains multiple anomaly trend feature entries, each with a corresponding independent behavior evolution unit identifier and anomaly time period information. These entries are traversed to extract the independent behavior evolution unit identifiers, such as "File Compression Unit-007" and "Data Transmission Unit-010," and these identifiers are organized into a trend anomaly unit list. Simultaneously, the corresponding anomaly time period information is recorded for each unit identifier; for example, the anomaly time period for "File Compression Unit-007" is t10-t15, and the anomaly time period for "Data Transmission Unit-010" is t12-t18, etc.

[0156] Step S1472: Extract the independent behavior evolution unit identifiers corresponding to the anomaly tracing features from the anomaly tracing verification sub-results, form a list of anomaly tracing units, and record the anomaly module association information corresponding to each unit identifier.

[0157] The anomaly verification sub-result contains anomaly tracing features and their corresponding independent behavioral evolution unit identifiers and module association information. The independent behavioral evolution unit identifiers, such as "Data Synchronization Unit-008" and "Log Recording Unit-004," are extracted to form a list of anomaly tracing units. For each unit identifier, its corresponding anomaly module association information is recorded; for example, "Data Synchronization Unit-008" is associated with both the "Network Communication Module" and the "Access Verification Module," and "Log Recording Unit-004" is associated with the "Storage Module." This ensures that each unit identifier in the anomaly tracing unit list includes detailed module association information, facilitating correlation analysis with other anomaly unit lists.

[0158] Step S1473: Extract the independent behavior evolution unit identifiers corresponding to the abnormal branch features from the branch anomaly verification sub-results, form a branch anomaly unit list, and record the abnormal branch association information corresponding to each unit identifier.

[0159] The branch anomaly verification sub-result contains information such as the main branch and sub-branch unit identifiers corresponding to the anomaly branch characteristics, as well as the branch association strength. The independent behavior evolution unit identifiers are extracted, including main branch unit identifiers and sub-branch unit identifiers, such as "Batch File Processing Main Flow Unit-009" and "File Format Conversion Branch Unit-006," forming a branch anomaly unit list. The anomaly branch association information corresponding to each unit identifier is recorded, such as the association strength between "File Format Conversion Branch Unit-006" and the main branch unit, and the triggering conditions for the anomaly branch. This ensures that the unit identifiers in the branch anomaly unit list accurately correspond to the anomaly branch association information.

[0160] Step S1474: Input the trend abnormal unit list, the source abnormal unit list, and the branch abnormal unit list into the unit identifier comparison engine of the cross-module collaborative verification module, and perform unit identifier intersection calculation.

[0161] After receiving the list of trend-abnormal units, the list of source-abnormal units, and the list of branch-abnormal units from the intelligent office collaboration system, the unit identifier comparison engine of the cross-module collaborative verification module begins to perform unit identifier intersection calculation. The engine first stores the unit identifiers from the three lists into three sets, for example, set A (trend abnormality), set B (source-abnormality), and set C (branch abnormality). Then, it calculates the intersection of these three sets, that is, it finds the unit identifiers that appear simultaneously in set A, set B, and set C. For example, if the unit identifier "Document Processing Integrated Unit-011" appears in all three lists, then this identifier is identified as an intersection element. Through the above set operations, the intersection results of the unit identifiers are obtained. These intersection elements are the independent behavioral evolution unit identifiers that appear in all three types of anomaly verification sub-results.

[0162] Step S1475: Identify independent behavior evolution unit identifiers that exist simultaneously in the trend anomaly unit list, the source anomaly unit list, and the branch anomaly unit list, mark them as common anomaly unit identifiers, and record the number of times each common anomaly unit identifier appears in the trend anomaly unit list, the source anomaly unit list, and the branch anomaly unit list.

[0163] After calculating the intersection results, the unit identifier comparison engine identifies independent behavioral evolution unit identifiers that simultaneously exist in all three abnormal unit lists of the intelligent office collaboration system, marking these identifiers as common abnormal unit identifiers. For example, "Document Processing Comprehensive Unit-011" appears once in the trend abnormal unit list, once in the source tracing abnormal unit list, and once in the branch abnormal unit list, recording its occurrence count as 3 times. For each common abnormal unit identifier, the number of times it appears in the three lists is accurately recorded; the more times it appears, the more obvious the abnormal behavior of the unit in different dimensions.

[0164] Step S1476: For the common abnormal unit identifier, extract its abnormal time period information in the trend abnormal unit list, abnormal module association information in the source tracing abnormal unit list, and abnormal branch association information in the branch abnormal unit list to form a common abnormal unit information table.

[0165] For common abnormal unit identifiers marked in the intelligent office collaboration system, such as "File Processing Integrated Unit-011", its abnormal time period information, such as t8-t20, is extracted from the trend abnormal unit list; its abnormal module association information is extracted from the source-tracing abnormal unit list, such as association with "File Parsing Module" and "Memory Management Module"; and its abnormal branch association information is extracted from the branch abnormal unit list, such as being associated as a sub-branch with "Batch Task Scheduling Main Unit-012", with an association strength of 0.6. This information is integrated into an information table, with each common abnormal unit identifier corresponding to one row, and columns including unit identifier, abnormal time period, abnormal module association information, and abnormal branch association information, forming a common abnormal unit information table that displays various abnormal-related information for common abnormal units.

[0166] Step S1477: Based on the common abnormal unit information table, arrange the common abnormal unit identifiers in chronological order of abnormal time periods to generate a cross-related abnormal unit list, and extract the unit identifiers and corresponding abnormal information from the cross-related abnormal unit list to generate a detail document of the cross-related abnormal units. The detail document is used to record the complete abnormal information of each common abnormal unit.

[0167] Based on the abnormal time period information of each common abnormal unit identifier in the common abnormal unit information table of the intelligent office collaboration system, the unit identifiers are arranged in chronological order of the start time of the abnormal time period. For example, if the abnormal time period start time of "File Processing Integrated Unit-011" is t8 and the start time of "Data Transmission Integrated Unit-013" is t10, then "File Processing Integrated Unit-011" is placed first. A cross-linked abnormal unit list is generated in the above order. Then, for each unit identifier in the list, all its abnormal information is extracted from the common abnormal unit information table, including abnormal time period, abnormal module association information, abnormal branch association information, etc., to generate a detailed document of the cross-linked abnormal unit. This detailed document establishes a detailed abnormal file for each common abnormal unit, recording its complete abnormal information.

[0168] Step S148: For each abnormal unit in the cross-correlation abnormal unit list, integrate its abnormal description information in the trend abnormality verification sub-result, the source abnormality verification sub-result, and the branch abnormality verification sub-result to form an abnormal unit comprehensive description document.

[0169] For each anomalous unit in the cross-correlation anomaly unit list of the intelligent office collaboration system, such as "File Processing Comprehensive Unit-011," the abnormal trend characteristics are described from the trend anomaly verification sub-results, such as "file compression speed is consistently 30% lower than the normal range"; the abnormal source characteristics are described from the source tracing anomaly verification sub-results, such as "compressed file source path contains uncertified nodes"; and the abnormal branch characteristics are described from the branch anomaly verification sub-results, such as "when acting as a sub-branch, the resource allocation ratio deviates from the main branch by 20%." These anomaly descriptions from different verification sub-results are integrated and categorized according to anomaly type (trend anomaly, source tracing anomaly, branch anomaly) to form a comprehensive description document for the anomalous unit. The document details the anomalous behavior of the unit in various aspects, enabling relevant personnel to fully understand the anomaly situation of the unit.

[0170] Step S149: Call the verification result feedback module of the abnormal behavior verification module combination, and feed back the comprehensive description document of the abnormal unit to the behavior evolution trajectory model optimization stage to supplement the behavior evolution information of the abnormal unit to the trajectory model.

[0171] The verification result feedback module of the abnormal behavior verification module sends the comprehensive description document of the abnormal units of the intelligent office collaboration system to the behavior evolution trajectory model optimization stage. Upon receiving the document, the behavior evolution trajectory model optimization stage extracts key information from the abnormal description of each abnormal unit recorded in the document, such as "File Processing Comprehensive Unit-011," including abnormal triggering conditions (unverified file source), abnormal execution instructions (incorrect compression algorithm selection), abnormal target (specific format file), and abnormal feedback information (compression failure message). This abnormal behavior evolution information is then added to the corresponding attribute fields of the abnormal unit in the behavior evolution trajectory model, updating the behavior evolution information of that unit in the model and enabling the behavior evolution trajectory model to more accurately reflect the abnormal behavior patterns of the system.

[0172] Step S1410: Based on the supplemented behavior evolution trajectory model, re-execute the local bidirectional interactive reasoning process to verify whether the abnormal characteristics of the abnormal unit persist and generate a secondary verification result.

[0173] Based on the behavior evolution trajectory model of the intelligent office collaboration system supplemented with abnormal behavior evolution information, a deep learning bidirectional reasoning model is initiated to perform bidirectional interactive reasoning processing on the local trajectory where the abnormal unit is located. For example, for "Document Processing Integrated Unit-011" and its related independent behavior evolution units, forward evolution trend reasoning, reverse backtracking source reasoning, and branch anomaly reasoning are re-executed. The characteristics of the abnormal unit in the reasoning results are analyzed to see if they still exhibit abnormal trends, abnormal source traceability, or abnormal branch characteristics. If the abnormal characteristics of the abnormal unit still exist after re-reasoning, it indicates that the anomaly is persistent; if the abnormal characteristics disappear or weaken, it indicates that the anomaly may be temporary or influenced by other factors. The verification results are recorded to generate secondary verification results, which serve as an important component of the final abnormal behavior verification results.

[0174] Step S1411: Integrate the trend anomaly verification sub-result, the source anomaly verification sub-result, the branch anomaly verification sub-result, and the secondary verification result to form the anomaly behavior verification result.

[0175] The trend anomaly verification sub-results, source tracing anomaly verification sub-results, branch anomaly verification sub-results, and secondary verification results of the intelligent office collaboration system are integrated. First, the anomaly unit information from the four results is merged. For the same anomaly unit, its anomaly descriptions and verification status in different sub-results are combined. For example, if "Document Processing Integrated Unit-011" is marked as anomaly in the trend anomaly sub-result, and the secondary verification result also confirms its continued anomaly, then the anomaly conclusion for this unit is reinforced during integration. For conflicting results, such as a unit being anomaly in the trend anomaly sub-result but normal in the secondary verification result, further analysis of the cause is required. If the cause cannot be determined, both results are retained and marked as conflicting. After integration, a single anomaly behavior verification result containing all anomaly information, the verification process, and the final conclusion is formed.

[0176] Step S1412: Extract key abnormal information from the abnormal behavior verification results and generate an abnormal verification summary document. The abnormal verification summary document is used to summarize the type, scope and verification basis of the abnormal behavior.

[0177] Key anomaly information is extracted from the verification results of abnormal behaviors in the intelligent office collaboration system. This includes the type of abnormal behavior, such as "trend anomaly," "source anomaly," "branch anomaly," and "comprehensive anomaly"; the scope of the abnormal behavior, including the number of independent behavioral evolution units involved, the number of application modules involved, and the time span of the anomaly occurrence; and the verification basis, such as trend feature comparison results, source feature comparison results, and secondary verification results. This key information is then compiled into a concise and clear anomaly verification summary document. The document structure includes an overview of the anomaly types, statistics on the anomaly scope, a list of major anomaly units, and a summary of the verification basis. This summary document allows relevant personnel to quickly understand the overall situation of the abnormal behavior and the basis for verification.

[0178] Step S150: Generate a computer application behavior dynamic analysis report based on the abnormal behavior verification results. The computer application behavior dynamic analysis report includes details of the behavior evolution corresponding to the abnormal behavior branch features, the correlation between forward and reverse reasoning features, the propagation path of the abnormal behavior in the evolution trajectory, and the application operation environment information at the stage of the abnormal occurrence.

[0179] Step S151: Integrate the independent behavior evolution unit information corresponding to the abnormal behavior branch features in the trend abnormality verification sub-result, the source abnormality verification sub-result, and the branch abnormality verification sub-result in the abnormal behavior verification results to generate an abnormal behavior unit list.

[0180] In intelligent office collaboration systems, the three sub-results of abnormal behavior verification all contain information on independent behavioral evolution units related to the branch characteristics of abnormal behavior. In the trend anomaly verification sub-result, some abnormal trend characteristics are related to branch behaviors, such as "branch task resource preemption causing delays in main process processing"; in the source tracing anomaly verification sub-result, some abnormal source tracing characteristics point to the abnormal source of the branch behavior; and the branch anomaly verification sub-result directly contains the unit information corresponding to the abnormal branch characteristics. Integrating this information, all independent behavioral evolution unit identifiers related to the branch characteristics of abnormal behavior are extracted, and duplicate identifiers are removed to form a list of abnormal behavior units. For example, the list includes unit identifiers such as "File Format Conversion Branch Unit - 006" and "Parallel Task Branch Unit - 014".

[0181] Step S152: For each independent behavior evolution unit in the list of abnormal behavior units, extract its behavior evolution triggering conditions, behavior evolution execution instructions, behavior evolution target and behavior evolution feedback information to form an abnormal behavior evolution details table.

[0182] For each independent behavior evolution unit in the list of abnormal behavior units in the intelligent office collaboration system, such as "File Format Conversion Branch Unit-006", detailed information is extracted from the behavior evolution trajectory model. The behavior evolution trigger condition is "receiving a batch file processing instruction from the main branch, including a list of files to be converted and the target format"; the behavior evolution execution instruction is "calling format conversion algorithm A and setting the conversion priority to high"; the behavior evolution target is "the set of PDF format files to be converted"; and the behavior evolution feedback information is "conversion failed, error code E001, 10 failed files". The above information is organized into a table according to the unit identifier, with each unit on one row and columns for unit identifier, trigger condition, execution instruction, target, and feedback information, forming an abnormal behavior evolution detail table that comprehensively displays the behavior evolution details of each abnormal behavior unit.

[0183] Step S153: Extract the bidirectional interaction feature set from the abnormal behavior verification results, analyze the correlation between the positive evolution trend features and the reverse backtracking source features, determine the feature dependency nodes of the two, and generate a feature correlation graph.

[0184] Extract the previously generated bidirectional interaction feature set from the abnormal behavior verification results of the intelligent office collaboration system. This set contains the intersection features of forward evolution trend features and backward tracing features. Analyze these intersection features to determine the correlation between the forward evolution trend features and the backward tracing features. For example, the "file size increase" feature in the forward evolution trend features depends on the "original file upload" feature in the backward tracing features; that is, the increase in file size is due to the larger initial size of the original file during upload. There is a dependency relationship between these two features, and the "original file upload" feature node is a dependent node of the "file size increase" feature node. Through the above analysis, identify all feature dependency nodes and represent these dependencies in the form of a directed graph, where nodes represent features and directed edges represent the dependency direction, generating a feature correlation graph.

[0185] Step S154: Based on the feature association graph, label the cross-association nodes of forward and backward inference features, record the abnormal behavior unit identifier corresponding to each cross-association node, and generate a feature association labeling document.

[0186] In the feature association diagram of the intelligent office collaboration system, identify cross-related nodes that are both forward evolution trend feature nodes and reverse backtracking source feature nodes. For example, the "Data Synchronization Completion Status" feature node represents the completion trend of the synchronization process in the forward evolution trend, and represents the source basis of the synchronization result in the reverse backtracking source; this node is a cross-related node. Mark these cross-related nodes in the feature association diagram, for example, by using different colors or shapes to highlight them. Then, for each cross-related node, determine its corresponding abnormal behavior unit identifier by querying the bidirectional interaction feature set, such as "Data Synchronization Unit-008". Record the annotation information of the cross-related nodes and the corresponding abnormal behavior unit identifier to generate a feature association annotation document. This feature association annotation document shows the cross-related situation of forward and reverse reasoning features and their relationship with abnormal behavior units.

[0187] Step S155: Extract the abnormal correlation feature units from the abnormal behavior verification results, track the propagation path of the abnormal correlation feature units in each trajectory type of the behavior evolution trajectory model, record the propagation order and time period of the abnormality from the initial unit to the subsequent units, and generate an abnormal propagation path table.

[0188] For example, step S1551: extract the abnormal association feature units in the abnormal behavior verification results, determine the initial independent behavior evolution unit identifier corresponding to the abnormal association feature unit, and mark it as the abnormal initial unit.

[0189] In the abnormal behavior verification results of the intelligent office collaboration system, the abnormal association feature units are the feature units previously marked as being associated with branch abnormal features. These abnormal association feature units are extracted, and their corresponding independent behavior evolution unit identifiers are analyzed. For example, an abnormal association feature unit might have the unit identifier "File Format Conversion Branch Unit-006". Since this unit is the source of the abnormal association feature, it is identified as the initial abnormal unit and marked.

[0190] Step S1552: Retrieve the trajectory type to which the abnormal initial unit belongs from the behavior evolution trajectory model, and record the position information of the abnormal initial unit in the trajectory type.

[0191] The trajectory type of the abnormal initial unit "File Format Conversion Branch Unit-006" is retrieved from the behavior evolution trajectory model of the intelligent office collaboration system. According to the model records, this unit belongs to a sub-branch trajectory within the branch evolution trajectory. Its position information within this trajectory type is recorded, including the sub-branch trajectory's level within the branch evolution trajectory (e.g., a second-level sub-branch) and the unit's sequence number within the sub-branch trajectory (e.g., the 3rd unit), thus clarifying the position of the abnormal initial unit within the entire trajectory model.

[0192] Step S1553: Track the subsequent associated units of the abnormal initial unit in its respective trajectory type, and based on the evolutionary association, determine the subsequent units that have a direct evolutionary association with the abnormal initial unit and mark them as first-level propagation units.

[0193] Based on the evolutionary relationships recorded in the behavioral evolution trajectory model, identify subsequent units in the intelligent office collaboration system that have a direct evolutionary relationship with the initial abnormal unit, "File Format Conversion Branch Unit-006". For example, after the initial abnormal unit completes the format conversion, its subsequent behavioral evolution direction points to "File Merging Unit-015", and there is a sixth type of evolutionary relationship between the two, with a relationship strength of 0.7. Therefore, "File Merging Unit-015" is marked as a first-level propagation unit, indicating that the abnormality may have propagated from the initial unit to this unit.

[0194] Step S1554: Record the propagation period from the initial abnormality unit to the first-level propagation unit, that is, from the end of the behavior evolution period of the initial abnormality unit to the start of the behavior evolution period of the first-level propagation unit, and generate first-level propagation information.

[0195] The query in the intelligent office collaboration system shows that the end time of the behavior evolution period of the initial abnormal unit "File Format Conversion Branch Unit-006" is t15, and the start time of the behavior evolution period of the first-level propagation unit "File Merge Unit-015" is t16. Therefore, the propagation period of the abnormal from the initial unit to the first-level propagation unit is t15-t16. Record the abnormal initial unit identifier, the first-level propagation unit identifier, the propagation period, and other information to generate first-level propagation information.

[0196] Step S1555: Track the subsequent associated units of the first-level propagation unit in its respective trajectory type, and based on the evolutionary association, determine the subsequent units that have a direct evolutionary association with the first-level propagation unit and mark them as second-level propagation units.

[0197] Continuing with the evolutionary relationships in the behavioral evolution trajectory model, we track the subsequent associated units of the first-level propagation unit "File Merging Unit-015" in the intelligent office collaboration system. Assuming that the subsequent evolution direction of this unit points to "File Encryption Unit-016", and the two have a first-type evolutionary relationship with a correlation strength of 0.9, then "File Encryption Unit-016" is marked as a second-level propagation unit.

[0198] Step S1556: Record the propagation time from the first-level propagation unit to the second-level propagation unit and generate second-level propagation information.

[0199] The query shows that the end time of the behavior evolution period of the first-level propagation unit "File Merging Unit-015" is t20, the start time of the behavior evolution period of the second-level propagation unit "File Encryption Unit-016" is t21, and the propagation period is t20-t21. Record information such as the first-level propagation unit identifier, the second-level propagation unit identifier, and the propagation period to generate second-level propagation information.

[0200] Step S1557: Repeat the above tracking steps until a propagation unit with no subsequent associated units is tracked, mark it as the final propagation unit, and stop propagation tracking.

[0201] Following the same method, continue tracking the subsequent associated units of the secondary propagation unit "File Encryption Unit-016" in the intelligent office collaboration system to determine the tertiary propagation unit and record the propagation period. Continue this process until a certain propagation unit has no subsequent associated units in the behavioral evolution trajectory model, such as "File Archiving Unit-017," and no other units are associated with it. At this point, mark that unit as the final propagation unit and stop the propagation tracking process.

[0202] Step S1558: Integrate the identification information of the initial abnormality unit, each level of propagation unit and the final propagation unit, arrange them in the propagation order, and generate a propagation unit sequence.

[0203] The identification information of the abnormal initial unit, first-level propagation unit, second-level propagation unit, ..., final propagation unit marked in the intelligent office collaboration system is integrated together according to the propagation order. For example, if the abnormal initial unit is "File Format Conversion Branch Unit-006", the first-level propagation unit is "File Merging Unit-015", the second-level propagation unit is "File Encryption Unit-016", and the final propagation unit is "File Archiving Unit-017", then the propagation unit sequence is ["File Format Conversion Branch Unit-006", "File Merging Unit-015", "File Encryption Unit-016", "File Archiving Unit-017"].

[0204] Step S1559: Extract the propagation period of each adjacent unit pair in the propagation unit sequence, record the duration of each propagation period and the corresponding evolutionary relationship type, and generate a propagation period information table.

[0205] For each adjacent unit pair in the propagation unit sequence of the intelligent office collaboration system, such as ("File Format Conversion Branch Unit-006", "File Merging Unit-015") and ("File Merging Unit-015", "File Encryption Unit-016"), the previously recorded propagation time periods are extracted, and the duration of each propagation time period is calculated. For example, the duration of t15-t16 is 5 minutes, and the duration of t20-t21 is 3 minutes. Simultaneously, the evolutionary relationship type corresponding to each adjacent unit pair is recorded, such as the sixth type, the first type, etc. The information such as the adjacent unit pair identifier, propagation time period, duration, and evolutionary relationship type are compiled into a propagation time period information table.

[0206] Step S15510: Based on the propagation unit sequence and propagation period information table, construct an abnormal propagation path table, which includes the propagation unit identifier, propagation order, propagation period and duration, and evolutionary relationship type.

[0207] By combining the propagation unit sequence and propagation time period information table of the intelligent office collaboration system, an anomaly propagation path table is constructed. Each row in the table represents a propagation node, and the columns include the propagation unit identifier, propagation order (e.g., 1, 2, 3, 4), propagation time period (e.g., t15-t16), propagation duration (e.g., 5 minutes), and evolutionary relationship type (e.g., the sixth category). For example, the first row records the information of the initial unit of the anomaly, with a propagation order of 1; the second row records the first-level propagation unit, with a propagation order of 2, and so on. This anomaly propagation path table displays the propagation path information of the anomaly in the system behavior evolution trajectory.

[0208] Step S15511: Verify the propagation information in the abnormal propagation path table, correct any errors found during the verification, update the abnormal propagation path table, and generate the final abnormal propagation path table document.

[0209] The abnormal propagation path table of the intelligent office collaboration system is verified, checking whether the propagation unit identifiers are correct, whether the propagation order is logical, whether there are overlaps or conflicts in the propagation periods, and whether the evolutionary relationship types are accurate. For example, it was found that the propagation order of "File Encryption Unit-016" in the propagation unit sequence was incorrectly marked as 3, when it should actually be 3. After checking with other information, it was confirmed to be correct. If an error is found in the calculation of the duration of a certain propagation period, such as the duration of t20-t21 being mistakenly calculated as 4 minutes when it should actually be 3 minutes, the error is corrected. After verification and correction, the abnormal propagation path table is updated, and the final abnormal propagation path table document is generated.

[0210] Step S156: Analyze the propagation nodes in the abnormal propagation path table, determine the key turning points of abnormal propagation, mark the change in the direction of behavior evolution corresponding to each key turning point, and generate a list of key nodes for abnormal propagation.

[0211] Analyze the propagation nodes in the anomaly propagation path table of the intelligent office collaboration system to identify nodes where the direction of behavioral evolution changes significantly during the anomaly propagation process; these nodes are the key inflection points. For example, when the anomaly propagates from "File Merging Unit-015" to "File Encryption Unit-016," the direction of behavioral evolution changes from "file content integration" to "file security processing," and this node is a key inflection point. Mark the change in the direction of behavioral evolution corresponding to each key inflection point; for example, the change in direction from "File Merging Unit-015" to "File Encryption Unit-016" is "content integration → security processing." Compile the unit identifier, propagation order, and change in the direction of behavioral evolution of the above key inflection points into a list of key nodes for anomaly propagation.

[0212] Step S157: Extract the abnormal occurrence stage information from the abnormal behavior verification results, obtain the application operation stage to which the abnormal behavior unit belongs, record the application operation environment parameters of each stage, and generate an abnormal stage environment information table.

[0213] Extracting anomaly occurrence stage information from the abnormal behavior verification results of the intelligent office collaboration system, we determine the application runtime stage to which each abnormal behavior unit belongs, such as the initial startup stage, function iteration stage, resource dynamic allocation stage, or process termination stage. For example, "File Format Conversion Branch Unit-006" occurs during the function iteration stage. Then, we obtain the application runtime environment parameters of the abnormal behavior unit in its respective application runtime stage, including CPU utilization, memory usage, network bandwidth, operating system version, and related dependency library versions. We record the abnormal behavior unit identifier, its runtime stage, and the names and values ​​of each environment parameter to generate an anomaly stage environment information table.

[0214] Step S158: Integrate the abnormal behavior evolution details table, feature association annotation document, abnormal propagation path table, abnormal propagation key node list, and abnormal stage environment information table to form a computer application behavior dynamic analysis report. Extract the core abnormal information from the computer application behavior dynamic analysis report and generate a report summary page. The report summary page is used to summarize the core characteristics, propagation scope, and occurrence stage of the abnormal behavior.

[0215] The abnormal behavior evolution details table, feature association annotation document, abnormal propagation path table, list of key nodes in abnormal propagation, and environmental information table of abnormal stages of the intelligent office collaboration system are integrated into a single document to form a dynamic analysis report of computer application behavior. The report includes detailed information on abnormal behavior, feature associations, propagation paths, key nodes, and environmental parameters. Then, core abnormal information is extracted from the report, such as the core characteristics of the abnormal behavior (format conversion failure, data synchronization anomaly, etc.), the scope of propagation (involving 5 independent behavioral evolution units and 3 application modules), and the stage of occurrence (functional iteration stage, dynamic resource allocation stage), generating a report summary page. The summary page concisely summarizes the core content of the report, allowing users to quickly understand the overall situation of the abnormal behavior.

[0216] Step S159: Convert the computer application behavior dynamic analysis report into a standard document format and attach the original data link of the abnormal behavior verification results.

[0217] The generated dynamic analysis report on computer application behavior of the intelligent office collaboration system is converted into standard document formats such as PDF to ensure that the report can be viewed normally on different devices and software. Simultaneously, links to the raw data of abnormal behavior verification results are attached to the report. These links point to the database address or file path storing the raw data of trend anomaly verification sub-results, source anomaly verification sub-results, and branch anomaly verification sub-results. Users can click on the links to view detailed raw data for in-depth anomaly analysis and problem troubleshooting.

[0218] Step S210: Train a deep learning bidirectional inference model.

[0219] Step S211: Collect a large set of behavioral evolution sequences of computer applications under different operating states as training data. These data cover normal operating states and various abnormal operating states. At the same time, desensitize the privacy-sensitive information in the training data, such as replacing user identifiers and encrypting sensitive fields.

[0220] Step S212: Construct a behavior evolution trajectory model for the set of behavior evolution sequences in the training data according to the method in step S120, and use it as sample data for model training.

[0221] Step S213: Convert the behavioral evolution trajectory model in the sample data into feature vector and feature matrix form, and divide it into training set, validation set and test set, with the ratio set to 7:2:1.

[0222] Step S214: Construct the network structure of the deep learning bidirectional inference model, including a trajectory feature input layer, a forward inference module, a backward inference module, a branch inference module, a bidirectional interaction module, a feature enhancement module, a feature fusion module, and a feature extraction module. The trajectory feature input layer uses a fully connected layer to map the input features to a unified dimension; both the forward and backward inference modules use an LSTM network structure, with the forward inference module containing 3 LSTM layers and 2 fully connected layers, and the backward inference module containing 3 LSTM layers and 2 fully connected layers; the branch inference module uses a CNN network structure; the bidirectional interaction module uses an attention mechanism; the feature enhancement and feature fusion modules use fully connected layers and concatenation operations; and the feature extraction module uses fully connected layers and a softmax activation function.

[0223] Step S215: Set the model training parameters. Select Adam as the optimizer, set the initial learning rate to 0.001, decrease the learning rate to 0.9 times every 10 epochs, set the batch size to 32, and set the training epochs to 100 epochs. Use the cross-entropy loss function.

[0224] Step S216: Train the model using the training set. After each epoch, evaluate the model performance using the validation set. If the validation set loss does not decrease for 5 consecutive epochs, stop training and save the current model parameters as the optimal model.

[0225] Step S217: Perform performance testing on the trained model using the test set. Evaluation metrics include accuracy, precision, recall, and F1 score. Ensure that all model metrics meet preset thresholds, such as accuracy not lower than 0.9, precision and recall not lower than 0.85, and F1 score not lower than 0.85. If the thresholds are not met, adjust the model structure or training parameters, and retrain and test until the model performance meets the standards.

[0226] In one exemplary embodiment, a deep learning-based computer application behavior analysis system is provided. This system can be a terminal, server, etc., and its internal structure diagram can be as follows: Figure 2As shown, this deep learning-based computer application behavior analysis system includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, near-field communication, or other technologies. When the computer program is executed by the processor, it implements a deep learning-based computer application behavior analysis method. The display unit is used to form a visually visible image and can be a display screen, projection device, or virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, or a button, trackball, or touchpad set on the shell of a deep learning-based computer application behavior analysis system, or an external keyboard, touchpad, or mouse, etc.

[0227] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A computer application behavior analysis method based on deep learning, characterized in that, The method includes: Obtain a set of behavior evolution sequences generated by a computer application throughout its entire operating cycle. The set of behavior evolution sequences includes operation behavior evolution sequences, resource call evolution sequences, and data interaction evolution sequences generated by the application during the initial startup phase, function iteration phase, dynamic resource allocation phase, and process termination phase. Each behavior evolution sequence carries information such as behavior evolution time period, behavior-associated application module identifier, behavior target, and behavior evolution direction. A behavior evolution trajectory model is constructed based on the set of behavior evolution sequences. The behavior evolution trajectory model is divided into forward evolution trajectory, backward backtracking trajectory and branch evolution trajectory according to the direction of behavior evolution. Each trajectory contains the behavior evolution unit in the corresponding evolution direction and the evolution relationship between the units. The pre-trained deep learning bidirectional reasoning model is invoked to perform bidirectional interactive reasoning processing on the behavior evolution trajectory model to obtain behavior reasoning results. The behavior reasoning results include behavior trend features obtained from forward evolution reasoning, behavior source features obtained from backward backtracking reasoning, and behavior abnormal branch features obtained from branch evolution reasoning. Based on the behavioral reasoning results, an abnormal behavior verification module combination is constructed. The abnormal behavior verification module combination includes a trend feature verification module, a source tracing feature verification module, a branch feature verification module, a cross-module collaborative verification module, and a verification result feedback module. Each module collaboratively outputs the abnormal behavior verification results. A dynamic analysis report of computer application behavior is generated based on the abnormal behavior verification results. The report includes details of the behavior evolution corresponding to the abnormal behavior branch features, the correlation between forward and backward reasoning features, the propagation path of the abnormal behavior in the evolution trajectory, and the application operating environment information at the stage of the abnormal occurrence.

2. The computer application behavior analysis method based on deep learning according to claim 1, characterized in that, The construction of the behavior evolution trajectory model based on the set of behavior evolution sequences includes: Each behavior evolution sequence in the set of behavior evolution sequences is decomposed into a unit, and each behavior evolution sequence is divided into an independent behavior evolution unit containing a behavior evolution triggering condition, a behavior evolution execution instruction, a behavior evolution target, a behavior evolution feedback information, and a behavior evolution subsequent direction. Each independent behavior evolution unit carries an evolution direction identifier. Based on the evolution direction identifier of the independent behavior evolution unit, all independent behavior evolution units are assigned to the corresponding trajectory type. Independent behavior evolution units in the forward evolution direction are assigned to the forward evolution trajectory, those in the reverse backtracking direction are assigned to the reverse backtracking trajectory, and those in the branch evolution direction are assigned to the branch evolution trajectory. Analyze the progressive relationship between independent behavioral evolution units within the positive evolution trajectory, extract the behavioral evolution feedback information of the previous independent behavioral evolution unit and the behavioral evolution triggering conditions of the next independent behavioral evolution unit, compare the progressive matching relationship between the two, and generate progressive matching results; Based on the progressive matching results, the evolutionary association relationship between independent behavior evolutionary units within the positive evolutionary trajectory is defined. If the progressive matching result is a complete progressive match, a first type of evolutionary association relationship is defined. If the progressive matching result is a partial progressive match, a second type of evolutionary association relationship is defined. If the progressive matching result is no progressive match, it is marked as a progressive break unit. Analyze the backtracking relationship between independent behavioral evolution units within the reverse backtracking trajectory, extract the behavioral evolution feedback information of the latter independent behavioral evolution unit and the behavioral evolution triggering condition of the former independent behavioral evolution unit, compare the backtracking matching relationship between the two, and generate backtracking matching results; Based on the backtracking matching results, the evolutionary association relationship between independent behavioral evolutionary units within the reverse backtracking trajectory is defined. If the backtracking matching result is a complete backtracking match, a third type of evolutionary association relationship is defined. If the backtracking matching result is a partial backtracking match, a fourth type of evolutionary association relationship is defined. If the backtracking matching result is no backtracking match, it is marked as a backtracking break unit. Analyze the branching relationships between independent behavioral evolution units within the branching trajectory, extract the subsequent direction of behavioral evolution of the main branch independent behavioral evolution unit and the triggering conditions of behavioral evolution of the sub-branch independent behavioral evolution unit, compare the branching matching relationship between the two, and generate branching matching results; Based on the branch matching results, the evolutionary association relationship between independent behavior evolutionary units within the branch evolution trajectory is defined. If the branch matching result is a complete branch matching, the fifth type of evolutionary association relationship is defined. If the branch matching result is a partial branch matching, the sixth type of evolutionary association relationship is defined. If the branch matching result is no branch matching, it is marked as a branch break unit. Calculate the evolution association strength corresponding to each evolution association relationship. The calculation of evolution association strength is based on the matching frequency of independent behavior evolution units within the same trajectory and the cross association frequency of independent behavior evolution units between different trajectories. The higher the matching frequency and the higher the cross association frequency, the greater the evolution association strength. The independent behavioral evolution units, evolutionary relationships, and evolutionary relationship strengths of each trajectory type are integrated to form an initial behavioral evolution trajectory model. The initial behavioral evolution trajectory model is then subjected to fracture unit repair processing. Based on the evolutionary relationship of adjacent independent behavioral evolution units, the missing behavioral evolution information of the fracture units is supplemented to obtain an optimized behavioral evolution trajectory model. Extract the unit distribution information and evolutionary association distribution information of each trajectory type in the optimized behavior evolution trajectory model, and generate a trajectory model structure document. The trajectory model structure document is used to record the number of units of each trajectory type, the type of evolutionary association, and the distribution of evolutionary association strength.

3. The computer application behavior analysis method based on deep learning according to claim 1, characterized in that, The invocation of the pre-trained deep learning bidirectional reasoning model to perform bidirectional interactive reasoning processing on the behavior evolution trajectory model yields the behavior reasoning result, including: The independent behavioral evolution units of each trajectory type in the behavioral evolution trajectory model are converted into feature vectors. The independent behavioral evolution units of the forward evolution trajectory are converted into forward evolution feature vectors, the reverse backtracking trajectory is converted into reverse backtracking feature vectors, and the branch evolution trajectory is converted into branch evolution feature vectors. The forward evolution feature vector, the backward backtracking feature vector, and the branch evolution feature vector are input into the trajectory feature input layer of the deep learning bidirectional inference model. The feature mapping operation converts the feature vectors of each trajectory type into a trajectory feature matrix of a unified dimension. The forward inference module of the deep learning bidirectional inference model is invoked to perform a progressive trend inference operation on the forward evolution feature matrix in the trajectory feature matrix. Based on the feature vector of the preceding independent behavior evolution unit, the feature change direction of the subsequent independent behavior evolution unit is predicted, and a forward evolution trend feature sequence is generated. The reverse reasoning module of the deep learning bidirectional reasoning model performs source tracing reasoning on the reverse backtracking feature matrix in the trajectory feature matrix, and infers the feature source of the preceding independent behavior evolution unit based on the feature vector of the subsequent independent behavior evolution unit, generating a reverse backtracking source tracing feature sequence. The branch inference module of the deep learning bidirectional inference model is invoked to perform branch anomaly inference operation on the branch evolution feature matrix in the trajectory feature matrix, analyze the feature differences of the independent behavior evolution units of the main branch and the sub-branch, identify branch features that deviate from the normal branch feature range, and generate a branch anomaly feature sequence. The bidirectional interaction module of the deep learning bidirectional inference model is activated to compare the forward evolution trend feature sequence with the reverse backtracking source feature sequence, extract the feature intersection area of ​​the two, and generate a bidirectional interactive feature set. The bidirectional interaction feature set and the branch anomaly feature sequence are correlated to determine the corresponding position of the branch anomaly feature in the bidirectional interaction feature set and the anomaly correlation feature unit is marked. The feature enhancement module of the deep learning bidirectional inference model performs feature enhancement operations on the abnormal association feature unit to enhance the feature expression of the abnormal association feature unit and generate enhanced abnormal association features. The feature fusion module of the deep learning bidirectional inference model is invoked to fuse the forward evolution trend feature sequence, the reverse backtracking source feature sequence, and the enhanced abnormal correlation features to generate a fused feature matrix. The feature extraction module of the deep learning bidirectional reasoning model extracts behavioral trend features corresponding to forward evolution reasoning, behavioral source tracing features corresponding to backward reasoning, and behavioral abnormal branch features corresponding to branch evolution reasoning from the fused feature matrix. Perform consistency checks on features derived from different reasoning directions in the time dimension and module association dimension to generate behavioral reasoning results that pass the checks. Extract the feature relationships from the validated behavioral reasoning results and generate a feature relationship map document. The feature relationship map document is used to record the relationship paths between behavioral trend features, behavioral source features, and behavioral abnormal branch features.

4. The computer application behavior analysis method based on deep learning according to claim 1, characterized in that, The combination of abnormal behavior verification modules constructed based on the behavior reasoning results includes: Extract behavioral trend features from the behavioral reasoning results, input them into the trend feature verification module of the abnormal behavior verification module combination, the trend feature verification module loads the preset normal behavior trend feature library, compares the input behavioral trend features with the features in the normal behavior trend feature library, and generates trend feature comparison results. Based on the trend feature comparison results, abnormal trend features that deviate from the normal trend feature range are marked, and the independent behavior evolution unit identifier and time period information corresponding to the abnormal trend features are recorded to generate a trend anomaly verification sub-result. Extract the behavioral source traceability features from the behavioral reasoning results, input them into the source traceability feature verification module of the abnormal behavior verification module combination, the source traceability feature verification module loads the preset normal behavior source traceability feature library, compares the input behavioral source traceability features with the features in the normal behavior source traceability feature library, and generates source traceability feature comparison results; Based on the source tracing feature comparison results, abnormal source tracing features that deviate from the normal source tracing feature range are marked, and the independent behavior evolution unit identifier and module association information corresponding to the abnormal source tracing features are recorded to generate source tracing anomaly verification sub-results. Extract the abnormal branch features from the behavior reasoning results, input them into the branch feature verification module of the abnormal behavior verification module combination, the branch feature verification module loads the preset normal behavior branch feature library, compares the input abnormal branch features with the features in the normal behavior branch feature library, and generates branch feature comparison results. Based on the branch feature comparison results, the degree of abnormality of the abnormal branch features is confirmed, the main branch and sub-branch unit identifiers and branch association strengths corresponding to the abnormal branch features are recorded, and a branch anomaly verification sub-result is generated. The cross-module collaborative verification module of the abnormal behavior verification module combination is activated, and the trend abnormal verification sub-result, the source abnormal verification sub-result, and the branch abnormal verification sub-result are cross-correlated. The common abnormal unit identifiers in the trend abnormal verification sub-result, the source abnormal verification sub-result, and the branch abnormal verification sub-result are extracted, and a cross-correlated abnormal unit list is generated. For each abnormal unit in the cross-correlation abnormal unit list, integrate its abnormal description information in the trend abnormality verification sub-result, the source abnormality verification sub-result, and the branch abnormality verification sub-result to form an abnormal unit comprehensive description document; The verification result feedback module of the abnormal behavior verification module combination is called to feed back the comprehensive description document of the abnormal unit to the behavior evolution trajectory model optimization stage, and supplement the behavior evolution information of the abnormal unit to the trajectory model. Based on the supplemented behavior evolution trajectory model, the local bidirectional interactive reasoning process is re-executed to verify whether the abnormal characteristics of the abnormal unit persist and generate a secondary verification result. The abnormal behavior verification results are formed by integrating the trend anomaly verification results, source anomaly verification results, branch anomaly verification results, and secondary verification results. Extract key abnormal information from the abnormal behavior verification results and generate an abnormal verification summary document, which is used to summarize the type, scope and verification basis of the abnormal behavior.

5. The computer application behavior analysis method based on deep learning according to claim 1, characterized in that, The step of generating a dynamic analysis report of computer application behavior based on the abnormal behavior verification results includes: Integrate the independent behavior evolution unit information corresponding to the abnormal behavior branch features in the trend anomaly verification sub-result, the source anomaly verification sub-result, and the branch anomaly verification sub-result from the abnormal behavior verification results to generate an abnormal behavior unit list. For each independent behavior evolution unit in the list of abnormal behavior units, extract its behavior evolution triggering conditions, behavior evolution execution instructions, behavior evolution target and behavior evolution feedback information to form an abnormal behavior evolution details table; Extract the bidirectional interaction feature set from the abnormal behavior verification results, analyze the correlation between the positive evolution trend features and the reverse backtracking source features, determine the feature dependency nodes of the two, and generate a feature correlation graph. Based on the feature association graph, the cross-association nodes of forward and backward inference features are labeled, the abnormal behavior unit identifiers corresponding to each cross-association node are recorded, and a feature association labeling document is generated. Extract the abnormal correlation feature units from the abnormal behavior verification results, track the propagation path of the abnormal correlation feature units in each trajectory type of the behavior evolution trajectory model, record the propagation order and time segment of the abnormality from the initial unit to the subsequent units, and generate an abnormal propagation path table. Analyze the propagation nodes in the abnormal propagation path table, identify the key turning points of abnormal propagation, mark the change in the direction of behavior evolution corresponding to each key turning point, and generate a list of key nodes for abnormal propagation. Extract the abnormal occurrence stage information from the abnormal behavior verification results, obtain the application operation stage to which the abnormal behavior unit belongs, record the application operation environment parameters of each stage, and generate an abnormal stage environment information table. The abnormal behavior evolution details table, feature association annotation document, abnormal propagation path table, list of key nodes of abnormal propagation and abnormal stage environment information table are integrated to form a computer application behavior dynamic analysis report. The core abnormal information in the computer application behavior dynamic analysis report is extracted and a report summary page is generated. The report summary page is used to summarize the core characteristics, propagation scope and occurrence stage of the abnormal behavior. Convert the computer application behavior dynamic analysis report into a standard document format and attach the original data link of the abnormal behavior verification results.

6. The computer application behavior analysis method based on deep learning according to claim 2, characterized in that, The initial behavior evolution trajectory model is subjected to fracture unit repair processing. Based on the evolutionary correlation between adjacent independent behavior evolution units, the missing behavior evolution information of the fracture units is supplemented to obtain an optimized behavior evolution trajectory model, including: Extract the progressive fracture units, backtracking fracture units, and branch fracture units from the initial behavior evolution trajectory model to form a fracture unit list, and record the location information of each fracture unit and the identifier of adjacent independent behavior evolution units. For the progressive fracture units in the fracture unit list, extract the behavioral evolution feedback information of their preceding independent behavioral evolution units and the behavioral evolution triggering conditions of their subsequent independent behavioral evolution units, analyze the characteristic differences between the two, and determine the direction for supplementing the missing behavioral evolution triggering conditions and feedback information of the fracture unit. Based on the aforementioned supplementary direction, the behavior evolution information supplementary library is invoked to filter behavior evolution information that matches the features of the preceding and subsequent independent behavior evolution units, thereby generating supplementary information for the progressive fracture unit. The supplementary information of the progressive fracture unit is filled into the progressive fracture unit, the behavior evolution triggering condition, behavior evolution execution instruction and behavior evolution feedback information of the progressive fracture unit are updated, and the repaired progressive unit is generated. For the backtracking fracture units in the fracture unit list, extract the behavioral evolution feedback information of their subsequent independent behavioral evolution units and the behavioral evolution triggering conditions of their preceding independent behavioral evolution units, analyze the characteristic differences between the two, and determine the direction for supplementing the missing behavioral evolution triggering conditions and feedback information of the fracture unit. Based on the aforementioned supplementary direction, the behavior evolution information supplementary library is invoked to filter behavior evolution information that matches the features of the preceding and subsequent independent behavior evolution units, and to generate supplementary information for the retrospective fracture unit. The supplementary information of the backtracking fracture unit is filled into the backtracking fracture unit, the behavior evolution triggering condition, behavior evolution execution instruction and behavior evolution feedback information of the backtracking fracture unit are updated, and the repaired backtracking unit is generated. For the branch fracture units in the fracture unit list, extract the subsequent direction of behavioral evolution of the main branch independent behavioral evolution unit and the triggering condition of behavioral evolution of the sub-branch independent behavioral evolution unit, analyze the characteristic differences between the two, and determine the missing behavioral evolution triggering condition and the supplementary direction of the subsequent direction of the fracture unit. Based on the aforementioned supplementary direction, the behavior evolution information supplementary library is invoked to filter behavior evolution information that matches the characteristics of independent behavior evolution units of the main branch and sub-branch, and to generate supplementary information for branch breakage units. The supplementary information of the branch fracture unit is filled into the branch fracture unit, the behavior evolution triggering condition, behavior evolution execution instruction and behavior evolution subsequent direction of the branch fracture unit are updated, and the repaired branch unit is generated. Replace the corresponding fracture unit in the initial behavior evolution trajectory model with the repaired progressive unit, repaired backtracking unit, and repaired branching unit to generate the repaired behavior evolution trajectory model. The evolutionary relationships of independent behavioral evolution units of each trajectory type in the repaired behavioral evolution trajectory model are recalculated, and the evolutionary relationship strength of each evolutionary relationship is updated. Extract the unit integrity index and correlation integrity index of the repaired behavior evolution trajectory model, compare them with the preset model integrity standard, and confirm the model repair effect. If the model repair effect meets the preset standard, it is determined to be the optimized behavior evolution trajectory model; if it does not meet the standard, the above fracture unit repair steps are repeated until the model repair effect meets the standard.

7. The computer application behavior analysis method based on deep learning according to claim 3, characterized in that, The bidirectional interaction module that initiates the deep learning bidirectional inference model compares the forward evolution trend feature sequence with the reverse backtracking source feature sequence, extracts the feature intersection region between the two, and generates a bidirectional interactive feature set, including: The forward evolution trend feature sequence and the reverse backtracking source feature sequence are converted into feature lists with the same data structure. Each feature list contains a feature identifier, a feature value, and an identifier of the independent behavioral evolution unit corresponding to the feature. Based on the identifier of the independent behavioral evolution unit corresponding to the feature, the two feature lists are aligned with the unit identifiers. The positive evolution trend features and the reverse backtracking source features corresponding to the same independent behavioral evolution unit identifier are grouped together to generate a feature grouping list. For each feature group in the feature grouping list, calculate the numerical similarity between the forward evolution trend feature and the reverse backtracking source feature, record the feature groups whose similarity reaches a preset threshold, and generate a target feature group list. Extract the common feature dimension of each group of features in the target feature group list, determine the dimension range of the feature intersection region, and generate a feature intersection dimension table; Based on the feature intersection dimension table, feature values ​​of corresponding dimensions are extracted from high similarity feature groups to form a feature intersection value set. The feature values ​​in the feature intersection value set are deduplicated, and unique feature values ​​are retained to generate a deduplicated feature intersection set. Assign a corresponding feature identifier and an independent behavior evolution unit identifier to each feature value in the deduplicated feature intersection set to form a structured bidirectional interactive feature set; The features in the bidirectional interaction feature set are sorted and arranged according to the chronological order of independent behavioral evolution units to generate an ordered bidirectional interaction feature set. Extract the feature associations from the ordered bidirectional interactive feature set, record the numerical change trends between adjacent features, and generate a feature change trend table; The ordered bidirectional interactive feature set is integrated with the feature change trend table to form a bidirectional interactive feature set document; The integrity of the features in the bidirectional interactive feature set document is checked, and missing feature identifiers and independent behavior evolution unit identifiers are supplemented to ensure that each feature has associated information.

8. The computer application behavior analysis method based on deep learning according to claim 4, characterized in that, The cross-module collaborative verification module of the startup abnormal behavior verification module cross-correlates the trend abnormality verification sub-results, source tracing abnormality verification sub-results, and branch abnormality verification sub-results, extracts the common abnormal unit identifiers from the trend abnormality verification sub-results, source tracing abnormality verification results, and branch abnormality verification results, and generates a cross-correlated abnormal unit list, including: Extract the independent behavior evolution unit identifiers corresponding to the abnormal trend features from the trend anomaly verification sub-results to form a trend anomaly unit list, and record the abnormal time period information corresponding to each unit identifier; Extract the independent behavior evolution unit identifiers corresponding to the anomaly source verification sub-results to form a source anomaly unit list, and record the anomaly module association information corresponding to each unit identifier; Extract the independent behavior evolution unit identifiers corresponding to the abnormal branch features from the branch anomaly verification sub-results, form a branch anomaly unit list, and record the abnormal branch association information corresponding to each unit identifier; Input the list of trend anomaly units, the list of source anomaly units, and the list of branch anomaly units into the unit identifier comparison engine of the cross-module collaborative verification module, and perform unit identifier intersection calculation; Identify independent behavior evolution unit identifiers that simultaneously exist in the trend anomaly unit list, the source anomaly unit list, and the branch anomaly unit list, mark them as common anomaly unit identifiers, and record the number of times each common anomaly unit identifier appears in the trend anomaly unit list, the source anomaly unit list, and the branch anomaly unit list; For the common anomaly unit identifier, extract its abnormal time period information in the trend anomaly unit list, abnormal module association information in the source tracing anomaly unit list, and abnormal branch association information in the branch anomaly unit list to form a common anomaly unit information table; Based on the common anomaly unit information table, the common anomaly unit identifiers are arranged in chronological order of the anomaly time period to generate a cross-linked anomaly unit list. The unit identifiers and corresponding anomaly information in the cross-linked anomaly unit list are then extracted to generate a detail document for the cross-linked anomaly units. The detail document is used to record the complete anomaly information of each common anomaly unit.

9. A computer application behavior analysis system based on deep learning, characterized in that, include: processor; A machine-readable storage medium for storing machine-executable instructions of the processor; The processor is configured to execute the deep learning-based computer application behavior analysis method according to any one of claims 1 to 8 by executing the machine-executable instructions.

10. A computer program product, characterized in that, The computer program product includes machine-executable instructions stored in a computer-readable storage medium. The processor of the deep learning-based computer application behavior analysis system reads the machine-executable instructions from the computer-readable storage medium and executes the machine-executable instructions, causing the deep learning-based computer application behavior analysis system to perform the deep learning-based computer application behavior analysis method as described in any one of claims 1 to 8.

Images