Artificial intelligence-based real-time analysis system for data abnormal usage behavior

Abstract

The application discloses a data abnormal use behavior real-time analysis system based on artificial intelligence, comprising an event collection module, a feature construction module, a burst detection module, an abnormal scoring module, a risk judgment module and an alarm output module. The event collection module collects data use events and generates continuous behavior event sequences; the feature construction module divides the continuous behavior event sequences by sliding time windows and constructs behavior feature vector sequences; the burst detection module performs Kleinberg burst detection based on event arrival frequency sequences, generates burst state sequences and burst intensity sequences; the abnormal scoring module establishes a behavior feature support domain model, and generates support domain deviation scores through an inverse Christoffel function abnormal detection algorithm; the risk judgment module jointly maps the burst intensity values and the support domain deviation scores to generate risk judgment results; and the alarm output module generates behavior alarm data. The system realizes real-time identification and risk early warning of data abnormal use behavior.

Description

Technical Field

[0001] This invention relates to the field of data security monitoring and intelligent analysis technology, and in particular to a real-time analysis system for abnormal data usage behavior based on artificial intelligence. Background Technology

[0002] As enterprises continue their digital transformation and data assetization, data access behaviors in database systems, business analytics platforms, and data sharing systems are becoming more frequent, diverse, and complex. Data security monitoring and abnormal usage behavior identification have become crucial technical directions for data security management. Currently, enterprises typically monitor user data access behavior through database auditing systems, security log analysis platforms, or access control systems to identify and warn of abnormal access behaviors, unauthorized data acquisition, and potential data leakage risks.

[0003] Existing data anomaly analysis systems still have significant limitations in practical applications. On the one hand, traditional monitoring systems mainly rely on fixed threshold rules such as access frequency, access duration, or data download volume for anomaly judgment, lacking the ability to comprehensively analyze changes in behavior over time and multi-dimensional behavioral characteristics. When legitimate business behavior shows high-frequency access in a short period of time, it is prone to generating a large number of false alarms, while it is difficult to identify distributed, multi-stage data anomaly behavior in a timely manner. On the other hand, some machine learning-based anomaly detection systems often directly use historical behavior data to build single behavior models, lacking a joint modeling mechanism for sudden behavior states and normal behavior boundaries. When data access behavior shows sudden changes in the time series, concentrated changes in access objects, or abnormal switching of operation paths, it is difficult to accurately identify complex anomalies. In addition, existing systems usually only generate simple alarm information after identifying anomalies, lacking the ability to associate and encapsulate identity identifiers, data object identifiers, time window information, and risk indicators. This makes it difficult for security handling systems to quickly obtain complete behavioral context information, thus affecting the real-time response efficiency of data security risks.

[0004] Therefore, how to provide a real-time analysis system for abnormal data usage behavior based on artificial intelligence is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a real-time data anomaly usage behavior analysis system based on artificial intelligence. This invention constructs a continuous sequence of behavioral events and a sequence of behavioral feature vectors, introduces a Kleinberg burst detection model to identify burst states of data access behavior, and combines an inverse Christoffel function anomaly detection algorithm to establish a behavioral feature support domain model. This enables joint risk assessment and real-time alarm generation for abnormal data usage behavior, and has the advantages of strong behavioral feature modeling capabilities, high accuracy in abnormal behavior identification, and high real-time risk response.

[0006] The real-time data anomaly usage behavior analysis system based on artificial intelligence according to an embodiment of the present invention includes the following steps:

[0007] The event acquisition module collects data using events, encodes the data using events according to a unified field structure, sorts them by event time, and outputs a sequence of continuous behavioral events after verification.

[0008] The feature construction module divides the continuous behavioral event sequence into sliding time windows, and counts the event arrival interval, average arrival interval, number of access requests, data object access concentration, and operation path change within each time window to construct a sequence of behavioral feature vectors.

[0009] The burst detection module constructs an event arrival frequency sequence based on the event arrival intervals in the behavioral feature vector sequence. This sequence is then input into the Kleinberg burst detection model. The Kleinberg model forms observation pairs based on the number of access requests and the time window length, calculates the base emissivity, and constructs a burst state hierarchy set. For each time window and state level, a transmission cost table is constructed. For changes in state levels between adjacent time windows, a transition cost table is constructed. The module also imposes jump restrictions on upward transitions in the transition cost table based on the access subject set and data object set of adjacent time windows. Based on the transmission cost table and transition cost table, cumulative cost recursion and optimal state path backtracking are performed to generate a burst state sequence and a burst intensity sequence. Finally, the target time window and target behavioral feature vector are determined according to the burst state hierarchy.

[0010] The anomaly scoring module extracts behavioral feature vectors corresponding to non-sudden states to construct a normal behavior sample set. Based on the normal behavior sample set, it generates a boundary sample set and a core sample set. The boundary inverse matrix corresponding to the boundary sample set and the core inverse matrix corresponding to the core sample set constitute a two-layer behavioral feature support domain model. The module calculates the boundary inverse Christoffel value and the core inverse Christoffel value corresponding to the target behavioral feature vector using the inverse Christoffel function anomaly detection algorithm. The module generates a support domain deviation score based on the difference between the boundary inverse Christoffel value and the core inverse Christoffel value.

[0011] The risk assessment module jointly maps the sudden intensity value corresponding to the target time window with the support domain deviation score, and generates a risk assessment result for the target time window that simultaneously meets the conditions of a sudden state and the support domain deviation score exceeds a preset threshold.

[0012] The alarm output module extracts behavior records within the target time window based on the risk assessment results, and associates and encapsulates the identity identifier, data object identifier, target time window identifier, sudden intensity value, and support domain deviation score to form real-time abnormal usage behavior alarm data.

[0013] Optionally, modules can be integrated using the following methods:

[0014] S1. Collect data using events, encode the data using events according to a unified field structure and sort them by event time, and output the continuous behavior event sequence after verification processing;

[0015] S2. Divide the continuous sequence of behavioral events into sliding time windows, and statistically analyze the event arrival interval, average arrival interval, number of access requests, data object access concentration, and operation path change within each time window to construct a sequence of behavioral feature vectors.

[0016] S3. Construct an event arrival frequency sequence based on the event arrival interval in the behavioral feature vector sequence. Input the event arrival frequency sequence into the Kleinberg burst detection model. The Kleinberg burst detection model forms observation pairs based on the number of access requests and the time window length, calculates the basic emissivity, and constructs a burst state hierarchy set. Construct an emission cost table for each time window and each state hierarchy. Construct a transition cost table for the state hierarchy changes of adjacent time windows. Based on the set of access subjects and the set of data objects of adjacent time windows, impose a jump restriction on the upward transition in the transition cost table. Based on the emission cost table and the transition cost table, perform cumulative cost recursion and optimal state path backtracking to generate a burst state sequence and a burst intensity sequence. Determine the target time window and target behavioral feature vector based on the burst state hierarchy.

[0017] S4. Extract behavioral feature vectors corresponding to non-sudden states to construct a normal behavior sample set. Based on the normal behavior sample set, generate a boundary sample set and a core sample set. The boundary inverse matrix corresponding to the boundary sample set and the core inverse matrix corresponding to the core sample set constitute a two-layer behavioral feature support domain model. Calculate the boundary inverse Christoffel value and the core inverse Christoffel value corresponding to the target behavioral feature vector using the inverse Christoffel function anomaly detection algorithm. Generate a support domain deviation score based on the difference between the boundary inverse Christoffel value and the core inverse Christoffel value.

[0018] S5. Jointly map the sudden intensity value corresponding to the target time window with the support domain deviation score, and generate a risk judgment result for the target time window that simultaneously meets the conditions of sudden state and support domain deviation score exceeding the preset threshold.

[0019] S6. Extract behavior records within the target time window based on the risk assessment results, and associate and encapsulate the identity identifier, data object identifier, target time window identifier, sudden intensity value and support domain deviation score to form real-time abnormal usage behavior alarm data.

[0020] Optionally, S1 includes:

[0021] S11. Collect data access logs at the data access gateway, database audit module and business system log interface, extract identity identifier, data object identifier, access request type, operation type, event time and session context fields, and generate raw data usage event records;

[0022] S12. Establish a unified field structure, map the field names in different log sources to identity fields, data object identification fields, access request type fields, operation type fields, event time fields, and session context fields, and reorganize the original data using event recording according to the field structure to form standard event records;

[0023] S13. Perform a unified time base conversion on the event time field in the standard event record, convert the timestamps generated by different systems into a unified time format, and sort all standard event records in ascending order according to the event time to obtain a time-sorted event set.

[0024] S14. Divide the time-sorted event set into sessions based on the identity identifier field and the session context field. Divide event records with the same identity identifier and the same session identifier into the same session event group, and maintain the time order of events within each session event group.

[0025] S15. Merge and arrange the event records in all session event groups according to the global event time order, and number the event records in time order to maintain an increasing time relationship between adjacent events and generate a continuous action event sequence.

[0026] S16. Perform consistency verification on the continuous action event sequence, identify and clean up duplicate event records, session identifier mismatch records and invalid data object records, and output the continuous action event sequence after verification.

[0027] Optionally, S2 includes:

[0028] S21. Read the event time, data object identifier, access request type, and operation type fields from the continuous action event sequence, and set the sliding time window length. and sliding step size Based on the event time, a continuous sequence of behavioral events is truncated in chronological order to form a... A set of time window events ;

[0029] S22. For each time window event set, sequentially traverse the event times, calculate the time difference between adjacent events, obtain the event arrival interval sequence of the time window, and average the event arrival interval sequence to obtain the average arrival interval value of the corresponding time window.

[0030] S23. Count the total number of event records in the event set of each time window as the number of access requests, and count the number of accesses for different data object identifiers within the same time window. Calculate the access ratio for each data object, and calculate the data object access concentration for the time window based on the access ratio. ,in Indicates the first Data object access concentration within a time window Indicates the first The first time window Access ratio of class data objects, This indicates the number of data object categories within the time window;

[0031] S24. Read the operation type field in the time window event set according to the order of event occurrence to form an operation sequence. Judge whether adjacent operation types have changed one by one and accumulate the number of changes to obtain the operation path change amount of the time window.

[0032] S25. Combine the average arrival interval, number of access requests, data object access concentration, and operation path change according to a unified field structure order to construct a behavioral feature vector for the corresponding time window.

[0033] S26. Arrange all behavioral feature vectors according to the time order of the time window to generate a sequence of behavioral feature vectors that correspond one-to-one with each time window.

[0034] Optionally, S3 includes:

[0035] S31. Read the average arrival interval value and event arrival interval sequence corresponding to each time window in the behavior feature vector sequence. Perform a reciprocal transformation on the event arrival interval sequence to obtain the event arrival frequency sequence corresponding to each time window, where the first... The event arrival frequency within a time window is expressed as: ,in Indicates the first The frequency of event arrivals within a time window. Indicates the first Average arrival interval for each time window;

[0036] S32. Input the event arrival frequency sequence into the Kleinberg burst detection model in chronological order, and establish a one-to-one correspondence between each time window identifier and the corresponding behavioral feature vector in the behavioral feature vector sequence to form a burst detection input sequence.

[0037] S33. Use the Kleinberg burst detection model to perform state evaluation calculations on the burst detection input sequence, and output the burst state sequence and burst intensity sequence corresponding to each time window;

[0038] S34. Identify the time window for the establishment of an emergency state based on the emergency state sequence, determine the time window where the emergency state level is higher than the basic state as the target time window, and record the emergency intensity value corresponding to the target time window.

[0039] S35. Based on the position index of the target time window in the behavioral feature vector sequence, extract the corresponding behavioral feature vector to form a target behavioral feature vector set, and associate and record the target time window identifier, sudden state value, sudden intensity value and target behavioral feature vector.

[0040] Optionally, the Kleinberg burst detection model includes:

[0041] Receive the event arrival frequency sequence and maintain the time window identifier order, for the first Read the number of access requests within a time window. With time window length Event arrival frequency and Establish correspondences and form observation pairs arranged by time windows. ;

[0042] The sum of the number of access requests for all time windows is obtained. ,in This represents the total number of time windows, obtained by summing the durations of all time windows. ,by The event arrival rate is used as the base state and recorded. With time window length The correspondence;

[0043] Construct a set of emergency status levels ,by Starting from the geometric hierarchy, generate the emissivity of each state. ,in Take a fixed multiplier. Indicates the state level sequence number; determines the number of states. Make the highest level state satisfy And record the mapping table between the state and emissivity of each level;

[0044] Construct a launch cost table for each time window. With each state With "in duration" Within the time window, the state The arrival rate Observed at time Using the Poisson arrival process of the "sub-event" as a counting model, the corresponding negative log-likelihood is calculated as the emission cost. After omitting constant terms that are irrelevant to the state hierarchy, the emission cost satisfies:

[0045] ;

[0046] And Write the launch cost table according to the time window number and state level;

[0047] Construct a transition cost table for state transitions within any adjacent time window. Constructing hierarchical differences ,in Recorded as a transfer to maintain, This is recorded as an upward transition. This is recorded as a pullback transition. Indicates the state level index; assigns a constant cost to hold transitions. The transfer costs for both upward and downward transfers are constructed by linearly accumulating the absolute values ​​of the hierarchical differences, satisfying the following:

[0048] ;

[0049] in, The cost per level of ascent is a constant. Let the unit level fallback cost constant be, and Write it into the transfer cost table;

[0050] In the transfer cost table, a consistency label is calculated for the access subject set and the data object set of adjacent time windows. The access subject set is obtained by deduplicating the identity identifiers within the time window, and the data object set is obtained by deduplicating the data object identifiers within the time window. The consistency label is valid when the intersection of the access subject set and the data object set of adjacent time windows is non-empty; otherwise, it is invalid. When the consistency label is invalid, a jump restriction is applied to the ascending transfer, and the restriction rule is that only jumps are allowed. For those that do not meet the restriction rules The transfer is marked as unreachable in the transfer cost table;

[0051] Based on the launch cost table and the transfer cost table, a cumulative cost recursive relationship is constructed. The cumulative total cost is calculated for each state level in the order of time windows. The cumulative total cost is obtained by adding the cumulative total cost of each state in the previous time window to the launch cost and state transition cost of the current time window. The predecessor state index is recorded for each state in each time window. In the last time window, the state with the minimum cumulative total cost is selected as the termination state. The optimal state path is obtained by backtracking. The burst state sequence and burst intensity sequence are output, and the burst intensity is taken as the value of the corresponding state level.

[0052] On the optimal state path, burst segments are formed for consecutive burst state time windows. For each burst segment, the intersection of the access subject set and the data object set within the segment is extracted as the segment consistency set. When there is only one basic state time window between two adjacent burst segments, and the segment consistency sets of both burst segments are not empty, the state level of the basic state time window is relabeled as a first-level burst state, and the three segments are merged into the same burst segment. When the length of the burst segment is a single time window and the consistency label corresponding to the burst segment is invalid before and after, the state level of the burst segment is relabeled as a basic state.

[0053] Based on the recalibrated sequence of sudden states, the set of target time windows for the occurrence of sudden states is determined, and the corresponding behavioral feature vectors are extracted according to the position index of the target time window set in the sequence of behavioral feature vectors to form a set of target behavioral feature vectors. The target time window identifier, sudden state value and sudden intensity value are associated and recorded.

[0054] Optionally, S4 includes:

[0055] S41. Read the behavioral feature vector sequence and the sudden state sequence, and extract the time window index set of the sudden state as the base state. and based on Extract corresponding behavioral feature vectors from the behavioral feature vector sequence to form an initial set of normal behavior samples. Read the target time window set The time window index, and based on Extract target behavioral feature vectors from the behavioral feature vector sequence to form a target sample set. Maintain a one-to-one correspondence between the target time window identifier and the target sample set;

[0056] S42. Set up the initial normal behavior sample set Each behavioral feature vector is arranged in field order to form a sample vector. The fields, in order, include the average arrival interval, the number of access requests, the concentration of data object access, and the change in operation path, forming a sample matrix. ; set of target samples Each target behavior feature vector is arranged in the order of the same fields to form the target vector. Maintain consistency with the field order of the sample matrix;

[0057] S43. Generate the boundary sample set and the core sample set: Calculate the sample center vector. Let the mean of each sample vector in the sample matrix be denoted as . Calculate the Euclidean distance from each sample vector to the sample center vector and select the vector with the largest distance as the initial boundary sample. Then, for the remaining sample vectors, successively calculate the minimum Euclidean distance from each vector to the selected boundary sample set and add the sample with the largest minimum Euclidean distance to the boundary sample set, until the number of boundary samples reaches . Obtain the boundary sample set In the sample matrix Select the one with the smallest distance to the sample center vector. The sample vectors form the core sample set. ,in Indicates the number of dimensions in the behavioral feature vector;

[0058] S44, Based on Boundary Sample Set With core sample set Construct feature basis sets separately for the boundary sample set. Each boundary sample vector in Expanding the boundary feature basis vectors in a fixed order—constant terms, linear terms of each field component, and univariate square terms of each field component—and then collecting all boundary feature basis vectors into a boundary feature basis set; for the core sample set... Each core sample vector in The core feature basis vectors are formed by expanding the constant term, the linear term of each field component, and the square term of each field component in a fixed order, and then all the core feature basis vectors are gathered into a core feature basis set.

[0059] S45. Construct matrix-based support domain representations for the boundary feature basis set and the core feature basis set respectively: Read each boundary feature basis vector from the boundary feature basis set. Calculate the outer product of the boundary feature basis vector and its transpose. The outer product results of all boundary feature basis vectors in the boundary feature basis set are summed to form the boundary matrix. , where the boundary matrix Represent the matrix-formatted support domain of the boundary sample set in the feature basis space; read each core feature basis vector from the core feature basis set. Calculate the outer product of the core feature basis vector and its transpose. The outer product results of all core feature basis vectors in the core feature basis set are summed to form the core matrix. The core matrix Represent the matrixed support domain of the core sample set in the feature basis space; for the boundary matrix After adding the regularization term, the inverse matrix is ​​obtained by taking the boundary inverse matrix. For the core matrix After adding a regularization term, the inverse matrix is ​​obtained by inverting the matrix. ; the boundary sample set, the boundary feature basis set, and the boundary matrix and boundary inverse matrix Combined into a boundary support domain layer, the core sample set, core feature basis set, and core matrix are... and core inverse matrix The core support domain layer is combined with the boundary support domain layer to form a two-layer behavioral feature support domain model.

[0060] S46. For the target sample set Each target vector Construct target feature basis vectors The boundary inverse Christoffel value is obtained by calculating using a quadratic form. Inverse Christoffel value of the core The quadratic form calculation satisfies:

[0061] ;

[0062] in, Represents the target vector The corresponding inverse Christoffel value, Take the boundary inverse matrix When Take the core inverse matrix When ;

[0063] S47. During the deviation scoring phase, the same target vector The support domain deviation score is obtained by calculating the difference between the boundary inverse Christoffel value and the core inverse Christoffel value.

[0064] ;

[0065] And Index alignment is performed based on the target time window identifier to form a support domain deviation score sequence;

[0066] S48. Associate and record the target time window identifier, target behavior feature vector, boundary inverse Christoffel value, core inverse Christoffel value and support domain deviation score to generate a support domain deviation score result that corresponds one-to-one with the target time window.

[0067] Optionally, S5 includes:

[0068] S51. Read the target time window set and the burst intensity sequence corresponding to each target time window, and read the support domain deviation score sequence; index and align the burst intensity value and support domain deviation score according to the target time window identifier, and construct a joint judgment data table. Each record in the joint judgment data table contains the time window identifier, burst state value, burst intensity value and support domain deviation score.

[0069] S52. Extract records from the joint judgment data table whose sudden state values ​​are higher than the baseline values ​​to form a sudden time window set. Extract the support domain deviation score from the joint judgment data table if it exceeds the preset threshold. The records form a set of deviation time windows. Preset threshold Determined based on the statistical distribution of the deviation score sequence from the support domain;

[0070] S53, Set of Sudden Time Windows With deviation time window set Perform a set intersection operation based on the time window identifier to obtain a composite trigger time window set. and based on Extract the corresponding burst intensity value and support domain deviation score from the index position in the joint judgment data table;

[0071] S54. For each time window in the composite trigger time window set. The joint risk value is calculated by multiplying the sudden intensity value corresponding to the time window with the support domain deviation score. The joint risk value satisfies the following: ,in Indicates the first The combined risk value for each time window, Indicates the first The burst intensity value corresponding to each time window Indicates the first The support domain deviation score corresponding to each time window;

[0072] S55. Sort the records in the composite triggering time window set according to the magnitude of the joint risk value, and perform interval mapping on the joint risk value according to the preset risk interval threshold to divide the joint risk value into multiple risk level intervals, with each risk level interval corresponding to a risk level identifier.

[0073] S56. Generate a risk assessment result for each record in the composite trigger time window set. The risk assessment result includes the time window identifier, the sudden state value, the sudden intensity value, the support domain deviation score, the joint risk value, and the risk level identifier, and forms a risk assessment result sequence according to the time window order.

[0074] The beneficial effects of this invention are:

[0075] This invention introduces the Kleinberg burst detection model to perform state transition analysis on the event arrival frequency sequence, and combines it with a consistency label constraint mechanism to identify sudden changes in data access behavior. This enables the identification of abnormal access surges, abnormal concentration of access objects, and abnormal switching of access paths within a short period of time, thereby improving the detection capability of complex abnormal behaviors.

[0076] This invention establishes a two-layer behavioral feature support domain model and uses the inverse Christoffel function anomaly detection algorithm to calculate the support domain deviation score of the target behavioral feature vector, thereby achieving joint analysis of the normal behavior distribution boundary and the degree of deviation of abnormal behavior. Compared with traditional detection methods based on fixed thresholds or single distance metrics, it can improve the ability to identify hidden abnormal behaviors and complex behavioral pattern changes. Attached Figure Description

[0077] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0078] Figure 1 The flowchart is a real-time analysis system for abnormal data usage behavior based on artificial intelligence proposed in this invention.

[0079] Figure 2 This is a schematic diagram of the burst behavior recognition process based on the Kleinberg burst detection model proposed in this invention. Detailed Implementation

[0080] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0081] refer to Figure 1 - Figure 2 A real-time data anomaly usage behavior analysis system based on artificial intelligence includes the following steps:

[0082] The event acquisition module collects data using events, encodes the data using events according to a unified field structure, sorts them by event time, and outputs a sequence of continuous behavioral events after verification.

[0083] The feature construction module divides the continuous behavioral event sequence into sliding time windows, and counts the event arrival interval, average arrival interval, number of access requests, data object access concentration, and operation path change within each time window to construct a sequence of behavioral feature vectors.

[0084] The burst detection module constructs an event arrival frequency sequence based on the event arrival intervals in the behavioral feature vector sequence. This sequence is then input into the Kleinberg burst detection model. The Kleinberg model forms observation pairs based on the number of access requests and the time window length, calculates the base emissivity, and constructs a burst state hierarchy set. For each time window and state level, a transmission cost table is constructed. For changes in state levels between adjacent time windows, a transition cost table is constructed. The module also imposes jump restrictions on upward transitions in the transition cost table based on the access subject set and data object set of adjacent time windows. Based on the transmission cost table and transition cost table, cumulative cost recursion and optimal state path backtracking are performed to generate a burst state sequence and a burst intensity sequence. Finally, the target time window and target behavioral feature vector are determined according to the burst state hierarchy.

[0085] The anomaly scoring module extracts behavioral feature vectors corresponding to non-sudden states to construct a normal behavior sample set. Based on the normal behavior sample set, it generates a boundary sample set and a core sample set. The boundary inverse matrix corresponding to the boundary sample set and the core inverse matrix corresponding to the core sample set constitute a two-layer behavioral feature support domain model. The module calculates the boundary inverse Christoffel value and the core inverse Christoffel value corresponding to the target behavioral feature vector using the inverse Christoffel function anomaly detection algorithm. The module generates a support domain deviation score based on the difference between the boundary inverse Christoffel value and the core inverse Christoffel value.

[0086] The risk assessment module jointly maps the sudden intensity value corresponding to the target time window with the support domain deviation score, and generates a risk assessment result for the target time window that simultaneously meets the conditions of a sudden state and the support domain deviation score exceeds a preset threshold.

[0087] The alarm output module extracts behavior records within the target time window based on the risk assessment results, and associates and encapsulates the identity identifier, data object identifier, target time window identifier, sudden intensity value, and support domain deviation score to form real-time abnormal usage behavior alarm data.

[0088] In this embodiment, the modules are connected through the following method:

[0089] S1. Collect data using events, encode the data using events according to a unified field structure and sort them by event time, and output the continuous behavior event sequence after verification processing;

[0090] S2. Divide the continuous sequence of behavioral events into sliding time windows, and statistically analyze the event arrival interval, average arrival interval, number of access requests, data object access concentration, and operation path change within each time window to construct a sequence of behavioral feature vectors.

[0091] S3. Construct an event arrival frequency sequence based on the event arrival interval in the behavioral feature vector sequence. Input the event arrival frequency sequence into the Kleinberg burst detection model. The Kleinberg burst detection model forms observation pairs based on the number of access requests and the time window length, calculates the basic emissivity, and constructs a burst state hierarchy set. Construct an emission cost table for each time window and each state hierarchy. Construct a transition cost table for the state hierarchy changes of adjacent time windows. Based on the set of access subjects and the set of data objects of adjacent time windows, impose a jump restriction on the upward transition in the transition cost table. Based on the emission cost table and the transition cost table, perform cumulative cost recursion and optimal state path backtracking to generate a burst state sequence and a burst intensity sequence. Determine the target time window and target behavioral feature vector based on the burst state hierarchy.

[0092] S4. Extract behavioral feature vectors corresponding to non-sudden states to construct a normal behavior sample set. Based on the normal behavior sample set, generate a boundary sample set and a core sample set. The boundary inverse matrix corresponding to the boundary sample set and the core inverse matrix corresponding to the core sample set constitute a two-layer behavioral feature support domain model. Calculate the boundary inverse Christoffel value and the core inverse Christoffel value corresponding to the target behavioral feature vector using the inverse Christoffel function anomaly detection algorithm. Generate a support domain deviation score based on the difference between the boundary inverse Christoffel value and the core inverse Christoffel value.

[0093] S5. Jointly map the sudden intensity value corresponding to the target time window with the support domain deviation score, and generate a risk judgment result for the target time window that simultaneously meets the conditions of sudden state and support domain deviation score exceeding the preset threshold.

[0094] S6. Extract behavior records within the target time window based on the risk assessment results, and associate and encapsulate the identity identifier, data object identifier, target time window identifier, sudden intensity value and support domain deviation score to form real-time abnormal usage behavior alarm data.

[0095] In this embodiment, S1 includes:

[0096] S11. Collect data access logs at the data access gateway, database audit module and business system log interface, extract identity identifier, data object identifier, access request type, operation type, event time and session context fields, and generate raw data usage event records;

[0097] S12. Establish a unified field structure, map the field names in different log sources to identity fields, data object identification fields, access request type fields, operation type fields, event time fields, and session context fields, and reorganize the original data using event logging according to this field structure to form standard event logs;

[0098] S13. Perform a unified time base conversion on the event time field in the standard event record, convert the timestamps generated by different systems into a unified time format, and sort all standard event records in ascending order according to the event time to obtain a time-sorted event set.

[0099] S14. Divide the time-sorted event set into sessions based on the identity identifier field and the session context field. Divide event records with the same identity identifier and the same session identifier into the same session event group, and maintain the time order of events within each session event group.

[0100] S15. Merge and arrange the event records in all session event groups according to the global event time order, and number the event records in time order to maintain an increasing time relationship between adjacent events and generate a continuous action event sequence.

[0101] S16. Perform consistency verification on the continuous action event sequence, identify and clean up duplicate event records, session identifier mismatch records and invalid data object records, and output the continuous action event sequence after verification.

[0102] In this embodiment, S2 includes:

[0103] S21. Read the event time, data object identifier, access request type, and operation type fields from the continuous action event sequence, and set the sliding time window length. and sliding step size Based on the event time, the continuous sequence of behavioral events is slidably extracted in chronological order to form multiple time window event sets. ;

[0104] S22. For each time window event set, sequentially traverse the event times, calculate the time difference between adjacent events, obtain the event arrival interval sequence for that time window, and average the interval sequence to obtain the average arrival interval value for the corresponding time window.

[0105] S23. Count the total number of event records in the event set of each time window as the number of access requests, and count the number of accesses for different data object identifiers within the same time window. Calculate the access ratio for each data object, and calculate the data object access concentration for that time window based on the access ratio. ,in Indicates the first Data object access concentration within a time window Indicates the first The first time window Access ratio of class data objects, This indicates the number of data object categories within that time window;

[0106] S24. Read the operation type field in the event set of the time window according to the order of event occurrence to form an operation sequence. Check whether the adjacent operation types have changed one by one and accumulate the number of changes to obtain the amount of change in the operation path of the time window.

[0107] S25. Combine the average arrival interval, number of access requests, data object access concentration, and operation path change according to a unified field structure order to construct a behavioral feature vector for the corresponding time window.

[0108] S26. Arrange all behavioral feature vectors according to the time order of the time window, generate a behavioral feature vector sequence that corresponds one-to-one with each time window, and pass the behavioral feature vector sequence to the event arrival frequency sequence construction step.

[0109] In this embodiment, S3 includes:

[0110] S31. Read the average arrival interval value and event arrival interval sequence corresponding to each time window in the behavior feature vector sequence. Perform a reciprocal transformation on the event arrival interval sequence to obtain the event arrival frequency sequence corresponding to each time window, where the first... The event arrival frequency within a time window is expressed as: ,in Indicates the first The frequency of event arrivals within a time window. Indicates the first Average arrival interval for each time window;

[0111] S32. Input the event arrival frequency sequence into the Kleinberg burst detection model in chronological order, and establish a one-to-one correspondence between each time window identifier and the corresponding behavioral feature vector in the behavioral feature vector sequence to form a burst detection input sequence.

[0112] S33. Use the Kleinberg burst detection model to perform state evaluation calculation on the burst detection input sequence, and output the burst state sequence and burst intensity sequence corresponding to each time window. The burst state sequence is used to characterize the activity state level of each time window, and the burst intensity sequence is used to characterize the burst degree of the corresponding time window.

[0113] S34. Identify the time window for the establishment of an emergency state based on the emergency state sequence, determine the time window where the emergency state level is higher than the basic state as the target time window, and record the emergency intensity value corresponding to the target time window.

[0114] S35. Based on the position index of the target time window in the behavioral feature vector sequence, extract the corresponding behavioral feature vector to form a target behavioral feature vector set, and associate and record the target time window identifier, sudden state value, sudden intensity value and target behavioral feature vector.

[0115] In this embodiment, the Kleinberg burst detection model includes:

[0116] Receive the event arrival frequency sequence and maintain the time window identifier order, for the first Read the number of access requests within a time window. With time window length Event arrival frequency and Establish correspondences and form observation pairs arranged by time windows. ;

[0117] The sum of the number of access requests for all time windows is obtained. ,in This represents the total number of time windows, obtained by summing the durations of all time windows. ,by The event arrival rate is used as the base state and recorded. With time window length The correspondence;

[0118] Construct a set of emergency status levels ,by Starting from the geometric hierarchy, generate the emissivity of each state. ,in Take a fixed multiplier. Indicates the state level sequence number; determines the number of states. Make the highest level state satisfy And record the mapping table between the state and emissivity of each level;

[0119] Construct a launch cost table for each time window. With each state With "in duration" Within the time window, the state The arrival rate Observed at time Using the Poisson arrival process of the "sub-event" as a counting model, the corresponding negative log-likelihood is calculated as the emission cost. After omitting constant terms that are irrelevant to the state hierarchy, the emission cost satisfies:

[0120] ;

[0121] And Write the launch cost table according to the time window number and state level;

[0122] Construct a transition cost table for state transitions within any adjacent time window. Constructing hierarchical differences ,in Recorded as a transfer to maintain, This is recorded as an upward transition. This is denoted as a fallback transition; a constant cost is assigned to the hold transition. The transfer costs for both upward and downward transfers are constructed by linearly accumulating the absolute values ​​of the hierarchical differences, satisfying the following:

[0123] ;

[0124] in, The cost per level of ascent is a constant. Let the unit level fallback cost constant be, and Write it into the transfer cost table;

[0125] The first improvement step is introduced into the transfer cost table: A consistency label is calculated for the access subject set and data object set of adjacent time windows. The access subject set is obtained by deduplicating the identity identifiers within that time window, and the data object set is obtained by deduplicating the data object identifiers within that time window. The consistency label is valid if the intersection of the access subject set and the data object set of adjacent time windows is non-empty; otherwise, it is invalid. When the consistency label is invalid, a jump restriction is applied to the ascending transfer, with the restriction rule being that only jumps are allowed. For those that do not meet the restriction rules The transfer is marked as unreachable in the transfer cost table;

[0126] Based on the launch cost table and the transfer cost table, a cumulative cost recursive relationship is constructed. The cumulative total cost is calculated for each state level in the order of time windows. The cumulative total cost is obtained by adding the cumulative total cost of each state in the previous time window to the launch cost and state transition cost of the current time window. The predecessor state index is recorded for each state in each time window. In the last time window, the state with the minimum cumulative total cost is selected as the termination state. The optimal state path is obtained by backtracking. The burst state sequence and burst intensity sequence are output, and the burst intensity is taken as the value of the corresponding state level.

[0127] A second improvement step is introduced on the optimal state path: For consecutive burst state time windows, burst segments are formed. For each burst segment, the intersection of the access subject set and the data object set within the segment is extracted as the segment consistency set. When there is only one basic state time window between two adjacent burst segments, and the segment consistency sets of both burst segments are not empty, the state level of the basic state time window is relabeled as a first-level burst state, and the three segments are merged into the same burst segment. When the length of a burst segment is a single time window and the consistency label corresponding to the burst segment is invalid before and after, the state level of the burst segment is relabeled as a basic state.

[0128] Based on the recalibrated sequence of sudden states, the set of target time windows for the occurrence of sudden states is determined, and the corresponding behavioral feature vectors are extracted according to the position index of the target time window set in the sequence of behavioral feature vectors to form a set of target behavioral feature vectors. The target time window identifier, sudden state value and sudden intensity value are associated and recorded.

[0129] In this embodiment, S4 includes:

[0130] S41. Read the behavioral feature vector sequence and the sudden state sequence, and extract the time window index set of the sudden state as the base state. and based on Extract corresponding behavioral feature vectors from the behavioral feature vector sequence to form an initial set of normal behavior samples. Read the target time window set The time window index, and based on Extract target behavioral feature vectors from the behavioral feature vector sequence to form a target sample set. Maintain a one-to-one correspondence between the target time window identifier and the target sample set;

[0131] S42. Set up the initial normal behavior sample set Each behavioral feature vector is arranged in field order to form a sample vector. The fields, in order, include the average arrival interval, the number of access requests, the concentration of data object access, and the change in operation path, forming a sample matrix. ; set of target samples Each target behavior feature vector is arranged in the order of the same fields to form the target vector. Maintain consistency with the field order of the sample matrix;

[0132] S43. Generate the boundary sample set and the core sample set: Calculate the sample center vector. Let the mean of each sample vector in the sample matrix be denoted as . Calculate the Euclidean distance from each sample vector to the sample center vector and select the vector with the largest distance as the initial boundary sample. Then, for the remaining sample vectors, successively calculate the minimum Euclidean distance from each vector to the selected boundary sample set and add the sample with the largest minimum Euclidean distance to the boundary sample set, until the number of boundary samples reaches . Obtain the boundary sample set In the sample matrix Select the one with the smallest distance to the sample center vector. The sample vectors form the core sample set. ,in Indicates the number of dimensions in the behavioral feature vector;

[0133] S44, Based on Boundary Sample Set With core sample set Construct feature basis sets separately for the boundary sample set. Each boundary sample vector in Expanding the boundary feature basis vectors in a fixed order—constant terms, linear terms of each field component, and univariate square terms of each field component—and then collecting all boundary feature basis vectors into a boundary feature basis set; for the core sample set... Each core sample vector in The core feature basis vectors are formed by expanding the constant term, the linear term of each field component, and the square term of each field component in a fixed order, and then all the core feature basis vectors are gathered into a core feature basis set.

[0134] S45. Construct matrix-based support domain representations for the boundary feature basis set and the core feature basis set respectively: Read each boundary feature basis vector from the boundary feature basis set. Calculate the outer product of the boundary feature basis vector and its transpose. The outer product results of all boundary feature basis vectors in the boundary feature basis set are summed to form the boundary matrix. , where the boundary matrix Represent the matrix-formatted support domain of the boundary sample set in the feature basis space; read each core feature basis vector from the core feature basis set. Calculate the outer product of the core feature basis vector and its transpose. The outer product results of all core feature basis vectors in the core feature basis set are summed to form the core matrix. The core matrix Represent the matrixed support domain of the core sample set in the feature basis space; for the boundary matrix After adding the regularization term, the inverse matrix is ​​obtained by taking the boundary inverse matrix. For the core matrix After adding a regularization term, the inverse matrix is ​​obtained by inverting the matrix. ; the boundary sample set, the boundary feature basis set, and the boundary matrix and boundary inverse matrix Combined into a boundary support domain layer, the core sample set, core feature basis set, and core matrix are... and core inverse matrix The core support domain layer is combined with the boundary support domain layer to form a two-layer behavioral feature support domain model.

[0135] S46. For the target sample set Each target vector Construct target feature basis vectors The boundary inverse Christoffel value is obtained by calculating using a quadratic form. Inverse Christoffel value of the core The quadratic form calculation satisfies:

[0136] ;

[0137] in, Represents the target vector The corresponding inverse Christoffel value, Take the boundary inverse matrix When Take the core inverse matrix When ;

[0138] S47. During the deviation scoring phase, the same target vector The support domain deviation score is obtained by calculating the difference between the boundary inverse Christoffel value and the core inverse Christoffel value.

[0139] ;

[0140] And Index alignment is performed based on the target time window identifier to form a support domain deviation score sequence;

[0141] S48. Associate and record the target time window identifier, target behavior feature vector, boundary inverse Christoffel value, core inverse Christoffel value and support domain deviation score to generate support domain deviation score results that correspond one-to-one with the target time window, and pass them to the subsequent joint risk assessment steps.

[0142] In this embodiment, S5 includes:

[0143] S51. Read the output target time window set and the burst intensity sequence corresponding to each target time window, and read the output support domain deviation score sequence; index and align the burst intensity value and support domain deviation score according to the target time window identifier, and construct a joint judgment data table. Each record in the joint judgment data table contains the time window identifier, burst state value, burst intensity value and support domain deviation score.

[0144] S52. Extract records from the joint judgment data table whose sudden state values ​​are higher than the baseline values ​​to form a sudden time window set. Extract the support domain deviation score from the joint judgment data table if it exceeds the preset threshold. The records form a set of deviation time windows. Preset threshold Determined based on the statistical distribution of the deviation score sequence from the support domain;

[0145] S53, Set of Sudden Time Windows With deviation time window set Perform a set intersection operation based on the time window identifier to obtain a composite trigger time window set. and based on Extract the corresponding burst intensity value and support domain deviation score from the index position in the joint judgment data table;

[0146] S54. For each time window in the composite trigger time window set. The joint risk value is calculated by multiplying the sudden intensity value corresponding to the time window with the support domain deviation score. The joint risk value satisfies the following: ,in Indicates the first The combined risk value for each time window, Indicates the first The burst intensity value corresponding to each time window Indicates the first The support domain deviation score corresponding to each time window;

[0147] S55. Sort the records in the composite triggering time window set according to the magnitude of the joint risk value, and perform interval mapping on the joint risk value according to the preset risk interval threshold to divide the joint risk value into multiple risk level intervals, with each risk level interval corresponding to a risk level identifier.

[0148] S56. Generate a risk assessment result for each record in the composite trigger time window set. The risk assessment result includes the time window identifier, the sudden state value, the sudden intensity value, the support domain deviation score, the joint risk value, and the risk level identifier, and forms a risk assessment result sequence according to the time window order.

[0149] In this embodiment, S6 includes:

[0150] S61. Read the risk assessment result sequence, extract the target time window set where the risk level identifier falls into the preset alarm level set, and keep the target time window identifier consistent with the index of the corresponding sudden intensity value, support domain deviation score and joint risk value.

[0151] S62. Based on the index range of the target time window set in the time window event set, backtrack to locate the time window event set corresponding to each target time window, and extract the event record field group from the time window event set. The event record field group includes identity identifier, data object identifier, access request type, operation type, event time and session context fields to form the target behavior record set.

[0152] S63. Merge the target behavior record set according to the session context field to obtain session behavior record groups; sort each session behavior record group in ascending order of event time, extract the total number of event records, the deduplication count of data objects and the operation type sequence to form a behavior summary field group within the target time window;

[0153] S64. Construct an alarm primary key for each target time window. The alarm primary key is generated by combining the identity identifier, data object identifier, target time window identifier, and session identifier. Perform deduplication processing on the target behavior record set corresponding to the same alarm primary key. The deduplication rule is to retain only one event record whose event time, access request type, and operation type fields are consistent.

[0154] S65. Align the fields of alarm primary key, risk level identifier, sudden state value, sudden intensity value, supporting domain deviation score, joint risk value and behavior summary field group and encapsulate them into alarm data record. Write the generation timestamp and unique alarm number into the alarm data record to form real-time abnormal usage behavior alarm data.

[0155] S66. Arrange the real-time abnormal usage behavior alarm data according to the time order of the target time window identifier to generate an alarm data sequence.

[0156] Example:

[0157] To verify the application effect of the proposed AI-based real-time data anomaly usage behavior analysis system in complex data security monitoring scenarios, the system was deployed in the data security management platform of a large data operation enterprise. This enterprise operates multiple business systems and data analysis platforms, including a customer data management system, a business analysis system, a data sharing platform, and a data warehouse platform. Different business departments need to perform operations such as querying, analyzing, statistically analyzing, exporting, and API calls on massive amounts of data daily. As the enterprise's data scale continues to expand, data access behavior exhibits characteristics such as a large number of access subjects, high access frequency, and rapid changes in access objects. Traditional data security monitoring systems mainly rely on database audit rules and fixed threshold strategies for anomaly identification, generating alarms when the number of accesses, the amount of exported data, or the number of accesses to sensitive fields exceeds preset thresholds. However, in actual business operations, legitimate data analysis tasks may also generate a large number of access requests in a short period, causing the system to frequently trigger false alarms. Simultaneously, some abnormal data acquisition behaviors are completed gradually through multiple distributed accesses, with each single access behavior not exceeding the threshold. Therefore, traditional systems struggle to detect such hidden anomalies in a timely manner. Due to the lack of joint analysis capabilities for time-series changes in access behavior and multi-dimensional behavioral characteristics, traditional systems are significantly inadequate in identifying complex abnormal behaviors. Security managers need to spend a lot of time manually reviewing alarm information, resulting in low efficiency in data security monitoring.

[0158] In this scenario, the real-time data anomaly usage behavior analysis system proposed in this invention includes an event acquisition module, a feature construction module, a burst detection module, an anomaly scoring module, a risk assessment module, and an alarm output module. The event acquisition module is deployed at the data access gateway, database audit node, and business system log interface to collect data access logs in real time. The event acquisition module extracts identity identifier, data object identifier, access request type, operation type, event time, and session context fields from the logs, and performs unified mapping processing on fields from different log sources. Subsequently, the system performs a unified time base conversion on all event records and sorts them in ascending order according to event time. The system further divides the event records into sessions based on the identity identifier and session context fields, merging the access behaviors of the same user in the same session into session event groups, and merging all session event groups while maintaining the event time order to generate a continuous behavior event sequence. Through this process, the system can completely record the user's access behavior trajectory within the system.

[0159] After receiving a continuous sequence of behavioral events, the feature construction module divides the sequence into sliding time windows. The system sets a fixed-length time window and a sliding step size, and segments the sequence of behavioral events according to their chronological order. Within each time window, the system sequentially reads the event time field and calculates the time difference between adjacent events, forming an event arrival interval sequence, and further obtains the average arrival interval value. Simultaneously, the system counts the total number of access requests within the time window as the access request count, and also counts the access counts for different data objects within the time window, generating a data object access concentration based on the access ratio of different data objects. The system also reads the operation type field according to the event occurrence order to form an operation sequence, and counts the number of changes in adjacent operation types to obtain the operation path change. Subsequently, the system combines the average arrival interval value, access request count, data object access concentration, and operation path change in a unified field order to form a behavioral feature vector, and generates a behavioral feature vector sequence according to the time window order. Through this module, the system can provide a structured description of user data access behavior.

[0160] The burst detection module constructs an event arrival frequency sequence based on the average arrival interval value in the behavioral feature vector sequence and inputs this sequence into the Kleinberg burst detection model. The system first calculates the arrival rate of basic state events based on the number of access requests and the length of each time window, and constructs a burst state hierarchy set based on a geometric hierarchy. Then, the system calculates the transmission cost for each time window and each state level, and calculates the state transition cost based on the state level change relationship. To reduce misjudgments caused by abnormal jump-level states, the system further extracts the access subject set and data object set from adjacent time windows and generates consistency labels. When the consistency label between adjacent time windows is not valid, the system imposes a jump-level restriction on ascending transitions, allowing only adjacent level state transitions. Subsequently, the system performs optimal state path solving for all time windows based on the cumulative cost recursive relationship, and generates a burst state sequence and a burst intensity sequence through path backtracking. The system further recalibrates burst segments formed by continuous burst states, merging burst segments that are only separated by one basic state time window and meet the consistency condition, thereby forming the final burst state result and determining the target time window set.

[0161] The anomaly scoring module extracts behavioral feature vectors corresponding to non-sudden states from the behavioral feature vector sequence to construct a normal behavior sample set. The system performs matrix processing on the behavioral feature vectors in the normal behavior sample set and calculates the sample center vector. Subsequently, the system selects a boundary sample set based on the distance between the sample vector and the sample center vector, and further selects the samples closest to the center vector to form a core sample set. The system constructs feature basis sets based on the boundary sample set and the core sample set respectively, and forms the boundary matrix and core matrix through outer accumulation. After matrix inversion, the system establishes a two-layer behavioral feature support domain model. For the target behavioral feature vector corresponding to the target time window, the system uses the inverse Christoffel function anomaly detection algorithm to calculate the boundary inverse Christoffel value and the core inverse Christoffel value respectively, and generates a support domain deviation score based on the difference between the two. Through this module, the system can identify data access behaviors that deviate from the normal behavior distribution boundary.

[0162] The risk assessment module aligns the burst intensity value output by the burst detection module with the support domain deviation score output by the anomaly scoring module, and constructs a joint assessment data table. The system extracts time window records where the burst state is higher than the baseline state from the joint assessment data table, and simultaneously extracts time window records where the support domain deviation score exceeds a preset threshold. It then determines a composite triggering time window set through set intersection. For each time window in the composite triggering time window set, the system calculates a joint risk value based on the burst intensity value and the support domain deviation score, and completes the risk level mapping according to a preset risk interval threshold, generating a risk assessment result sequence.

[0163] The alarm output module extracts behavioral records within the target time window based on the risk assessment results and correlates and organizes the fields of identity identifier, data object identifier, access request type, operation type, event time, and session context. The system merges behavioral records within the same session and generates a behavioral summary field group. Subsequently, the system constructs an alarm primary key based on the identity identifier, data object identifier, target time window identifier, and session identifier, and performs deduplication on duplicate behavioral records. Finally, the system correlates and encapsulates the risk level identifier, outbreak state value, outbreak intensity value, supporting domain deviation score, and behavioral summary field group to form real-time behavioral alarm data, which is then output to the security risk handling system.

[0164] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A real-time data anomaly usage behavior analysis system based on artificial intelligence, characterized in that, Includes the following modules: The event acquisition module collects data using events, encodes the data using events according to a unified field structure, sorts them by event time, and outputs a sequence of continuous behavioral events after verification. The feature construction module divides the continuous behavioral event sequence into sliding time windows, and counts the event arrival interval, average arrival interval, number of access requests, data object access concentration, and operation path change within each time window to construct a sequence of behavioral feature vectors. The burst detection module constructs an event arrival frequency sequence based on the event arrival intervals in the behavioral feature vector sequence. This sequence is then input into the Kleinberg burst detection model. The Kleinberg model forms observation pairs based on the number of access requests and the time window length, calculates the base emissivity, and constructs a burst state hierarchy set. An emission cost table is built for each time window and each state hierarchy, and a transition cost table is built for state hierarchy changes between adjacent time windows. Skip restrictions are applied to ascending transitions in the transition cost table based on the access subject set and data object set of adjacent time windows. In the transition cost table, a consistency label is calculated for the access subject set and data object set of adjacent time windows. The access subject set is obtained by deduplicating the identity identifiers within the time window, and the data object set is obtained by deduplicating the data object identifiers within the time window. A consistency label is valid when the intersection of the access subject set and the data object set of adjacent time windows is non-empty; otherwise, it is invalid. When the consistency label is invalid, a skip restriction is applied to ascending transitions, with the restriction rule being that only skips are allowed. For those that do not meet the restriction rules The transfer is marked as unreachable in the transfer cost table, where and Both represent state level numbers; Based on the launch cost table and transfer cost table, cumulative cost recursion and optimal state path backtracking are performed to generate a burst state sequence and a burst intensity sequence, and the target time window and target behavior feature vector are determined according to the burst state level. The anomaly scoring module extracts behavioral feature vectors corresponding to non-sudden states to construct a normal behavior sample set. Based on the normal behavior sample set, it generates a boundary sample set and a core sample set. The boundary inverse matrix corresponding to the boundary sample set and the core inverse matrix corresponding to the core sample set constitute a two-layer behavioral feature support domain model. The module calculates the boundary inverse Christoffel value and the core inverse Christoffel value corresponding to the target behavioral feature vector using the inverse Christoffel function anomaly detection algorithm. The module generates a support domain deviation score based on the difference between the boundary inverse Christoffel value and the core inverse Christoffel value. The risk assessment module jointly maps the sudden intensity value corresponding to the target time window with the support domain deviation score, and generates a risk assessment result for the target time window that simultaneously meets the conditions of a sudden state and the support domain deviation score exceeds a preset threshold. The alarm output module extracts behavior records within the target time window based on the risk assessment results, and associates and encapsulates the identity identifier, data object identifier, target time window identifier, sudden intensity value, and support domain deviation score to form real-time abnormal usage behavior alarm data.

2. A real-time data anomaly usage behavior analysis method based on artificial intelligence, employing the real-time data anomaly usage behavior analysis system based on artificial intelligence as described in claim 1, characterized in that, The modules are connected in the following way: S1. Collect data using events, encode the data using events according to a unified field structure and sort them by event time, and output the continuous behavior event sequence after verification processing; S2. Divide the continuous sequence of behavioral events into sliding time windows, and statistically analyze the event arrival interval, average arrival interval, number of access requests, data object access concentration, and operation path change within each time window to construct a sequence of behavioral feature vectors. S3. Construct an event arrival frequency sequence based on the event arrival interval in the behavioral feature vector sequence. Input the event arrival frequency sequence into the Kleinberg burst detection model. The Kleinberg burst detection model forms observation pairs based on the number of access requests and the time window length, calculates the base emissivity, and constructs a burst state hierarchy set. Construct an emission cost table for each time window and each state hierarchy, and construct a transition cost table for state hierarchy changes between adjacent time windows. Apply a jump restriction to the ascending transition in the transition cost table based on the access subject set and data object set of adjacent time windows. In the transition cost table, calculate a consistency label for the access subject set and data object set of adjacent time windows. The access subject set is obtained by deduplicating the identity identifiers within the time window, and the data object set is obtained by deduplicating the data object identifiers within the time window. The consistency label is valid when the intersection of the access subject set and the data object set of adjacent time windows is non-empty; otherwise, it is not valid. When the consistency label is not valid, apply a jump restriction to the ascending transition, with the restriction rule being that only jumps are allowed. For those that do not meet the restriction rules The transfer is marked as unreachable in the transfer cost table, where and Both represent state level numbers; Based on the launch cost table and transfer cost table, cumulative cost recursion and optimal state path backtracking are performed to generate a burst state sequence and a burst intensity sequence, and the target time window and target behavior feature vector are determined according to the burst state level. S4. Extract behavioral feature vectors corresponding to non-sudden states to construct a normal behavior sample set. Based on the normal behavior sample set, generate a boundary sample set and a core sample set. The boundary inverse matrix corresponding to the boundary sample set and the core inverse matrix corresponding to the core sample set constitute a two-layer behavioral feature support domain model. Calculate the boundary inverse Christoffel value and the core inverse Christoffel value corresponding to the target behavioral feature vector using the inverse Christoffel function anomaly detection algorithm. Generate a support domain deviation score based on the difference between the boundary inverse Christoffel value and the core inverse Christoffel value. S5. Jointly map the sudden intensity value corresponding to the target time window with the support domain deviation score, and generate a risk judgment result for the target time window that simultaneously meets the conditions of sudden state and support domain deviation score exceeding the preset threshold. S6. Extract behavior records within the target time window based on the risk assessment results, and associate and encapsulate the identity identifier, data object identifier, target time window identifier, sudden intensity value and support domain deviation score to form real-time abnormal usage behavior alarm data.

3. The real-time analysis method for abnormal data usage behavior based on artificial intelligence according to claim 2, characterized in that, S1 includes: S11. Collect data access logs at the data access gateway, database audit module and business system log interface, extract identity identifier, data object identifier, access request type, operation type, event time and session context fields, and generate raw data usage event records; S12. Establish a unified field structure, map the field names in different log sources to identity fields, data object identification fields, access request type fields, operation type fields, event time fields, and session context fields, and reorganize the original data using event recording according to the field structure to form standard event records; S13. Perform a unified time base conversion on the event time field in the standard event record, convert the timestamps generated by different systems into a unified time format, and sort all standard event records in ascending order according to the event time to obtain a time-sorted event set. S14. Divide the time-sorted event set into sessions based on the identity identifier field and the session context field. Divide event records with the same identity identifier and the same session identifier into the same session event group, and maintain the time order of events within each session event group. S15. Merge and arrange the event records in all session event groups according to the global event time order, and number the event records in time order to maintain an increasing time relationship between adjacent events and generate a continuous action event sequence. S16. Perform consistency verification on the continuous action event sequence, identify and clean up duplicate event records, session identifier mismatch records and invalid data object records, and output the continuous action event sequence after verification.

4. The real-time data anomaly usage behavior analysis method based on artificial intelligence according to claim 2, characterized in that, S2 includes: S21. Read the event time, data object identifier, access request type, and operation type fields from the continuous action event sequence, and set the sliding time window length. and sliding step size Based on the event time, a continuous sequence of behavioral events is truncated in chronological order to form a... A set of time window events ; S22. For each time window event set, sequentially traverse the event times, calculate the time difference between adjacent events, obtain the event arrival interval sequence of the time window, and average the event arrival interval sequence to obtain the average arrival interval value of the corresponding time window. S23. Count the total number of event records in the event set of each time window as the number of access requests, and count the number of accesses for different data object identifiers within the same time window. Calculate the access ratio for each data object, and calculate the data object access concentration for the time window based on the access ratio. ,in Indicates the first Data object access concentration within a time window Indicates the first The first time window Access ratio of class data objects, This indicates the number of data object categories within the time window; S24. Read the operation type field in the time window event set according to the order of event occurrence to form an operation sequence. Judge whether adjacent operation types have changed one by one and accumulate the number of changes to obtain the operation path change amount of the time window. S25. Combine the average arrival interval, number of access requests, data object access concentration, and operation path change according to a unified field structure order to construct a behavioral feature vector for the corresponding time window. S26. Arrange all behavioral feature vectors according to the time order of the time window to generate a sequence of behavioral feature vectors that correspond one-to-one with each time window.

5. The real-time data anomaly usage behavior analysis method based on artificial intelligence according to claim 2, characterized in that, S3 includes: S31. Read the average arrival interval value and event arrival interval sequence corresponding to each time window in the behavior feature vector sequence. Perform a reciprocal transformation on the event arrival interval sequence to obtain the event arrival frequency sequence corresponding to each time window, where the first... The event arrival frequency within a time window is expressed as: ,in Indicates the first The frequency of event arrivals within a time window. Indicates the first Average arrival interval for each time window; S32. Input the event arrival frequency sequence into the Kleinberg burst detection model in chronological order, and establish a one-to-one correspondence between each time window identifier and the corresponding behavioral feature vector in the behavioral feature vector sequence to form a burst detection input sequence. S33. Use the Kleinberg burst detection model to perform state evaluation calculations on the burst detection input sequence, and output the burst state sequence and burst intensity sequence corresponding to each time window; S34. Identify the time window for the establishment of an emergency state based on the emergency state sequence, determine the time window where the emergency state level is higher than the basic state as the target time window, and record the emergency intensity value corresponding to the target time window. S35. Based on the position index of the target time window in the behavioral feature vector sequence, extract the corresponding behavioral feature vector to form a target behavioral feature vector set, and associate and record the target time window identifier, sudden state value, sudden intensity value and target behavioral feature vector.

6. The real-time data anomaly usage behavior analysis method based on artificial intelligence according to claim 5, characterized in that, The Kleinberg burst detection model includes: Receive the event arrival frequency sequence and maintain the time window identifier order, for the first Read the number of access requests within a time window. With time window length Event arrival frequency and Establish correspondences and form observation pairs arranged by time windows. ; The sum of the number of access requests for all time windows is obtained. ,in This represents the total number of time windows, obtained by summing the durations of all time windows. ,by The event arrival rate is used as the base state and recorded. With time window length The correspondence; Construct a set of emergency status levels ,by Starting from the geometric hierarchy, generate the emissivity of each state. ,in Take a fixed multiplier. Indicates the state level number; determines the number of states. Make the highest level state satisfy And record the mapping table between the state and emissivity of each level; Construct a launch cost table for each time window. With each state , with "in duration as Within the time window, the state The arrival rate Observed at time Using the Poisson arrival process of the "sub-event" as a counting model, the corresponding negative log-likelihood is calculated as the emission cost. After omitting constant terms that are irrelevant to the state hierarchy, the emission cost satisfies: ； And Write the launch cost table according to the time window number and state level; Construct a transition cost table for state transitions within any adjacent time window. Constructing hierarchical differences ,in Recorded as a transfer to maintain, This is recorded as an upward transition. This is recorded as a pullback transition. Indicates the state level index; assigns a constant cost to hold transitions. The transfer costs for both upward and downward transfers are constructed by linearly accumulating the absolute values ​​of the hierarchical differences, satisfying the following: ； in, The cost per level of ascent is a constant. Let the unit level fallback cost constant be, and Write it into the transfer cost table; In the transfer cost table, a consistency label is calculated for the access subject set and the data object set of adjacent time windows. The access subject set is obtained by deduplicating the identity identifiers within the time window, and the data object set is obtained by deduplicating the data object identifiers within the time window. The consistency label is valid when the intersection of the access subject set and the data object set of adjacent time windows is non-empty; otherwise, it is invalid. When the consistency label is invalid, a jump restriction is applied to the ascending transfer, and the restriction rule is that only jumps are allowed. For those that do not meet the restriction rules The transfer is marked as unreachable in the transfer cost table; Based on the launch cost table and the transfer cost table, a cumulative cost recursive relationship is constructed. The cumulative total cost is calculated for each state level in the order of time windows. The cumulative total cost is obtained by adding the cumulative total cost of each state in the previous time window to the launch cost and state transition cost of the current time window. The predecessor state index is recorded for each state in each time window. In the last time window, the state with the minimum cumulative total cost is selected as the termination state. The optimal state path is obtained by backtracking. The burst state sequence and burst intensity sequence are output, and the burst intensity is taken as the value of the corresponding state level. On the optimal state path, burst segments are formed for consecutive burst state time windows. For each burst segment, the intersection of the access subject set and the data object set within the segment is extracted as the segment consistency set. When there is only one basic state time window between two adjacent burst segments, and the segment consistency sets of both burst segments are not empty, the state level of the basic state time window is relabeled as a first-level burst state, and the three segments are merged into the same burst segment. When the length of the burst segment is a single time window and the consistency label corresponding to the burst segment is invalid before and after, the state level of the burst segment is relabeled as a basic state. Based on the recalibrated sequence of sudden states, the set of target time windows for the occurrence of sudden states is determined, and the corresponding behavioral feature vectors are extracted according to the position index of the target time window set in the sequence of behavioral feature vectors to form a set of target behavioral feature vectors. The target time window identifier, sudden state value and sudden intensity value are associated and recorded.

7. The real-time data anomaly usage behavior analysis method based on artificial intelligence according to claim 2, characterized in that, S4 includes: S41. Read the behavioral feature vector sequence and the sudden state sequence, and extract the time window index set of the sudden state as the basic state. and based on Extract corresponding behavioral feature vectors from the behavioral feature vector sequence to form an initial set of normal behavior samples. Read the target time window set The time window index, and based on Extract target behavioral feature vectors from the behavioral feature vector sequence to form a target sample set. Maintain a one-to-one correspondence between the target time window identifier and the target sample set; S42. Set up the initial normal behavior sample set Each behavioral feature vector is arranged in field order to form a sample vector. The fields, in order, include the average arrival interval, the number of access requests, the concentration of data object access, and the change in operation path, forming a sample matrix. ; set of target samples Each target behavior feature vector is arranged in the order of the same fields to form the target vector. Maintain consistency with the field order of the sample matrix; S43. Generate the boundary sample set and the core sample set: Calculate the sample center vector. Let the mean of each sample vector in the sample matrix be denoted as . Calculate the Euclidean distance from each sample vector to the sample center vector and select the vector with the largest distance as the initial boundary sample. Then, for the remaining sample vectors, successively calculate the minimum Euclidean distance from each vector to the selected boundary sample set and add the sample with the largest minimum Euclidean distance to the boundary sample set, until the number of boundary samples reaches . Obtain the boundary sample set In the sample matrix Select the one with the smallest distance to the sample center vector. The sample vectors form the core sample set. ,in Indicates the number of dimensions in the behavioral feature vector; S44, Based on Boundary Sample Set With core sample set Construct feature basis sets separately for the boundary sample set. Each boundary sample vector in Expanding the boundary feature basis vectors in a fixed order—constant terms, linear terms of each field component, and univariate square terms of each field component—and then collecting all boundary feature basis vectors into a boundary feature basis set; for the core sample set... Each core sample vector in The core feature basis vectors are formed by expanding the constant term, the linear term of each field component, and the square term of each field component in a fixed order, and then all the core feature basis vectors are gathered into a core feature basis set. S45. Construct matrix-based support domain representations for the boundary feature basis set and the core feature basis set respectively: Read each boundary feature basis vector from the boundary feature basis set. Calculate the outer product of the boundary feature basis vector and its transpose. The outer product results of all boundary feature basis vectors in the boundary feature basis set are summed to form the boundary matrix. , where the boundary matrix Represent the matrix-formatted support domain of the boundary sample set in the feature basis space; read each core feature basis vector from the core feature basis set. Calculate the outer product of the core feature basis vector and its transpose. The outer product results of all core feature basis vectors in the core feature basis set are summed to form the core matrix. The core matrix Represent the matrixed support domain of the core sample set in the feature basis space; for the boundary matrix After adding the regularization term, the inverse matrix is ​​obtained by taking the boundary inverse matrix. For the core matrix After adding a regularization term, the inverse matrix is ​​obtained by inverting the matrix. The boundary sample set, the boundary feature basis set, and the boundary matrix are combined. and boundary inverse matrix Combined into a boundary support domain layer, the core sample set, core feature basis set, and core matrix are... and core inverse matrix The core support domain layer is combined with the boundary support domain layer to form a two-layer behavioral feature support domain model. S46. For the target sample set Each target vector Construct target feature basis vectors The boundary inverse Christoffel value is obtained by calculating using a quadratic form. Inverse Christoffel value of the core The quadratic form calculation satisfies: ； in, Represents the target vector The corresponding inverse Christoffel value, Take the boundary inverse matrix When Take the core inverse matrix When ; S47. During the deviation scoring phase, the same target vector The support domain deviation score is obtained by calculating the difference between the boundary inverse Christoffel value and the core inverse Christoffel value. ； And Index alignment is performed based on the target time window identifier to form a support domain deviation score sequence; S48. Associate and record the target time window identifier, target behavior feature vector, boundary inverse Christoffel value, core inverse Christoffel value and support domain deviation score to generate a support domain deviation score result that corresponds one-to-one with the target time window.

8. The real-time data anomaly usage behavior analysis method based on artificial intelligence according to claim 2, characterized in that, S5 includes: S51. Read the target time window set and the burst intensity sequence corresponding to each target time window, and read the support domain deviation score sequence; index and align the burst intensity value and support domain deviation score according to the target time window identifier, and construct a joint judgment data table. Each record in the joint judgment data table contains the time window identifier, burst state value, burst intensity value and support domain deviation score. S52. Extract records from the joint judgment data table whose sudden state values ​​are higher than the baseline values ​​to form a sudden time window set. Extract the support domain deviation score from the joint judgment data table if it exceeds the preset threshold. The records form a set of deviation time windows. Preset threshold Determined based on the statistical distribution of the deviation score sequence from the support domain; S53, Set of Sudden Time Windows With deviation time window set Perform a set intersection operation based on the time window identifier to obtain a composite trigger time window set. and based on Extract the corresponding burst intensity value and support domain deviation score from the index position in the joint judgment data table; S54. For each time window in the composite trigger time window set. The joint risk value is calculated by multiplying the sudden intensity value corresponding to the time window with the support domain deviation score. The joint risk value satisfies the following: ,in Indicates the first The combined risk value for each time window, Indicates the first The burst intensity value corresponding to each time window Indicates the first The support domain deviation score corresponding to each time window; S55. Sort the records in the composite triggering time window set according to the magnitude of the joint risk value, and perform interval mapping on the joint risk value according to the preset risk interval threshold to divide the joint risk value into multiple risk level intervals, with each risk level interval corresponding to a risk level identifier. S56. Generate a risk assessment result for each record in the composite trigger time window set. The risk assessment result includes the time window identifier, the sudden state value, the sudden intensity value, the support domain deviation score, the joint risk value, and the risk level identifier, and forms a risk assessment result sequence according to the time window order.

Images