A password service platform calling behavior analysis and intelligent decision method

Abstract

The application discloses a password service platform calling behavior analysis and intelligent decision method, relates to the field of password service security monitoring, and comprises the following steps: establishing a three-end consistent trust link of an SDK end, a platform gateway end and a password service end, performing full-link trusted verification on a password service calling request initiated by a user to obtain trusted calling data; performing batch analysis, real-time analysis and sequence analysis on the trusted calling data and platform state data respectively to generate an alarm event; classifying and grading the alarm event according to an alarm source and a risk influence degree to obtain a graded alarm event; and generating a corresponding management and control strategy through a pre-trained intelligent decision model based on the graded alarm event. The method realizes full-link trusted collection, multi-dimensional risk identification and intelligent decision of password service platform calling behavior, and improves the security protection continuity and response efficiency of the platform.

Description

Technical Field

[0001] This invention relates to the field of cryptographic service security monitoring, and more specifically to a method for analyzing and making intelligent decisions regarding the call behavior of a cryptographic service platform. Background Technology

[0002] As a system that centrally manages core security capabilities such as encryption, decryption, signing, signature verification, and key management, the cryptographic service platform is widely used in scenarios such as financial risk control, enterprise access control, and cloud service security auditing. With the surge in the number of connected clients and business systems, the platform generates massive amounts of high-concurrency call behavior data every day.

[0003] Existing technical solutions mainly focus on the implementation of the cryptographic service function itself, lacking a verification mechanism for the integrity and authenticity of the call data. For example, the call requests received by the platform gateway may be hijacked or tampered with, and the call logs may be maliciously modified before collection, leading to subsequent analysis based on untrusted data and resulting in misjudgments or omissions. In addition, traditional solutions usually only collect user identity and business operation information, without performing signature verification and authorization consistency confirmation at each link of the call chain, and cannot guarantee the trustworthiness of the entire chain from request initiation to service execution.

[0004] In terms of behavioral analysis, existing technologies have significant shortcomings. Batch analysis often only counts the number of calls within a fixed time period, ignoring the differences in security sensitivity of different cryptographic operations. This leads to a large number of low-risk encryption operations being treated the same as a small number of high-risk key destruction operations, making it impossible to accurately identify weighted risks. Real-time analysis lacks a short-term context caching mechanism. It only judges individual requests independently, making it difficult to detect abnormal combinations of time-series related behaviors such as consecutive call failures or immediate key queries after signature verification failures. Sequence analysis lacks the ability to adapt to operation time-series rules and has not established a whitelist mechanism, which easily leads to duplicate false alarms for normal business sequences.

[0005] For alarm events, most existing technologies adopt a unified alarm method without classifying alarms according to their source and risk impact. This leads to the mixed handling of emergency and general risks, resulting in low efficiency. More importantly, the response after an alarm relies entirely on manual intervention. When no one responds during off-peak hours such as night or holidays, the risk continues to escalate and cannot be effectively controlled. Even if some solutions introduce simple rules, they lack intelligent decision-making models based on historical data and cannot automatically generate control strategies that match the risk level.

[0006] Therefore, how to design a method for analyzing and making intelligent decisions regarding the call behavior of cryptographic service platforms, and how to achieve automated risk identification and control strategy generation for the call behavior of cryptographic service platforms to ensure continuous and efficient security protection capabilities are problems that urgently need to be solved by those skilled in the art. Summary of the Invention

[0007] In view of this, the present invention provides a method for analyzing and making intelligent decisions regarding the call behavior of a cryptographic service platform. This method aims to address the problems of existing cryptographic service platforms lacking unified monitoring and analysis capabilities for user call behavior, making it difficult to detect security risks such as abnormal calls and unauthorized access in real time, and the high reliance on manual alarm handling and the existence of protection gaps during off-peak hours. By establishing a consistent trust link across three terminals, integrating batch, real-time, and sequence analysis, and combining intelligent decision-making models based on K-means and XGBoost, the method achieves automated risk identification and control strategy generation for call behavior, thereby improving the continuity of security protection and response efficiency of the platform.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] A method for analyzing the behavior and making intelligent decisions of a cryptographic service platform includes the following steps: S1. Establish a consistent trust link between the SDK end, the platform gateway end and the password service end, and perform full-link trusted verification on the password service call request initiated by the user to obtain trusted call data; S2. Perform batch analysis, real-time analysis, and sequence analysis on the trusted call data and platform status data respectively to generate alarm events; S3. Classify and grade the alarm events according to their alarm sources and risk impact levels to obtain graded alarm events; S4. Based on the graded alarm events, generate corresponding control strategies through a pre-trained intelligent decision-making model.

[0010] Preferably, in step S1, establishing a consistent trust link between the SDK end, the platform gateway end, and the cryptographic server includes: On the SDK side, the request body of the cryptographic service call is hashed, and the hash value is signed using the user's hardware device to generate a trusted request message; At the platform gateway, the trusted request message is received, the signature value is verified and the validity of the request timestamp is checked. After the signature verification is successful, the gateway generates a relay signature value, and the request body is combined with the relay signature value and then routed to the cryptographic server. On the password server side, the validity of the SDK signature and the gateway relay signature is verified again, and the user's permissions and operation type are confirmed. The password operation is only executed when both are verified and the permissions match.

[0011] Preferably, in step S2, the batch analysis includes: Different risk weights are assigned to different types of cryptographic operations. Based on the degree of impact of the operation on the security of the cryptographic service platform, a corresponding preset risk weight value is set for each type of operation. Calculate the weighted total risk of target users within a specified time window. ,in Let the risk weight be the i-th type of operation. This refers to the number of times this type of operation is called within the time window. Number of operation types; Calculate dynamic risk threshold ,in It is the historical weighted risk average. The historical weighted risk standard deviation, The preset sensitivity coefficient; When the weighted total risk value When the risk exceeds the dynamic risk threshold T, a batch analysis alarm event is generated.

[0012] Preferably, in step S2, the batch analysis further includes anomaly detection based on time phase: Based on the historical call data of the target user for a preset number of historical days Q, each day is divided into a preset number M equal-length time slices. The number of calls within each time slice is counted to obtain a historical time distribution vector. The historical phase probability distribution is obtained by normalization. ; Calculate the real-time distribution of the real-time data within the current detection window. and its normalized distribution ; Using cosine similarity The similarity Sim is measured to be below a preset dynamic fluctuation threshold. When the similarity Sim is below the threshold, it is determined to be an abnormal time phase and a batch analysis alarm event is generated.

[0013] Preferably, in step S2, the real-time analysis includes: The call trajectory of each user within a preset short time window is cached in memory. The trajectory includes user identifier, operation type, call result and timestamp. When assessing the risk of the current call behavior, a joint assessment is made based on the current operation and the call trajectory. If a preset abnormal combination of behaviors is detected within a preset short time window, a real-time analysis alarm event is generated.

[0014] Preferably, in step S2, sequence analysis includes: Configure sequence analysis rules, which include time window size, user identifier, and operation sequence combination. When the real-time data acquired within the time window meets the sequence analysis rules, a sequence analysis alarm event is generated. An operation sequence whitelist is created for each user. When a sequence analysis alarm event is determined to be a false alarm, the corresponding operation sequence is added to the whitelist and an expiration time is set. If subsequent operations match the whitelist, no alarm will be generated.

[0015] Preferably, in step S3, the classification and grading include: Alarm events are categorized into user behavior alarms and platform operation alarms based on their source. User behavior alarms include high-frequency call behavior alarms, sensitive operation behavior alarms, abnormal operation behavior alarms, and unauthorized operation behavior alarms. Platform operation alarms include node resource overload alarms, abnormal node status alarms, and abnormal service performance alarms. Alarm events are classified into emergency alarms, important alarms, and general alarms based on the degree of risk impact.

[0016] Preferably, in step S4, the intelligent decision-making model is a collaborative model based on K-means clustering and XGBoost classification, and the pre-training process includes: Extract user behavior features, platform status features, and context features from the call log database or monitoring components, and construct a feature vector set; Based on the feature vector set, continuous features are standardized and discrete features are one-hot encoded, and the standardized and encoded feature vectors are output. The K-means clustering algorithm is used to divide the standardized and encoded feature vector into multiple risk clusters. The cluster number of each sample is recorded, and the cluster number is added to the original feature vector as a new feature to output the enhanced feature vector. Using the enhanced feature vector as input and the actual control strategy results corresponding to historical alarms as labels, train the XGBoost multi-classification model to obtain the trained model.

[0017] Preferably, in the K-means clustering algorithm, the optimal number of clusters is... By selecting the sum of squares within the cluster The K value corresponding to the descent inflection point is used to determine the sum of squares within the cluster. Represented as:

[0018] in, For data points, The number of clusters, For the i-th cluster, Let be the centroid of the i-th cluster.

[0019] Preferably, in step S4, generating the corresponding control strategy includes: For newly generated graded alarm events, their feature vectors are extracted, standardized, and one-hot encoded. The cluster number of the risk cluster to which the processed feature vector belongs is obtained through the K-means algorithm. The cluster number is then concatenated with the processed feature vector as an additional feature to form the corresponding enhanced feature vector. The enhanced feature vectors are input into the trained XGBoost model, which outputs the predicted probability and confidence of each candidate control strategy. Based on confidence level Compared with the preset first confidence threshold Second confidence threshold Relationship generation hierarchical control strategy: If If, then the highest probability strategy is generated; if Then a compromise control strategy is generated; if Then, a strategy for system review is generated.

[0020] As can be seen from the above technical solution, compared with the prior art, the technical solution of the present invention has the following beneficial effects: 1. This method establishes a consistent trust link between the SDK, the platform gateway, and the cryptographic service to perform end-to-end signature verification and authorization confirmation on cryptographic service call requests, ensuring that the call data entering the analysis stage is complete and has not been tampered with. On this basis, batch analysis, real-time analysis, and sequence analysis are performed in parallel on trusted call data and platform status data, which can comprehensively identify abnormal call behavior from multiple dimensions.

[0021] 2. Based on the source of alarms and the degree of risk impact, generated alarm events are divided into multiple levels, and combined with the specific subcategories of user behavior alarms and platform operation alarms. This hierarchical mechanism enables different types of risk events to obtain matching follow-up processing strategies, avoiding false alarms or missed alarms caused by a one-size-fits-all approach, and improving the precision of security management.

[0022] 3. The K-means clustering algorithm is used to divide historical alarm features into unsupervised risk clusters. The cluster number is used as an additional feature and concatenated with the original features to form an enhanced feature vector. Then, the XGBoost multi-classification model is used for supervised training. In the application stage, for newly generated graded alarm events, the model outputs the predicted probability and confidence of each candidate control strategy and generates different strategies based on preset dual thresholds. This collaborative decision-making mechanism realizes the automatic mapping from alarms to control strategies, improving response efficiency and the rationality of strategy matching. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0024] Figure 1 A flowchart of a cryptographic service platform call behavior analysis and intelligent decision-making method provided in an embodiment of the present invention; Figure 2 This is a diagram of a three-terminal consistent trust link framework provided in an embodiment of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] like Figure 1 As shown, this embodiment provides a method for analyzing and intelligently deciding on the call behavior of a cryptographic service platform, including the following steps: S1. Establish a consistent trust link between the SDK end, the platform gateway end and the password service end, and perform full-link trusted verification on the password service call request initiated by the user to obtain trusted call data; S2. Perform batch analysis, real-time analysis, and sequence analysis on the trusted call data and platform status data respectively to generate alarm events; S3. Classify and grade the alarm events according to their alarm sources and risk impact levels to obtain graded alarm events; S4. Based on the graded alarm events, generate corresponding control strategies through a pre-trained intelligent decision-making model.

[0027] It ensures the trustworthiness of call data by establishing a consistent trust link between the SDK, gateway, and cryptographic server. On this basis, it comprehensively uses three dimensions—batch analysis, real-time analysis, and sequence analysis—to identify abnormal calls and generate alarms. After alarm classification and grading, it automatically outputs graded control strategies using a collaborative model of K-means clustering and XGBoost classification, thereby achieving full-link trusted collection, multi-dimensional risk identification, and intelligent decision-making for cryptographic service platform call behavior.

[0028] The following provides further explanation of each step in the above method and its related technical features; like Figure 2 As shown, in this embodiment, S1, a consistent trust link is established between the SDK end, the platform gateway end and the password service end, and the password service call request initiated by the user is verified in the entire link to obtain trusted call data. The establishment of a consistent trust link between the SDK, platform gateway, and cryptographic server includes: On the SDK side, the request body of the cryptographic service call is hashed, and the hash value is signed using the user's hardware device to generate a trusted request message; At the platform gateway, the trusted request message is received, the signature value is verified and the validity of the request timestamp is checked. After the signature verification is successful, the gateway generates a relay signature value, and the request body is combined with the relay signature value and then routed to the cryptographic server. On the password server side, the validity of the SDK signature and the gateway relay signature is verified again, and the user's permissions and operation type are confirmed. The password operation is only executed when both are verified and the permissions match.

[0029] The trusted call data in this step refers to the call behavior data that has passed the verification of the three-terminal consistent trust link. In actual deployment, the hardware key used by the three-terminal consistent trust link can be signed using the national cryptographic SM2 or RSA algorithm. For high-security scenarios, the effective window for the request timestamp can be set to 5 seconds, while for general business systems it can be relaxed to 30 seconds to balance security and network latency. The establishment of this trust link ensures the authenticity and integrity of the subsequent analysis data and eliminates false alarms introduced by forged requests, replay attacks, and unauthorized tampering.

[0030] In this embodiment S2, the trusted call data and platform status data are subjected to batch analysis, real-time analysis, and sequence analysis, respectively, to generate alarm events; wherein, the batch analysis includes: Different risk weights are assigned to different types of cryptographic operations. Based on the degree of impact of the operation on the security of the cryptographic service platform, a corresponding preset risk weight value is set for each type of operation. In this embodiment, the weight of key destruction, key cancellation, and key export operations can be set to 10; the weight of key generation, key query, key import, and key change operations can be set to 5; the weight of data decryption, signature verification, and sensitive data decryption operations can be set to 0; and the weight of data encryption, ordinary signature, and non-sensitive signature verification operations can be set to 1. Calculate the weighted total risk of target users within a specified time window. ,in Let the risk weight be the i-th type of operation. This refers to the number of times this type of operation is called within the time window. Number of operation types; Calculate dynamic risk threshold ,in It is the historical weighted risk average. The historical weighted risk standard deviation, Preset sensitivity coefficient; historical weighted average risk and standard deviation Based on the user's recent 7 or 30 days of dynamic updates via a sliding window, the sensitivity coefficient K can be automatically switched according to the time period: for example, K=1.5 during working hours, and K=2.5 at night and on holidays; When the weighted total risk value When the risk exceeds the dynamic risk threshold T, a batch analysis alarm event is generated.

[0031] Furthermore, batch analysis also includes anomaly detection based on time phase: Based on the historical call data of the target user for a preset number of historical days Q, each day is divided into a preset number M equal-length time slices. The number of calls within each time slice is counted to obtain a historical time distribution vector. The historical phase probability distribution is obtained by normalization. The preset historical number of days Q for time phase anomaly detection is 15 days, and the time slice M is 96 (every 15 minutes). Calculate the real-time distribution of the real-time data within the current detection window. and its normalized distribution ;

[0032]

[0033] in, This represents the number of historical calls within the i-th time slice. This represents the probability value of the i-th time slice in the historical phase probability distribution; This represents the number of real-time calls in the i-th time slice within the current detection window. This represents the probability value of the i-th time slice in the real-time phase probability distribution; Using cosine similarity The similarity Sim is measured to be below a preset dynamic fluctuation threshold. When the similarity Sim is below the preset dynamic fluctuation threshold, it is determined to be a time phase anomaly and a batch analysis alarm event is generated. The dynamic fluctuation threshold is determined by statistically analyzing the cosine similarity distribution of each day in the past 15 days and the remaining 14 days, and taking the 5th percentile as the threshold.

[0034] Further, real-time analysis includes: The call trajectory of each user within a preset short time window is cached in memory. The trajectory includes user identifier, operation type, call result and timestamp. The short cache window can be configured to 2 seconds, and the cache uses a circular queue to store the 5 most recent records. When assessing the risk of the current call behavior, a joint assessment is made based on the current operation and the call trajectory. If a preset abnormal combination of behaviors is detected within a preset short time window, a real-time analysis alarm event is generated.

[0035] Further sequence analysis includes: Configure sequence analysis rules, which include time window size, user identifier, and operation sequence combination. When the real-time data acquired within the time window meets the sequence analysis rules, a sequence analysis alarm event is generated. A whitelist of operation sequences is created for each user. When a sequence analysis alarm event is determined to be a false alarm, the corresponding operation sequence is added to the whitelist and an expiration time is set. If subsequent operations match the whitelist, no alarm will be generated. The default expiration time of the whitelist is 24 hours, and it supports automatic renewal or shortening based on changes in user behavior.

[0036] Through the collaborative detection of batch analysis, real-time analysis, and sequence analysis in this step, this embodiment can comprehensively identify abnormal call behavior of the cryptographic service platform from multiple dimensions such as time-slice weighted risk, time phase distribution offset, short-term abnormal behavior combinations, and time-series operation sequences. Compared with single-dimensional detection methods, this multi-dimensional parallel analysis mechanism can automatically increase the sensitivity coefficient at night or on holidays to enhance monitoring, and can effectively reduce the false alarm rate by using short-term caching and sequence whitelists. This achieves accurate capture of highly covert attacks and improves the cryptographic service platform's ability to identify and respond to complex attack behaviors.

[0037] In this embodiment S3, the alarm events are classified and graded according to their alarm source and risk impact level to obtain graded alarm events; wherein, the classification and grading includes: Alarm events are categorized into user behavior alarms and platform operation alarms based on their source. User behavior alarms include high-frequency call behavior alarms, sensitive operation behavior alarms, abnormal operation behavior alarms, and unauthorized operation behavior alarms. Platform operation alarms include node resource overload alarms, abnormal node status alarms, and abnormal service performance alarms. Alarm events are classified into emergency alarms, important alarms, and general alarms based on the degree of risk impact.

[0038] Based on the classification and grading, this embodiment also sets up a dynamic priority adjustment mechanism: when the same user triggers multiple general alarms in a short period of time, the system automatically upgrades the last alarm to an important alarm; if an emergency alarm occurs on a core node of the platform, user behavior alarms related to that node are temporarily blocked to avoid interfering with the judgment of operation and maintenance personnel; after classification, all types of alarm events uniformly carry level labels and source identifiers, which allow the intelligent decision-making model to select the aggressiveness of the control strategy based on the level threshold. For example, an emergency alarm corresponds to a higher confidence threshold to trigger automatic blocking, while the threshold for important alarms can be appropriately relaxed to improve the response speed.

[0039] In this embodiment, S4, based on the graded alarm events, a corresponding control strategy is generated through a pre-trained intelligent decision-making model; wherein, the intelligent decision-making model is a collaborative model based on K-means clustering and XGBoost classification, and the pre-training process includes: Extract user behavior features, platform status features, and context features from the call log database or monitoring components, and construct a feature vector set; Based on the feature vector set, continuous features are standardized and discrete features are one-hot encoded, and the standardized and encoded feature vectors are output. The K-means clustering algorithm is used to divide the standardized and encoded feature vector into multiple risk clusters. The cluster number of each sample is recorded, and the cluster number is added to the original feature vector as a new feature to output the enhanced feature vector. Using the enhanced feature vector as input and the actual control strategy results corresponding to historical alarms as labels, an XGBoost multi-classification model is trained to obtain the trained model; the objective function of the XGBoost multi-classification model is:

[0040] in The logarithmic loss function, For predicted values, For real labels, For the regularization term of the k-th decision tree, The number of decision trees.

[0041] Furthermore, in the K-means clustering algorithm, the optimal number of clusters... By selecting the sum of squares within the cluster The K value corresponding to the descent inflection point is used to determine the sum of squares within the cluster. Represented as:

[0042] in, For data points, The number of clusters, For the i-th cluster, Let be the centroid of the i-th cluster; Specifically, a curve is plotted with K as the x-axis and SSE(K) as the y-axis. The K corresponding to the inflection point where the curve changes from a rapid descent to a gradual descent is selected as the optimal number of clusters. If there is no obvious inflection point, the silhouette coefficient method or interval statistics method can be used to assist in the determination.

[0043] Furthermore, the corresponding control strategies include: For newly generated graded alarm events, their feature vectors are extracted, standardized, and one-hot encoded. The cluster number of the risk cluster to which the processed feature vector belongs is obtained through the K-means algorithm. The cluster number is then concatenated with the processed feature vector as an additional feature to form the corresponding enhanced feature vector. The enhanced feature vectors are input into the trained XGBoost model, which outputs the predicted probability and confidence of each candidate control strategy. Based on confidence level Compared with the preset first confidence threshold Second confidence threshold Relationship generation hierarchical control strategy: If If, then the highest probability strategy is generated; if Then a compromise control strategy is generated; if Then, a strategy to be reviewed by the system is generated; Taking a financial payment scenario as an example, when a tiered alarm event occurs when user A fails to call the key decryption interface 10 times consecutively within 1 minute, the system extracts features such as the user's recent operation frequency, failure rate, and historical key operation count. After standardization and one-hot encoding, K-means is used to determine that the user belongs to a high-risk abnormal call cluster. The cluster number is concatenated with the feature vector and input into the XGBoost model. The model outputs the probabilities of three candidate strategies: account ban (0.92), account rate limiting (0.06), and logging only (0.02). Since the confidence level of 0.92 is higher than the first confidence threshold (0.85), the system automatically generates and executes the account ban strategy and pushes an alarm summary to the security administrator.

[0044] For general operational anomalies within the government system, such as a user querying a small amount of non-sensitive key information outside of working hours, the confidence level output by the model may be 0.65 (between the second threshold of 0.60 and the first threshold of 0.85). In this case, the system generates a compromise control strategy, such as only temporarily limiting the account and sending an email notification, rather than directly banning it, to avoid affecting normal office work the next day. If the confidence level is lower than the second threshold due to data sparsity, the model outputs a flag indicating that the system needs to review the alert event, storing the alert event in the review queue for subsequent verification to ensure decision security.

[0045] The cryptographic service platform call behavior analysis and intelligent decision-making method in this embodiment ensures the authenticity and reliability of call data by constructing a consistent trust link between the SDK, gateway, and cryptographic server. It then integrates batch analysis, real-time analysis, and sequence analysis to identify risks in cryptographic service call behavior from all dimensions and generate hierarchical alarms. Finally, it uses an intelligent decision-making model that combines K-means clustering and XGBoost to automatically output control strategies that match the confidence level. This achieves a fully automated closed loop from data collection and behavior analysis to strategy generation, effectively solving problems such as unreliable data, single analysis dimensions, and delayed manual handling in existing technologies. It improves the continuous protection capability and decision-making accuracy of the cryptographic service platform in unattended scenarios.

[0046] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0047] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for analyzing and intelligently deciding on the invocation behavior of a cryptographic service platform, characterized in that, Includes the following steps: S1. Establish a consistent trust link between the SDK end, the platform gateway end and the password service end, and perform full-link trusted verification on the password service call request initiated by the user to obtain trusted call data; S2. Perform batch analysis, real-time analysis, and sequence analysis on the trusted call data and platform status data respectively to generate alarm events; The batch analysis includes: Differentiated risk weights are assigned to different types of password operations. Based on the impact of the operation on the security of the password service platform, a corresponding preset risk weight value is set for each operation type. The weighted total risk value of the target users within a specified time window is calculated. ,in Let the risk weight be the i-th type of operation. This refers to the number of times this type of operation is called within the time window. Number of operation types; Calculate dynamic risk threshold. ,in It is the historical weighted risk average. The historical weighted risk standard deviation, The preset sensitivity coefficient; when the weighted total risk value When the risk exceeds the dynamic risk threshold T, a batch analysis alarm event is generated; S3. Classify and grade the alarm events according to their alarm sources and risk impact levels to obtain graded alarm events; S4. Based on the tiered alarm events, generate corresponding control strategies using a pre-trained intelligent decision-making model; the intelligent decision-making model is a collaborative model based on K-means clustering and XGBoost classification, and the pre-training process includes: User behavior features, platform status features, and context features are extracted from the call log database or monitoring components to construct a feature vector set. Based on the feature vector set, continuous features are standardized, and discrete features are one-hot encoded to output standardized and encoded feature vectors. The standardized and encoded feature vectors are divided into multiple risk clusters using the K-means clustering algorithm. The cluster number of each sample is recorded, and the cluster number is added as a new feature to the original feature vector to output an enhanced feature vector. The enhanced feature vector is used as input, and the actual control strategy results corresponding to historical alarms are used as labels to train an XGBoost multi-classification model to obtain the trained model.

2. The method for analyzing and intelligently deciding on the call behavior of a cryptographic service platform according to claim 1, characterized in that, In step S1, establishing a consistent trust link between the SDK end, the platform gateway end, and the cryptographic server includes: On the SDK side, the request body of the cryptographic service call is hashed, and the hash value is signed using the user's hardware device to generate a trusted request message; At the platform gateway, the trusted request message is received, the signature value is verified and the validity of the request timestamp is checked. After the signature verification is successful, the gateway generates a relay signature value, and the request body is combined with the relay signature value and then routed to the cryptographic server. On the password server side, the validity of the SDK signature and the gateway relay signature is verified again, and the user's permissions and operation type are confirmed. The password operation is only executed when both are verified and the permissions match.

3. The method for analyzing and intelligently deciding on the call behavior of a cryptographic service platform according to claim 1, characterized in that, In S2, the batch analysis also includes anomaly detection based on time phase: Based on the historical call data of the target user for a preset number of historical days Q, each day is divided into a preset number M equal-length time slices. The number of calls within each time slice is counted to obtain a historical time distribution vector. The historical phase probability distribution is obtained by normalization. ; Calculate the real-time distribution of the real-time data within the current detection window. and its normalized distribution ; Using cosine similarity The similarity Sim is measured to be below a preset dynamic fluctuation threshold. When the similarity Sim is below the threshold, it is determined to be an abnormal time phase and a batch analysis alarm event is generated.

4. The method for analyzing and intelligently deciding on the calling behavior of a cryptographic service platform according to claim 1, characterized in that, In S2, real-time analysis includes: The call trajectory of each user within a preset short time window is cached in memory. The trajectory includes user identifier, operation type, call result and timestamp. When assessing the risk of the current call behavior, a joint assessment is made based on the current operation and the call trajectory. If a preset abnormal combination of behaviors is detected within a preset short time window, a real-time analysis alarm event is generated.

5. The method for analyzing and intelligently deciding on the call behavior of a cryptographic service platform according to claim 1, characterized in that, In S2, sequence analysis includes: Configure sequence analysis rules, which include time window size, user identifier, and operation sequence combination. When the real-time data acquired within the time window meets the sequence analysis rules, a sequence analysis alarm event is generated. An operation sequence whitelist is created for each user. When a sequence analysis alarm event is determined to be a false alarm, the corresponding operation sequence is added to the whitelist and an expiration time is set. If subsequent operations match the whitelist, no alarm will be generated.

6. The method for analyzing and intelligently deciding on the call behavior of a cryptographic service platform according to claim 1, characterized in that, In S3, the classification and grading include: Alarm events are categorized into user behavior alarms and platform operation alarms based on their source. User behavior alarms include high-frequency call behavior alarms, sensitive operation behavior alarms, abnormal operation behavior alarms, and unauthorized operation behavior alarms. Platform operation alarms include node resource overload alarms, abnormal node status alarms, and abnormal service performance alarms. Alarm events are classified into emergency alarms, important alarms, and general alarms based on the degree of risk impact.

7. The method for analyzing and intelligently deciding on the call behavior of a cryptographic service platform according to claim 1, characterized in that, In the K-means clustering algorithm, the optimal number of clusters is... By selecting the sum of squares within the cluster The K value corresponding to the descent inflection point is used to determine the sum of squares within the cluster. Represented as: in, For data points, The number of clusters, For the i-th cluster, Let be the centroid of the i-th cluster.

8. The method for analyzing and intelligently deciding on the calling behavior of a cryptographic service platform according to claim 1, characterized in that, In step S4, generating the corresponding control policy includes: For newly generated graded alarm events, their feature vectors are extracted, standardized, and one-hot encoded. The cluster number of the risk cluster to which the processed feature vector belongs is obtained through the K-means algorithm. The cluster number is then concatenated with the processed feature vector as an additional feature to form the corresponding enhanced feature vector. The enhanced feature vectors are input into the trained XGBoost model, which outputs the predicted probability and confidence of each candidate control strategy. Based on confidence level Compared with the preset first confidence threshold Second confidence threshold Relationship generation hierarchical control strategy: If If, then the highest probability strategy is generated; if Then a compromise control strategy is generated; if Then, a strategy for system review is generated.

Images