Geospatial data security risk monitoring method based on user entity behavior analysis

Abstract

This invention proposes a geospatial data security risk monitoring method based on user entity behavior analysis. The method includes: S1, multi-source heterogeneous data acquisition and semantic preprocessing; S2, multi-dimensional behavioral feature extraction and vectorized representation; S3, adaptive behavioral baseline modeling and dynamic updating; S4, multi-level anomaly detection and risk quantification; and S5, adaptive response and dynamic handling: executing response measures according to risk scores. This invention's risk-score-based hierarchical response mechanism effectively reduces the cost of handling security incidents while ensuring business continuity.

Description

Technical Field

[0001] This invention relates to the field of risk monitoring technology, and in particular to a geospatial data security risk monitoring method based on user entity behavior analysis. Background Technology

[0002] With the rapid development of Geographic Information System (GIS) technology and the deepening of digital transformation, geospatial data has become an important production factor, widely used in key areas such as smart cities and natural resource management. Geospatial data is characterized by high precision, high sensitivity, and high value, and its security is directly related to personal privacy. However, traditional data security protection methods mainly rely on static access control policies and boundary protection mechanisms. Therefore, there is an urgent need for a user entity behavior analysis technology that integrates geospatial characteristics to achieve accurate perception and intelligent early warning of geospatial data security risks. Summary of the Invention

[0003] This invention aims to at least solve the technical problems existing in the prior art, and in particular, it innovatively proposes a geospatial data security risk monitoring method based on user entity behavior analysis.

[0004] To achieve the above-mentioned objectives of this invention, this invention provides a geospatial data security risk monitoring method based on user entity behavior analysis, comprising the following steps:

[0005] S1, Multi-source heterogeneous data acquisition and semantic preprocessing: Collect and integrate multi-source data to construct structured behavioral event records;

[0006] S2, Multi-dimensional behavioral feature extraction and vectorization representation: extracting behavioral features from four dimensions: temporal, spatial, semantic, and relational, forming a unified behavioral feature vector;

[0007] S3, Adaptive Behavioral Baseline Modeling and Dynamic Update: Establish personalized behavioral baselines based on historical behavioral data and dynamically evolve them over time;

[0008] S4, Multi-level Anomaly Detection and Risk Quantification: Anomalies are detected at four levels: individual, group, spatiotemporal context, and collaboration, and a comprehensive risk score is calculated by integrating them.

[0009] S5, Adaptive Response and Dynamic Handling: Implement response measures based on risk score classification.

[0010] In a preferred embodiment of the present invention, the multi-source heterogeneous data collected in step S1 includes one or any combination of geospatial data access logs, user identity attributes, terminal environment information, network layer data, and data resource metadata.

[0011] In a preferred embodiment of the present invention, the semantic preprocessing of the collected data in step S1 includes extracting user identity entities, data resource entities, spatiotemporal context entities, and operation behavior entities, and constructing a four-tuple structured behavior event record:

[0012] ,

[0013] in, This represents a structured record of behavioral events represented by a quadruple;

[0014] Represents the user entity, user entity Including user identifier Organizational structure attributes Job Responsibilities Historical Reputation Score One or any combination;

[0015] Represents a data resource entity. Including data identification Data types Geographical coverage Sensitivity Level Business attribution One or any combination;

[0016] Represents a vector. Represents a grid. Representing a 3D model, Represents metadata;

[0017] Geographical coverage minimum bounding rectangle As a delineated area;

[0018] in, Indicates the longitude of the western boundary within the rectangle;

[0019] Indicates the latitude of the southern boundary within the rectangle;

[0020] Indicates the longitude of the eastern boundary of the rectangle;

[0021] Indicates the latitude of the northern boundary within the rectangle;

[0022] Represents a spatiotemporal context entity. Including operation timestamps Terminal geographical location Network access point fingerprint of terminal device One or any combination;

[0023] Indicates the terminal's longitude location;

[0024] Indicates the latitude of the terminal location;

[0025] Represents the entity that performs the operation. Including operation type Operation results , amount of returned data Spatial query range One or any combination;

[0026] Indicates a query. Indicates download. This indicates a preview. Indicates analysis, Indicates sharing, This indicates an export.

[0027] In a preferred embodiment of the present invention, behavioral features are extracted from four dimensions based on behavioral event records in step S2:

[0028] S21, Temporal Behavior Characteristics Using a sliding time window to count user activity Operation frequency, total data downloaded, and operation type distribution entropy within a given time period:

[0029] ,

[0030] in, Represents the distribution entropy;

[0031] Indicates the number of operation types;

[0032] Indicates the first Percentage of similar operations;

[0033] S22, Spatial Behavior Characteristics Extracting spatial relationship features between terminal geographic location and data coverage, including:

[0034] Distance features This indicates the distance between the user's location and the data center;

[0035] in, Indicates the distance between the user's location and the data center;

[0036] Represents the Harvard sine function;

[0037] Indicates the terminal's geographical location;

[0038] Represents the geometric center function;

[0039] Indicates geographical coverage;

[0040] Regional overlap ,

[0041] in, Indicates the degree of overlap between regions;

[0042] This function represents the calculation function for the projected area of ​​a plane.

[0043] A radius buffer representing the user's location;

[0044] Intersection symbol;

[0045] Indicates geographical coverage;

[0046] Spatial access concentration ,

[0047] in, Indicates spatial access concentration;

[0048] This indicates the number of regions a user has frequently visited in the past.

[0049] This indicates the number of times a frequently accessed area has been visited;

[0050] Indicates the first Number of visits to each region;

[0051] Represents the Euclidean distance function;

[0052] Indicates the current geographical location of the terminal;

[0053] Indicates the first Geometric center coordinates of a historically frequently visited region;

[0054] S23, Semantic Behavioral Features Extracting business domain relevance based on data resource metadata. Percentage of access to sensitive data Cross-departmental data access frequency ;

[0055] S24, Related Behavioral Characteristics Construct a user-data bipartite graph and extract graph structure features;

[0056] The above features are concatenated to form a behavioral feature vector. ,

[0057] Represents a behavioral feature vector;

[0058] Indicates temporal behavioral characteristics;

[0059] Indicates spatial behavioral characteristics;

[0060] Represents semantic behavioral features;

[0061] Indicates the characteristics of related behaviors.

[0062] In a preferred embodiment of the present invention, in step S3, a personalized behavior baseline model is established for each user entity based on historical behavior data:

[0063] S31, Normal Behavior Pattern Learning: A variational autoencoder is used to learn the latent distribution of normal user behavior. The encoder then processes the behavioral features... Mapping to latent variables Decoder reconstruction Optimization is achieved by minimizing the reconstruction error and KL divergence:

[0064] ,

[0065] in, Indicates information about the encoder The expectation operator;

[0066] The posterior distribution of the encoder output is represented by a Gaussian distribution.

[0067] This represents the likelihood distribution of the decoder output;

[0068] This represents the regularization parameter, which controls the tradeoff between reconstruction accuracy and potential spatial regularity.

[0069] Represents the divergence metric function;

[0070] Represent the prior distribution; use the standard normal distribution;

[0071] Represents a behavioral feature vector;

[0072] This indicates that the encoder will generate behavioral feature vectors. Mapping to latent variables;

[0073] S32, Group Behavior Pattern Learning: For new users or users with sparse behavior, a transfer learning strategy based on similar users is adopted to calculate the similarity between users. ,in, Indicates the first User attribute embedding vector, Indicates the first User attribute embedding vector, Represents the cosine similarity function. Indicates the first user With the user Similarity; Constructing a hybrid model of group behavior:

[0074] ,

[0075] in, Represents the probability distribution of a group;

[0076] Indicates the number of user clusters;

[0077] Indicates the first Mixing coefficients for individual user clusters;

[0078] Indicates a Gaussian distribution;

[0079] Represents a behavioral feature vector;

[0080] Indicates the first The mean vector of each user cluster;

[0081] Indicates the first The covariance matrix of each user cluster;

[0082] S33, Dynamic Update Mechanism: Uses a weighted moving average to update baseline parameters for behavior, adapting to the evolution of user behavior.

[0083] ,

[0084] in, express The mean vector of behavior at any given time;

[0085] The learning rate is dynamically adjusted based on behavioral stability.

[0086] express The behavioral feature vector observed at each moment;

[0087] express The mean vector of behavior at each time step.

[0088] In a preferred embodiment of the present invention, step S4 includes:

[0089] S41, Individual-level anomaly detection: Calculate the deviation of the current behavior from the individual baseline:

[0090] ,

[0091] in, Indicates an individual's abnormal score;

[0092] Represents a behavioral feature vector;

[0093] Represents the mean vector of user behavior;

[0094] Represents the L2 norm;

[0095] Indicates the balance coefficient;

[0096] Represents the reconstruction loss function; ,

[0097] in, Represents a behavioral feature vector;

[0098] This represents the feature vector reconstructed by the decoder;

[0099] Represents the L2 norm;

[0100] S42, Group-level Anomaly Detection: Calculating the deviation from group behavior:

[0101] ,

[0102] in, Indicates the abnormality score of the group;

[0103] Represents the probability distribution of a group;

[0104] Represents a behavioral feature vector;

[0105] Indicates user;

[0106] S43, Spatiotemporal Context Anomaly Detection: Design a dedicated detector for geospatial characteristics.

[0107] Geographic jump detection: Calculating geographic speed ,like This will trigger an exception;

[0108] in, Indicates geographical speed;

[0109] Represents the Harvard sine function;

[0110] express The geographical location of the terminal at any given moment; , express The terminal longitude position at any given time; express The terminal latitude position at any given moment;

[0111] express The geographical location of the terminal at any given moment; , express The terminal longitude position at any given time; express The terminal latitude position at any given moment;

[0112] Indicates a time interval;

[0113] This indicates the preset maximum speed threshold;

[0114] Abnormal Area Access: Constructing a set of frequently accessed areas by users based on historical data. If the current data coverage area And sensitivity level If so, the risk level will be raised;

[0115] in, This represents the set of areas frequently visited by the user.

[0116] Indicates geographical coverage;

[0117] Symbol for empty set;

[0118] Indicates the sensitivity level;

[0119] Spatiotemporal clustering anomalies: Detecting patterns of multiple users accessing the same sensitive area within a short period and calculating the spatiotemporal clustering coefficient.

[0120] ,

[0121] in, Represents the spatiotemporal aggregation coefficient;

[0122] Indicates time window Number of users accessing sensitive areas;

[0123] Indicates the area of ​​the sensitive region;

[0124] Indicates the first The area of ​​the sensitive data sub-region accessed by each user;

[0125] Indicates the first The distance from the location of each user terminal to the center of the sensitive area;

[0126] when and At that time, it was determined to be a spatiotemporal aggregation anomaly;

[0127] in, Indicates the preset aggregation threshold;

[0128] This indicates a preset user count threshold;

[0129] S44, Collaborative Anomaly Detection: Detects abnormal behavior patterns of multiple related users within the same time period and calculates a collaborative anomaly score.

[0130] ,

[0131] in, Indicates the score of collaborative anomalies;

[0132] Indicates user The set of associated users;

[0133] Indicates user With users Similarity;

[0134] Indicates associated users Individual abnormality scores;

[0135] This represents the function that takes the maximum value.

[0136] S45, Comprehensive Risk Score: Integrates multi-layered anomaly indicators and employs weighted ensemble:

[0137] ,

[0138] in, This indicates the overall score;

[0139] It is the sigmoid activation function;

[0140] This represents the normalized outlier scores. ,

[0141] This represents the normalized weights; ,

[0142] Represents the normalized individual anomaly score The weights;

[0143] This represents the normalized individual anomaly score; the normalization method used is Min-Max normalization.

[0144] Represents the normalized population outlier score The weights;

[0145] This represents the normalized group outlier score;

[0146] Represents the normalized spatial context anomaly score The weights;

[0147] This represents the normalized spatial context anomaly score.

[0148] Represents the normalized co-anomaly score The weights;

[0149] This represents the normalized co-abnormal score.

[0150] In a preferred embodiment of the present invention, step S5 includes basing decisions on risk scores. The graded response is as follows:

[0151] like < If so, it is considered low risk;

[0152] like ≤ < If so, it is considered medium risk;

[0153] like ≤ < This indicates a high risk.

[0154] like ≥ This would be considered extremely high risk;

[0155] This indicates a preset first risk threshold; This indicates a preset second risk threshold; This indicates a preset third risk threshold; < < .

[0156] In a preferred embodiment of the present invention, the measures include:

[0157] Low risk: Log the information and allow passage normally;

[0158] Medium risk: Triggering two-factor authentication;

[0159] High risk: Block the operation in real time and notify the security administrator;

[0160] Extremely high risk: Account will be automatically frozen.

[0161] The present invention also discloses a computer system, comprising:

[0162] processor;

[0163] Memory used to store processor-executable instructions;

[0164] The processor is configured to implement a geospatial data security risk monitoring method based on user entity behavior analysis when executing the executable instructions.

[0165] The present invention also discloses a computer-readable storage medium, comprising:

[0166] A memory on which computer programs are stored;

[0167] A processor is configured to execute the program in the memory to implement a geospatial data security risk monitoring method based on user entity behavior analysis.

[0168] In summary, by employing the above-mentioned technical solutions, this invention achieves unified representation and deep correlation analysis of multi-source heterogeneous data through the construction of a four-tuple semantic behavioral event model; it establishes a personalized adaptive behavioral baseline by combining a variational autoencoder with a swarm hybrid model, effectively solving the detection drift problem caused by the dynamic evolution of behavioral patterns; it innovatively designs a multi-dimensional spatial feature extraction method that integrates geographical speed, regional overlap, and spatial access concentration, significantly improving the detection accuracy of spatial context anomalies such as geographical jumps and abnormal area access; through anomaly detection and weighted fusion at four levels—individual, swarm, spatiotemporal, and collaborative—it achieves in-depth defense from single-point anomalies to attack chains; and the risk-scoring-based hierarchical response mechanism effectively reduces the handling cost of security incidents while ensuring business continuity.

[0169] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0170] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:

[0171] Figure 1 This is a schematic flowchart of the present invention. Detailed Implementation

[0172] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0173] This invention discloses a geospatial data security risk monitoring method based on user entity behavior analysis, such as... Figure 1 As shown, it includes:

[0174] S1, Multi-source heterogeneous data acquisition and semantic preprocessing: Collect and integrate multi-source data to construct structured behavioral event records;

[0175] S2, Multi-dimensional behavioral feature extraction and vectorization representation: extracting behavioral features from four dimensions: temporal, spatial, semantic, and relational, forming a unified behavioral feature vector;

[0176] S3, Adaptive Behavioral Baseline Modeling and Dynamic Update: Establish personalized behavioral baselines based on historical behavioral data and dynamically evolve them over time;

[0177] S4, Multi-level Anomaly Detection and Risk Quantification: Anomalies are detected at four levels: individual, group, spatiotemporal context, and collaboration, and a comprehensive risk score is calculated by integrating them.

[0178] S5, Adaptive Response and Dynamic Handling: Implement response measures based on risk score classification.

[0179] In a preferred embodiment of the present invention, the multi-source heterogeneous data collected in step S1 includes one or any combination of geospatial data access logs, user identity attributes, terminal environment information, network layer data, and data resource metadata.

[0180] Semantic preprocessing of the collected data includes extracting user identity entities, data resource entities, spatiotemporal context entities, and operation behavior entities, and constructing a four-tuple structured behavior event record:

[0181] ,

[0182] in, This represents a structured record of behavioral events represented by a quadruple;

[0183] Represents the user entity, user entity Including user identifier Organizational structure attributes Job Responsibilities Historical Reputation Score One or any combination;

[0184] Represents a data resource entity. Including data identification Data types Geographical coverage Sensitivity Level Business attribution One or any combination;

[0185] Represents a vector. Represents a grid. Representing a 3D model, Represents metadata;

[0186] Geographical coverage minimum bounding rectangle As a delineated area;

[0187] in, It represents the longitude of the western boundary of the rectangle, and also the minimum longitude;

[0188] This represents the latitude of the southern boundary of the rectangle, and also the minimum latitude.

[0189] This indicates the longitude of the eastern boundary of the rectangle, and also the maximum longitude.

[0190] It represents the latitude of the northern boundary of the rectangle, and also the maximum longitude;

[0191] Represents a spatiotemporal context entity. Including operation timestamps Terminal geographical location Network access point fingerprint of terminal device One or any combination;

[0192] Indicates the terminal's longitude location;

[0193] Indicates the latitude of the terminal location;

[0194] Represents the entity that performs the operation. Including operation type Operation results , amount of returned data Spatial query range One or any combination;

[0195] Indicates a query. Indicates download. This indicates a preview. Indicates analysis, Indicates sharing, This indicates an export.

[0196] In a preferred embodiment of the present invention, behavioral features are extracted from four dimensions based on behavioral event records in step S2:

[0197] S21, Temporal Behavior Characteristics Using a sliding time window to count user activity Operation frequency, total data downloaded, and operation type distribution entropy within a given time period:

[0198] ,

[0199] in, Represents the distribution entropy;

[0200] Indicates the number of operation types;

[0201] Indicates the first Percentage of similar operations;

[0202] Calculate access time concentration (Based on hourly access distribution and cosine similarity to historical patterns);

[0203] S22, Spatial Behavior Characteristics Extracting spatial relationship features between terminal geographic location and data coverage, including:

[0204] Distance features This indicates the distance between the user's location and the data center;

[0205] in, Indicates the distance between the user's location and the data center;

[0206] Represents the Harvard sine function;

[0207] Indicates the terminal's geographical location;

[0208] Represents the geometric center function;

[0209] Indicates geographical coverage;

[0210] Regional overlap ,

[0211] in, Indicates the degree of overlap between regions;

[0212] This function represents the calculation function for the projected area of ​​a plane.

[0213] A radius buffer representing the user's location;

[0214] Intersection symbol;

[0215] Indicates geographical coverage;

[0216] Spatial access concentration ,

[0217] in, Indicates spatial access concentration;

[0218] This indicates the number of regions a user has frequently visited in the past.

[0219] This indicates the number of times a frequently accessed area has been visited;

[0220] Indicates the first Number of visits to each region;

[0221] Represents the Euclidean distance function;

[0222] Indicates the current geographical location of the terminal;

[0223] Indicates the first Geometric center coordinates of a historically frequently visited region;

[0224] S23, Semantic Behavioral Features Extracting business domain relevance based on data resource metadata. (The degree of matching between user responsibilities and data service tags), the proportion of access to sensitive data Cross-departmental data access frequency ;

[0225] S24, Related Behavioral Characteristics Construct a user-data bipartite graph and extract graph structure features, including the number of common neighbors. (Number of entities commonly associated with users and data resources), preference similarity (Based on cosine similarity of historical visit vectors).

[0226] The above features are concatenated to form a behavioral feature vector. ,

[0227] Represents a behavioral feature vector;

[0228] Indicates temporal behavioral characteristics;

[0229] Indicates spatial behavioral characteristics;

[0230] Represents semantic behavioral features;

[0231] Indicates related behavioral characteristics;

[0232] Represent the space of real numbers;

[0233] Indicates dimension.

[0234] In a preferred embodiment of the present invention, in step S3, a personalized behavior baseline model is established for each user entity based on historical behavior data:

[0235] S31, Normal Behavior Pattern Learning: A variational autoencoder (VAE) is used to learn the latent distribution of normal user behavior. The encoder then processes the behavioral features... Mapping to latent variables Decoder reconstruction Optimization is achieved by minimizing the reconstruction error and KL divergence:

[0236] ,

[0237] in, Indicates information about the encoder The expectation operator;

[0238] The posterior distribution of the encoder output is represented by a Gaussian distribution.

[0239] This represents the likelihood distribution of the decoder output;

[0240] This represents the regularization parameter, which controls the tradeoff between reconstruction accuracy and potential spatial regularity.

[0241] Represents the divergence metric function;

[0242] Represent the prior distribution; use the standard normal distribution;

[0243] Represents a behavioral feature vector;

[0244] This indicates that the encoder will generate behavioral feature vectors. Mapping to latent variables;

[0245] S32, Group Behavior Pattern Learning: For new users or users with sparse behavior, a transfer learning strategy based on similar users is adopted to calculate the similarity between users. ,in, Indicates the first User attribute embedding vector, Indicates the first User attribute embedding vector, Represents the cosine similarity function. Indicates the first user With the user Similarity; Constructing a hybrid model of group behavior:

[0246] ,

[0247] in, Represents the probability distribution of a group;

[0248] Indicates the number of user clusters;

[0249] Indicates the first Mixing coefficients for individual user clusters;

[0250] Indicates a Gaussian distribution;

[0251] Represents a behavioral feature vector;

[0252] Indicates the first The mean vector of each user cluster;

[0253] Indicates the first The covariance matrix of each user cluster;

[0254] S33, Dynamic Update Mechanism: Employs an exponentially weighted moving average to update baseline behavioral parameters, adapting to the slow evolution of user behavior.

[0255] ,

[0256] in, express The mean vector of behavior at any given time;

[0257] The learning rate is dynamically adjusted based on behavioral stability.

[0258] express The behavioral feature vector observed at each moment;

[0259] express The mean vector of behavior at each time step.

[0260] In a preferred embodiment of the present invention, step S4 includes:

[0261] S41, Individual-level anomaly detection: Calculate the deviation of the current behavior from the individual baseline:

[0262] ,

[0263] in, Indicates an individual's abnormal score;

[0264] Represents a behavioral feature vector;

[0265] Represents the mean vector of user behavior;

[0266] Represents the L2 norm;

[0267] Indicates the balance coefficient;

[0268] Represents the reconstruction loss function; ,

[0269] in, Represents a behavioral feature vector;

[0270] This represents the feature vector reconstructed by the decoder;

[0271] Represents the L2 norm;

[0272] S42, Group-level Anomaly Detection: Calculating the deviation from group behavior:

[0273] ,

[0274] in, Indicates the abnormality score of the group;

[0275] This represents the probability distribution of a group; it also represents the probability distribution of a given user. Under these conditions, behavioral characteristics The probability distribution of ; its base is the natural constant e;

[0276] Represents a behavioral feature vector;

[0277] Indicates user;

[0278] S43, Spatiotemporal Context Anomaly Detection: Design a dedicated detector for geospatial characteristics.

[0279] Geographic jump detection: Calculating geographic speed ,like This will trigger an exception;

[0280] in, Indicates geographical speed;

[0281] Represents the Harvard sine function;

[0282] express The geographical location of the terminal at any given moment; , express The terminal longitude position at any given time; express The terminal latitude position at any given moment;

[0283] express The geographical location of the terminal at any given moment; , express The terminal longitude position at any given time; express The terminal latitude position at any given moment;

[0284] Indicates a time interval;

[0285] This indicates the preset maximum speed threshold;

[0286] Abnormal Area Access: Constructing a set of frequently accessed areas by users based on historical data. If the current data coverage area And sensitivity level If so, the risk level will be raised;

[0287] in, This represents the set of areas frequently visited by the user.

[0288] Indicates geographical coverage;

[0289] Symbol for empty set;

[0290] Indicates the sensitivity level;

[0291] Spatiotemporal clustering anomalies: Detect patterns of multiple users accessing the same sensitive area within a short period (e.g., 1 hour), and calculate the spatiotemporal clustering coefficient.

[0292] ,

[0293] in, Represents the spatiotemporal aggregation coefficient;

[0294] Indicates time window Number of users accessing sensitive areas;

[0295] Indicates the area of ​​the sensitive region;

[0296] Indicates the first The area of ​​the sensitive data sub-region accessed by each user;

[0297] Indicates the first The distance from the location of each user terminal to the center of the sensitive area;

[0298] when and At that time, it was determined to be a spatiotemporal aggregation anomaly;

[0299] in, Indicates the preset aggregation threshold;

[0300] This indicates a preset user count threshold;

[0301] ,

[0302] in, Indicates the spatial context anomaly score;

[0303] This indicates that the maximum abnormality indication value among the three tests is taken;

[0304] This indicates an indicator function; it takes the value 1 if the condition is met, and 0 otherwise.

[0305] Indicates geographical speed;

[0306] This indicates the preset maximum speed threshold;

[0307] Indicates geographical coverage;

[0308] This represents the set of areas frequently visited by the user.

[0309] Symbol for empty set;

[0310] Indicates the sensitivity level;

[0311] Represents the spatiotemporal aggregation coefficient;

[0312] Indicates the preset aggregation threshold;

[0313] This indicates a preset user count threshold;

[0314] Indicates time window Number of users accessing sensitive areas;

[0315] This indicates logical AND;

[0316] S44, Collaborative Anomaly Detection: Detects abnormal behavior patterns of multiple related users within the same time period and calculates a collaborative anomaly score.

[0317] ,

[0318] in, Indicates the score of collaborative anomalies;

[0319] Indicates user The set of associated users;

[0320] Indicates user With users Similarity;

[0321] Indicates associated users Individual abnormality scores;

[0322] This represents the function that takes the maximum value.

[0323] S45, Comprehensive Risk Score: Integrates multi-layered anomaly indicators and employs weighted ensemble:

[0324] ,

[0325] in, This indicates the overall score;

[0326] It is the sigmoid activation function;

[0327] This represents the normalized outlier scores. ,

[0328] This represents the normalized weights; ,

[0329] Represents the normalized individual anomaly score The weights;

[0330] This represents the normalized individual anomaly score; the normalization method used is Min-Max normalization.

[0331] Represents the normalized population outlier score The weights;

[0332] This represents the normalized group outlier score;

[0333] Represents the normalized spatial context anomaly score The weights;

[0334] This represents the normalized spatial context anomaly score.

[0335] Represents the normalized co-anomaly score The weights;

[0336] This represents the normalized co-abnormal score.

[0337] In a preferred embodiment of the present invention, step S5 includes basing decisions on risk scores. The graded response is as follows:

[0338] like < If so, it is considered low risk;

[0339] like ≤ < If so, it is considered medium risk;

[0340] like ≤ < This indicates a high risk.

[0341] like ≥ This would be considered extremely high risk;

[0342] This indicates a preset first risk threshold; This indicates a preset second risk threshold; This indicates a preset third risk threshold; < < When taking specific values, low risk ( <0.3): Log the message and allow passage normally;

[0343] Medium risk (0.3≤ <0.7): Triggers two-factor authentication (such as SMS verification, facial recognition);

[0344] High risk (0.7≤ <0.9): Block the operation in real time and notify the security administrator;

[0345] Extremely high risk ≥0.9): Automatically freeze the account and initiate the emergency response process.

[0346] In a preferred embodiment of the present invention, step S6 is further included: risk correlation analysis and attack chain reconstruction: deep correlation mining is performed on high-risk events to reconstruct the attack chain and trace its source. Specifically, this includes:

[0347] S51, Temporal Correlation Mining: Constructing User Behavior Temporal Sequence Graphs ,node For behavioral events, edges It represents temporal relationships or resource associations; it uses graph neural networks (GNNs) to learn risk propagation patterns and identify cross-time period coordinated attack behaviors;

[0348] S52, Multi-Entity Association Analysis: Extended to the user-device-data-location four-part graph, applying Heterogeneous Graph Attention Network (HAN) to uncover hidden associations and detect complex threats such as account sharing and device forgery;

[0349] S53, Attack Chain Reconstruction: Based on high-risk event sequences, the Dynamic Time Warping (DTW) algorithm is used to match a library of known attack patterns to generate a visual attack chain diagram, assisting security analysts in tracing the source.

[0350] The present invention also discloses a computer system, comprising:

[0351] processor;

[0352] Memory used to store processor-executable instructions;

[0353] The processor is configured to implement a geospatial data security risk monitoring method based on user entity behavior analysis when executing the executable instructions.

[0354] The present invention also discloses a computer-readable storage medium, comprising:

[0355] A memory on which computer programs are stored;

[0356] A processor is configured to execute the program in the memory to implement a geospatial data security risk monitoring method based on user entity behavior analysis.

[0357] For example, security monitoring applications of geospatial data platforms

[0358] This embodiment describes the specific application of the method of the present invention in a provincial geographic information public service platform. The platform has approximately 5,000 daily active users and manages more than 10TB of various geospatial data resources, including vector data, remote sensing images, and 3D models.

[0359] S1, Multi-source heterogeneous data acquisition and semantic preprocessing

[0360] Deploy distributed data acquisition probes to collect data from the following five types of data sources in real time:

[0361] Access log data: Obtain information such as user access URL, request parameters, response status code, and data return amount through Nginx log parsing;

[0362] User identity attributes: Synchronously obtain user identifier, department, job responsibilities, and job level information from the unified identity authentication system (IAM);

[0363] Terminal environment information: Collect terminal device type, operating system version, browser fingerprint, screen resolution, etc.;

[0364] Network layer data: records user IP address, access ISP, network latency, and VPN usage identifier;

[0365] Data resource metadata: Extract data identifier, data type (vector / raster / 3D model / metadata), geographic coverage (represented by minimum bounding rectangle MBR), sensitivity level (level 1 to 5), and business affiliation tag.

[0366] The collected raw data undergoes semantic preprocessing to construct a four-tuple structured behavioral event record. For example, a surveying engineer, Zhang, accessed classified vector map data via the intranet at 14:32:18 on March 15, 2024. His event record would be: E=(U 张某 D 机密矢量地图 ,T 20240315143218 O 下载成功 )

[0367] Among them, U 张某 Includes user ID "zhangsan", department "Surveying and Mapping Engineering Institute", role "Senior Engineer", and historical reputation score of 0.92; D 机密矢量地图 Includes data identifier "VEC-2024-BJ-001", type d1 (vector), geographic coverage MBR=(116.2,39.8,116.5,40.0), sensitivity level 4, and business affiliation "Urban Planning"; T 20240315143218 Includes timestamp, terminal location (116.3, 39.9), access point "Office Building - 3F - WiFi", and device fingerprint; O 下载成功 Includes operation type o2 (download), result "success", returned data volume 256MB, and query range.

[0368] S2, Multi-dimensional behavioral feature extraction and vectorization representation

[0369] Based on the above event records, extract four-dimensional behavioral features:

[0370] Temporal behavioral characteristics: Using a 24-hour sliding window, Zhang performed 45 operations within this window, with a total data download volume of 3.2GB. The operation type distribution entropy H type =1.85 (queries account for 35%, downloads for 40%, previews for 20%, and analysis for 5%), access time concentration C time =0.78 (cosine similarity to historical patterns).

[0371] Spatial behavioral characteristics: Calculating distance features f dist =Haversine((116.3,39.9),center((116.2,39.8,116.5,40.0)))=5.2km; Regional overlap f overlap =0.85 (percentage of the area where the user's location 5km buffer zone intersects with the data coverage area); Spatial access concentration f conx =0.32 (based on a weighted average of the eight regional centers that the user has visited most frequently in the past).

[0372] Semantic behavioral characteristics: Business domain relevance f biz =0.95 (User responsibility "Surveying and Mapping Engineering" highly matches the data business tag "Urban Planning"), Sensitive data access ratio f sen =0.60, frequency of cross-departmental data access f cross =3 times.

[0373] Related behavioral characteristics: Construct a user-data bipartite graph and extract the number of common neighbors F. cn =12, preference similarity F sim =0.88.

[0374] The above features are concatenated to form a 128-dimensional behavioral feature vector x=[F time ,F space ,F sem ,F rel ].

[0375] S3, Adaptive Behavioral Baseline Modeling and Dynamic Update

[0376] A personalized VAE baseline model was trained using Zhang's historical behavioral data (3200 records from the past 180 days):

[0377] Encoder network structure: Input layer (128) → Hidden layer (64) → Latent space (16);

[0378] Decoder network structure: latent space (16) → hidden layer (64) → output layer (128);

[0379] Training parameters: learning rate 0.001, batch size 64, training epochs 200, β=0.5;

[0380] Optimization objective: Minimize the sum of the reconstruction error and the KL divergence to obtain the latent distribution of the normal behavior of this user, q(z|x) ~ N(μ individual , σ 2 ).

[0381] Meanwhile, construct a group behavior mixture model based on department similarity. The "Surveying and Mapping Engineering Institute" to which Zhang belongs, together with 5 departments such as the "Geographic Information Institute" and the "Remote Sensing Application Institute", form a user cluster, and the mixing coefficient π k is determined by weighting according to the department scale.

[0382] Adopt exponential weighted moving average to dynamically update the baseline parameters, and the learning rate α is dynamically adjusted according to behavior stability (α = 0.1 during the stable period, α = 0.3 during the changing period).

[0383] S4, Multi-level anomaly detection and risk quantification

[0384] Individual-level anomaly detection: The L2 distance between the current behavior feature x and the individual baseline μ individual is ||x - μ individual || 2 = 2.35, the reconstruction loss ReconLoss(x) = 1.82. Taking γ = 0.5, then A individual = 2.35 + 0.5 × 1.82 = 3.26.

[0385] Group-level anomaly detection: Calculate the probability density of the current behavior in the group mixture model, p group (x|u 张某 ) = 0.15, then A group = -log(0.15) = 1.90.

[0386] Spatio-temporal context anomaly detection:

[0387] Geographical jump detection: Calculate the geographical speed v geo = Haversine((116.3, 39.9), (115.8, 39.5)) / 3600s =​​​​​​​​​​​​​​​

[0390] Take the maximum value of the three terms, A space =1.

[0391] Collaborative anomaly detection: Zhang's associated user set includes 6 people, including colleagues Li and Wang. Calculate s. ij ·A individual (u j The maximum value of ) is 0.78, then A collab =0.78.

[0392] Comprehensive risk score: The four-layer anomaly scores are normalized using Min-Max to obtain... =0.82, =0.65, =1.0, =0.78; using weight ω individual =0.3, ω group =0.2, ω space =0.3, ω collab =0.2, calculation: R=σ(0.3×0.82+0.2×0.65+0.3×1.0+0.2×0.78)=σ(0.832)=0.87.

[0393] S5, Adaptive Response and Dynamic Handling

[0394] The risk score R=0.87 satisfies 0.7≤R<0.9, and is therefore classified as high risk. The system will execute the following response measures:

[0395] The download operation will be blocked immediately, and a message will be returned saying "The operation has been blocked. Please contact the security administrator."

[0396] Send alarm notifications to the security management platform, including user ID, anomaly type (geographic jump + abnormal area access), risk score, and suggested handling measures;

[0397] Record a complete audit log and preserve the chain of evidence.

[0398] After receiving the alert, the security administrator confirmed by phone that Zhang was on a business trip in another city and was using VPN access. The change of geographical location was reasonable, but accessing confidential data outside the scope of his responsibilities was a violation. Therefore, the administrator decided to suspend his data download privileges for 7 days and requested a written explanation.

[0399] For example, a cold start scenario for new users.

[0400] New employee Zhao logged into the system for the first time on his third day of employment. His historical behavioral data was less than 50 records, making it impossible to establish a reliable individual baseline. The system then activated its group transfer learning mechanism.

[0401] Extract Zhao's attribute embedding vector h 赵某=[Department: Remote Sensing Application Institute, Role: Assistant Engineer, Rank: P5];

[0402] Calculating the cosine similarity with other users within the department, a similarity s was found to be s with Assistant Engineer Qian. ij =0.92 is the highest;

[0403] The parameters of Qian's VAE baseline model were used as Zhao's initial baseline and assigned a high uncertainty weight.

[0404] As Zhao's behavioral data accumulates (reaching 100 records each time), the migration weight is gradually reduced to enhance personalized learning.

[0405] On day 15, Zhao attempted to download sensitive image data from a restricted area in batches. The system detected A based on the migration baseline. group =2.35, a significant deviation, prompting the system to promptly block the operation and issue an alarm. Upon investigation, it was found that Zhao was acting under the instructions of external personnel in an attempt to steal data; the system successfully prevented a data breach.

[0406] For example, advanced persistent threat detection

[0407] An attacker obtained the account of surveying engineer Sun through phishing emails and carried out covert data theft for two weeks.

[0408] Days 1-3: Attackers conduct low-frequency probing access, simulating normal working hours, with each download size <50MB, and the R score remains in the low-risk range of 0.2-0.4. The system logs record normal access.

[0409] Days 4-7: Attackers began using automated scripts for bulk downloads, exhibiting abnormal timing characteristics (operation frequency surged by 300%, with increased nighttime access). A individual The value rose to 0.75, and R=0.72 triggered a high-risk alarm. The system blocked the operation and notified the administrator, but the attacker paused the activity to evade detection.

[0410] Days 8-10: The attacker switched to account-sharing mode, using colleagues' accounts to distribute downloads. Individual downloads showed abnormally low performance, but the collaborative layer detected A. collab =0.85 (multi-account similar abnormal pattern), R=0.81 remains high risk;

[0411] Days 11-14: The attacker attempted to spoof geographical location via VPN, but the spatial layer detected anomalies in geographical jumps (the location jumped from "Beijing" to "Shanghai" and back to "Beijing" within 2 hours). space =1.0, with an overall R=0.93 triggering an extremely high risk. The system automatically freezes the relevant accounts and initiates the emergency response process.

[0412] Post-incident source tracing and analysis reconstructed the attack chain, restoring the complete attack path, identifying 3 controlled accounts and 17 affected data resources, and successfully preventing the leakage of approximately 2.5TB of sensitive data.

[0413] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A geospatial data security risk monitoring method based on user entity behavior analysis, characterized in that, Includes the following steps: S1, Multi-source heterogeneous data acquisition and semantic preprocessing: Collect and integrate multi-source data to construct structured behavioral event records; S2, Multi-dimensional behavioral feature extraction and vectorization representation: extracting behavioral features from four dimensions: temporal, spatial, semantic, and relational, forming a unified behavioral feature vector; In step S2, behavioral features are extracted from four dimensions based on the behavioral event records: S21, Temporal Behavior Characteristics Using a sliding time window to count user activity Operation frequency, total data downloaded, and operation type distribution entropy within a given time period: ， wherein denotes the distribution entropy; represents the number of operation types; Indicates the first Percentage of similar operations; S22, Spatial Behavior Characteristics Extracting spatial relationship features between terminal geographic location and data coverage, including: Distance features This indicates the distance between the user's location and the data center; in, Indicates the distance between the user's location and the data center; Represents the Harvard sine function; Indicates the terminal's geographical location; Represents the geometric center function; Indicates geographical coverage; Regional overlap , in, Indicates the degree of overlap between regions; This function represents the calculation function for the projected area of ​​a plane. A radius buffer representing the user's location; Intersection symbol; Indicates geographical coverage; Spatial access concentration , in, Indicates spatial access concentration; This indicates the number of regions a user has frequently visited in the past. This indicates the number of times a frequently accessed area has been visited. Indicates the first Number of visits to each region; Represents the Euclidean distance function; Indicates the current geographical location of the terminal; Indicates the first Geometric center coordinates of a historically frequently visited region; S23, Semantic Behavioral Features Extracting business domain relevance based on data resource metadata. Percentage of access to sensitive data Cross-departmental data access frequency ; S24, Related Behavioral Characteristics Construct a user-data bipartite graph and extract graph structure features; The above features are concatenated to form a behavioral feature vector. , Represents a behavioral feature vector; Indicates temporal behavioral characteristics; Indicates spatial behavioral characteristics; Represents semantic behavioral features; Indicates related behavioral characteristics; S3, Adaptive Behavioral Baseline Modeling and Dynamic Update: Establish personalized behavioral baselines based on historical behavioral data and dynamically evolve them over time; S4, Multi-level Anomaly Detection and Risk Quantification: Anomalies are detected at four levels: individual, group, spatiotemporal context, and collaboration, and a comprehensive risk score is calculated by integrating them. S5, Adaptive Response and Dynamic Handling: Implement response measures based on risk score classification.

2. The geospatial data security risk monitoring method based on user entity behavior analysis according to claim 1, characterized in that, In step S1, the multi-source heterogeneous data collection includes one or any combination of geospatial data access logs, user identity attributes, terminal environment information, network layer data, and data resource metadata.

3. The geospatial data security risk monitoring method based on user entity behavior analysis according to claim 1, characterized in that, In step S1, semantic preprocessing of the collected data includes extracting user identity entities, data resource entities, spatiotemporal context entities, and operation behavior entities, and constructing a four-tuple structured behavior event record: ， in, This represents a structured record of behavioral events represented by a quadruple; Represents the user entity, user entity Including user identifier Organizational structure attributes Job Responsibilities Historical Reputation Score One or any combination; Represents a data resource entity. Including data identification Data types Geographical coverage Sensitivity Level Business attribution One or any combination; Represents a vector. Represents a grid. Representing a 3D model, Represents metadata; Geographical coverage minimum bounding rectangle As a delineated area; in, Indicates the longitude of the western boundary within the rectangle; Indicates the latitude of the southern boundary within the rectangle; Indicates the longitude of the eastern boundary of the rectangle; Indicates the latitude of the northern boundary within the rectangle; Represents a spatiotemporal context entity. Including operation timestamps Terminal geographical location Network access point fingerprint of terminal device One or any combination; Indicates the terminal's longitude location; Indicates the latitude of the terminal location; Represents the entity that performs the operation. Including operation type Operation results , amount of returned data Spatial query range One or any combination; Indicates a query. Indicates download. This indicates a preview. Indicates analysis, Indicates sharing, This indicates an export.

4. The geospatial data security risk monitoring method based on user entity behavior analysis according to claim 1, characterized in that, In step S3, a personalized behavior baseline model is established for each user entity based on historical behavior data: S31, Normal Behavior Pattern Learning: A variational autoencoder is used to learn the latent distribution of normal user behavior. The encoder then processes the behavioral features... Mapping to latent variables Decoder reconstruction Optimization is achieved by minimizing the reconstruction error and KL divergence: ， in, Indicates information about the encoder The expectation operator; The posterior distribution of the encoder output is represented by a Gaussian distribution. This represents the likelihood distribution of the decoder output; This represents the regularization parameter, which controls the tradeoff between reconstruction accuracy and potential spatial regularity. Represents the divergence metric function; Represent the prior distribution; use the standard normal distribution; Represents a behavioral feature vector; This indicates that the encoder will generate behavioral feature vectors. Mapping to latent variables; S32, Group Behavior Pattern Learning: For new users or users with sparse behavior, a transfer learning strategy based on similar users is adopted to calculate the similarity between users. ,in, Indicates the first User attribute embedding vector, Indicates the first User attribute embedding vector, Represents the cosine similarity function. Indicates the first user With the user Similarity; Constructing a hybrid model of group behavior: ， in, Represents the probability distribution of a group; Indicates the number of user clusters; Indicates the first Mixing coefficients for individual user clusters; Indicates a Gaussian distribution; Represents a behavioral feature vector; Indicates the first The mean vector of each user cluster; Indicates the first The covariance matrix of each user cluster; S33, Dynamic Update Mechanism: Uses a weighted moving average to update baseline parameters for behavior, adapting to the evolution of user behavior. ， in, express The mean vector of behavior at any given time; The learning rate is dynamically adjusted based on behavioral stability. express The behavioral feature vector observed at each moment; express The mean vector of behavior at each time step.

5. The geospatial data security risk monitoring method based on user entity behavior analysis according to claim 1, characterized in that, Step S4 includes: S41, Individual-level anomaly detection: Calculate the deviation of the current behavior from the individual baseline: ， in, Indicates an individual's abnormal score; Represents a behavioral feature vector; Represents the mean vector of user behavior; Represents the L2 norm; Indicates the balance coefficient; Represents the reconstruction loss function; , in, Represents a behavioral feature vector; This represents the feature vector reconstructed by the decoder; Represents the L2 norm; S42, Group-level Anomaly Detection: Calculating the deviation from group behavior: ， in, Indicates the abnormality score of the group; Represents the probability distribution of a group; Represents a behavioral feature vector; Indicates user; S43, Spatiotemporal Context Anomaly Detection: Design a dedicated detector for geospatial characteristics. Geographic jump detection: Calculating geographic speed ,like This will trigger an exception; in, Indicates geographical speed; Represents the Harvard sine function; express The geographical location of the terminal at any given moment; , express The terminal longitude position at any given time; express The terminal latitude position at any given moment; express The geographical location of the terminal at any given moment; , express The terminal longitude position at any given time; express The terminal latitude position at any given moment; Indicates a time interval; This indicates the preset maximum speed threshold; Abnormal Area Access: Constructing a set of frequently accessed areas by users based on historical data. If the current data coverage area And sensitivity level If so, the risk level will be raised; in, This represents the set of areas frequently visited by the user. Indicates geographical coverage; Symbol for empty set; Indicates the sensitivity level; Spatiotemporal clustering anomalies: Detecting patterns of multiple users accessing the same sensitive area within a short period and calculating the spatiotemporal clustering coefficient. ， in, Represents the spatiotemporal aggregation coefficient; Indicates time window Number of users accessing sensitive areas; Indicates the area of ​​the sensitive region; Indicates the first The area of ​​the sensitive data sub-region accessed by each user; Indicates the first The distance from the location of each user terminal to the center of the sensitive area; when and At that time, it was determined to be a spatiotemporal aggregation anomaly; in, Indicates the preset aggregation threshold; This indicates a preset user count threshold; S44, Collaborative Anomaly Detection: Detects abnormal behavior patterns of multiple related users within the same time period and calculates a collaborative anomaly score. ， in, Indicates the score of collaborative anomalies; Indicates user The set of associated users; Indicates user With users Similarity; Indicates associated users Individual abnormality scores; This represents the function that takes the maximum value. S45, Comprehensive Risk Score: Integrates multi-layered anomaly indicators and employs weighted ensemble: ， in, This indicates the overall score; It is the sigmoid activation function; This represents the normalized outlier scores. , This represents the normalized weights; , Represents the normalized individual anomaly score The weights; This represents the normalized individual anomaly score; the normalization method used is Min-Max normalization. Represents the normalized population outlier score The weights; This represents the normalized group outlier score; Represents the normalized spatial context anomaly score The weights; This represents the normalized spatial context anomaly score. Represents the normalized co-anomaly score The weights; This represents the normalized co-abnormal score.

6. The geospatial data security risk monitoring method based on user entity behavior analysis according to claim 1, characterized in that, Step S5 includes basing decisions on risk scores. The graded response is as follows: like < If so, it is considered low risk; like ≤ < If so, it is considered medium risk; like ≤ < This indicates a high risk. like ≥ This would be considered extremely high risk; This indicates a preset first risk threshold; This indicates a preset second risk threshold; This indicates a preset third risk threshold; < < .

7. The geospatial data security risk monitoring method based on user entity behavior analysis according to claim 1, characterized in that, The measures include: Low risk: Log the information and allow passage normally; Medium risk: Triggering two-factor authentication; High risk: Block the operation in real time and notify the security administrator; Extremely high risk: Account will be automatically frozen.

Images