A data behavior analysis detection method, device, equipment, medium and product

Abstract

This application provides a data behavior analysis and detection method, apparatus, device, medium, and product. The method includes: acquiring behavior analysis data; determining multi-dimensional behavior parameters of the behavior analysis data; determining a base duration based on the variation characteristics of the multi-dimensional behavior parameters; determining a window length based on the base duration; and acquiring multiple sets of historical behavior data prior to the occurrence of the behavior analysis data based on the window length; determining whether to analyze and detect the behavior analysis data based on the fluctuation differences between the behavior analysis data and the multiple sets of historical behavior data in each dimension of the multi-dimensional behavior parameters; and, if it is determined that the behavior analysis data should be analyzed and detected, inputting the behavior analysis data into a pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model. This improves the accuracy, relevance, and processing efficiency of data behavior analysis and detection, thereby ensuring data security.

Description

Technical Field

[0001] This application relates to the field of data security operation technology, and in particular to a data behavior analysis and detection method, apparatus, equipment, medium and product. Background Technology

[0002] With the deepening of digitalization, data has become a key production factor, and its security is increasingly important. Against this backdrop, cybersecurity constitutes one of the main risks affecting data security. To address these risks, data behavior analysis and monitoring technology has emerged. Its core lies in the continuous monitoring and in-depth analysis of data access, manipulation, and transmission behaviors through technical means. This technology aims to identify abnormal operations deviating from normal patterns from massive behavioral records, such as unauthorized access, malicious data tampering or leakage attempts, thereby enabling timely warnings and blocking of security threats, ultimately ensuring the effective protection of data confidentiality and integrity.

[0003] However, some existing technical solutions are still insufficient in terms of the dimensions and depth of risk identification. For example, a typical existing technology focuses on analyzing attack behaviors against the system and using the analysis results to guide subsequent vulnerability testing. While this method can effectively locate frequently exploited real system vulnerabilities and reduce false positives, its protection perspective is relatively limited, mainly focusing on risks caused by software vulnerabilities. In fact, security risks do not only stem from system vulnerabilities. Even when the system itself has no known vulnerabilities, unauthorized operations performed after the theft of legitimate user credentials can also pose a serious threat, and such risks are difficult to detect through vulnerability analysis alone.

[0004] In summary, existing data behavior analysis methods have relatively limited analytical dimensions, rely excessively on vulnerability detection, and lack comprehensive analytical capabilities, resulting in low accuracy and poor data security. Summary of the Invention

[0005] This application provides a data behavior analysis and detection method, apparatus, device, medium, and product to address the technical problems of existing data behavior analysis methods, which have relatively simple analysis dimensions, rely excessively on vulnerability detection, lack comprehensive analysis capabilities, resulting in low accuracy and poor data security.

[0006] To solve the above-mentioned technical problems, this application is implemented as follows:

[0007] In a first aspect, embodiments of this application provide a data behavior analysis and detection method, the method comprising:

[0008] Acquire behavioral analysis data, determine the multidimensional behavioral parameters of the behavioral analysis data, and determine the base duration based on the changing characteristics of the multidimensional behavioral parameters;

[0009] The window length is determined based on the base duration, and multiple sets of historical behavioral data prior to the occurrence of the behavioral analysis data are obtained according to the window length.

[0010] Based on the fluctuation differences between the behavior analysis data and the multiple sets of historical behavior data in each dimension of the multidimensional behavior parameters, it is determined whether to analyze and detect the behavior analysis data.

[0011] If it is determined that the behavior analysis data will be analyzed and detected, the behavior analysis data is input into a pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model.

[0012] Optionally, determine the multidimensional behavioral parameters of the behavioral analysis data, and determine the base duration based on the variation characteristics of the multidimensional behavioral parameters, including:

[0013] The behavior analysis data is clustered using a preset time granularity and sorted in order of occurrence from oldest to newest to obtain a behavior data time series. Each element in the behavior data time series is behavior analysis data within the preset time granularity. The multidimensional behavior parameters include at least two of the following: number of behaviors, behavior frequency, minimum behavior interval, average load value, and load anomaly duration.

[0014] Determine the target selection value for each element in the behavioral data time series, and determine multiple selection elements from the behavioral data time series based on the target selection value;

[0015] Based on the distribution positions of the multiple selected elements in the behavioral data time series, the first element of the behavioral data time series, each selected element, and the last element of the behavioral data time series are used as nodes. The duration interval between each adjacent node is calculated, and the minimum value among the duration intervals is determined as the base duration.

[0016] Optionally, determining the target selection value for each element in the behavioral data time series includes:

[0017] The current selection value of each element in the behavioral data time series is initialized to zero;

[0018] For each element in the time series of the behavioral data, at least one of the following two items is performed on each dimension of the multidimensional behavioral parameters:

[0019] The value of the element in the dimension is compared with the statistical threshold corresponding to the dimension. If the value is not less than the statistical threshold, the first preset score is added to the current selected value of the element.

[0020] The value of the element in the dimension is compared with the values ​​of the element's preceding and following adjacent elements in the dimension. If the value of the element in the dimension is not less than the value of the preceding adjacent element and not less than the value of the following adjacent element, then a second preset score is added to the current selected value of the element.

[0021] After performing at least one of the above operations on all elements of the behavioral data time series across all dimensions of the multidimensional behavioral parameters, the current selection value of each element is taken as the target selection value.

[0022] Optionally, the window length is determined based on the base duration, and multiple sets of historical behavioral data prior to the occurrence of the behavioral analysis data are obtained according to the window length, including:

[0023] Determine the time span of the behavioral analysis data;

[0024] Calculate the ratio of the base duration to the time span, and determine the window multiple based on the ratio;

[0025] The window length is determined based on the window multiplier and the base duration;

[0026] Determine the occurrence time of the behavior analysis data, and starting from the occurrence time, continuously acquire the behavior data of a preset number of windows along an earlier direction along the time axis according to the window length. Take the behavior data of each window as a group of historical behavior data to obtain the multiple groups of historical behavior data.

[0027] Optionally, determining the window multiple based on the ratio includes:

[0028] Determine whether the ratio is less than a preset ratio threshold;

[0029] If the ratio is greater than or equal to the preset ratio threshold, then the window multiple is determined to be the preset multiple;

[0030] If the ratio is less than the preset ratio threshold, an adjustment coefficient is determined based on the time span, the preset ratio threshold, and the base duration, and the window multiple is determined based on the adjustment coefficient and the preset multiple.

[0031] Optionally, based on the fluctuation differences between the behavior analysis data and the multiple sets of historical behavior data across the various dimensions of the multidimensional behavior parameters, it is determined whether to analyze and detect the behavior analysis data, including:

[0032] Using the preset time granularity as the unit, each group of historical behavior data in the multiple groups of historical behavior data is clustered, and the historical behavior data is sorted in order of occurrence from oldest to most recent, to obtain the historical time series corresponding to each group of historical behavior data.

[0033] Determine the value of each element in the behavioral data time series and the value of each element in each historical time series in each dimension of the multidimensional behavioral parameter;

[0034] For each dimension of the multidimensional behavioral parameters, the following four steps are performed: Calculate the standard deviation of the values ​​of all elements in the behavioral data time series along the specified dimension, and use this as the first standard deviation; for each historical time series, calculate the standard deviation of the values ​​of all elements within that historical time series along the specified dimension, and use this as the second standard deviation for that historical time series; calculate the standard deviation of the values ​​of all elements in all historical time series along the specified dimension, and use this as the third standard deviation; calculate the standard deviation of the values ​​of all elements in all historical time series and all elements in the behavioral data time series along the specified dimension, and use this as the fourth standard deviation.

[0035] If, in any dimension of the multidimensional behavioral parameters, the first standard deviation is greater than the second standard deviation, or the fourth standard deviation is greater than the third standard deviation, then it is determined that the behavioral analysis data will be analyzed and detected.

[0036] If the first standard deviation is less than or equal to the second standard deviation across all dimensions of the multidimensional behavioral parameters, and the fourth standard deviation is less than or equal to the third standard deviation, then it is determined that the behavioral analysis data will not be analyzed or detected.

[0037] Optionally, when the multidimensional behavioral parameters include the duration of the load anomaly, the multidimensional behavioral parameters for determining the behavioral analysis data include:

[0038] Obtain the device operation data of the target device contained in the behavior analysis data, and determine the number of cores of the target device;

[0039] Based on the device operation data, for each moment within the preset time granularity, the average load value of the moment is calculated using multiple preset statistical windows to obtain the average load value of each moment under each preset statistical window. The multiple preset statistical windows include a first statistical window and at least two second statistical windows with a length greater than the first statistical window.

[0040] The moment when the average load value under the first statistical window is greater than or equal to the number of cores is determined as an abnormal moment;

[0041] For each of the aforementioned abnormal moments, starting from the moment before the abnormal moment, each moment is checked sequentially in the direction of earlier times to determine whether the average load value of the current checked moment under the first statistical window is greater than or equal to the average load value of the current checked moment under the second statistical window; if so, the check continues to the earlier moment before; otherwise, the moment after the current checked moment is determined as the starting moment.

[0042] Starting from the moment after the abnormal moment, each moment is checked sequentially in a later direction. It is determined whether the average load value of the current checked moment under the first statistical window is greater than or equal to the average load value of the current checked moment under the second statistical window. If so, the next moment is checked. If not, the moment before the current checked moment is determined as the termination moment.

[0043] The period from the start time to the end time is defined as the abnormal interval of the abnormal time;

[0044] The overlapping abnormal intervals are merged, the duration of each merged abnormal interval is calculated, and the durations are summed to obtain the total duration, which is then determined as the load abnormal duration.

[0045] Secondly, embodiments of this application provide a data behavior analysis and detection device, the device comprising:

[0046] The acquisition module is used to acquire behavioral analysis data, determine the multidimensional behavioral parameters of the behavioral analysis data, and determine the base duration based on the changing characteristics of the multidimensional behavioral parameters.

[0047] The execution module is used to determine the window length based on the base duration, and to obtain multiple sets of historical behavior data before the occurrence of the behavior analysis data according to the window length;

[0048] Based on the fluctuation differences between the behavior analysis data and the multiple sets of historical behavior data in each dimension of the multidimensional behavior parameters, it is determined whether to analyze and detect the behavior analysis data.

[0049] If it is determined that the behavior analysis data will be analyzed and detected, the behavior analysis data is input into a pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model.

[0050] Thirdly, embodiments of this application provide a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of a data behavior analysis and detection method as described in the first aspect.

[0051] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of a data behavior analysis and detection method as described in the first aspect.

[0052] Fifthly, embodiments of this application provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of a data behavior analysis and detection method as described in the first aspect.

[0053] In this embodiment, behavioral analysis data is first acquired, and multidimensional behavioral parameters of the data are determined. Then, a base duration is determined based on the changing characteristics of these parameters. This ensures that subsequent analyses do not use a fixed, single time scale, but rather determine a suitable time benchmark based on the changing patterns of the current behavioral analysis data across multiple dimensions. This allows for a more realistic reflection of the actual fluctuations in the behavioral analysis data. Furthermore, a window length is determined based on the base duration, and multiple sets of historical behavioral data prior to the occurrence of the behavioral analysis data are acquired according to this window length. This ensures that the selected historical behavioral data is consistent with the current behavioral analysis data in terms of time scale, avoiding weakened comparison effects due to an excessively large or small historical reference range. This allows subsequent comparisons to be based on a more comparable historical context. Furthermore, based on the fluctuation differences of behavioral analysis data and multiple sets of historical behavioral data across various dimensions of multidimensional behavioral parameters, it is determined whether to analyze and detect the behavioral analysis data. Before model detection, a preliminary judgment can be made as to whether the current behavioral analysis data shows any noteworthy abnormal fluctuations relative to historical behavioral data, thereby avoiding direct analysis and detection of behavioral analysis data with insignificant fluctuation characteristics or that are basically consistent with historical states. When it is determined that behavioral analysis data should be analyzed and detected, the behavioral analysis data is then input into a pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model. This allows model resources to be concentrated on data that are more likely to contain anomalies, improving the correspondence between the model detection results and actual abnormal behaviors.

[0054] In summary, by combining multidimensional behavioral parameters to dynamically determine the base duration, constructing historical references based on the base duration, and screening for fluctuation differences before model invocation, the accuracy, relevance, and processing efficiency of data behavior analysis and detection can be improved, thereby ensuring data security. Attached Figure Description

[0055] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0056] Figure 1 A flowchart of a data behavior analysis and detection method provided in this application embodiment;

[0057] Figure 2 A flowchart of a data behavior analysis and detection method provided in this application embodiment;

[0058] Figure 3 A structural block diagram of a data behavior analysis and detection device provided in this application embodiment;

[0059] Figure 4 This is a structural block diagram of a network device provided in an embodiment of this application. Detailed Implementation

[0060] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0061] Figure 1 This application illustrates a data behavior analysis and detection method according to an embodiment of the present application, such as... Figure 1 As shown, the method includes:

[0062] Step S101: Obtain behavioral analysis data, determine the multidimensional behavioral parameters of the behavioral analysis data, and determine the base duration based on the changing characteristics of the multidimensional behavioral parameters;

[0063] Step S102: Determine the window length based on the base duration, and obtain multiple sets of historical behavioral data before the occurrence of behavioral analysis data according to the window length;

[0064] Step S103: Based on the fluctuation differences between the behavior analysis data and multiple sets of historical behavior data in various dimensions of multidimensional behavior parameters, determine whether to analyze and detect the behavior analysis data.

[0065] Step S104: If it is determined that the behavior analysis data will be analyzed and detected, the behavior analysis data is input into the pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model.

[0066] It should be noted that this embodiment does not immediately launch the data behavior analysis detection model after acquiring the behavior analysis data. Instead, it first establishes a preliminary judgment process that matches the rhythm of change of the current behavior analysis data. Specifically, it first determines the multi-dimensional behavior parameters of the behavior analysis data to characterize the current behavior state from different aspects such as the number of behaviors, behavior frequency, minimum behavior interval, average load value, and abnormal load duration, avoiding one-sided judgments based on a single indicator. On this basis, it determines the base duration according to the changing characteristics of the multi-dimensional behavior parameters, so that the subsequent time window no longer uses a fixed length, but is adapted to the density of changes in the current behavior analysis data itself. In this way, when a certain type of behavior occurs in a concentrated manner within a short period of time, the base duration can reflect the relatively compact change characteristics of that type of behavior; when the behavior change is relatively gradual, the base duration can be extended accordingly, so that the selection of subsequent historical references has a more appropriate time scale.

[0067] Furthermore, the window length is determined based on the base duration, and multiple sets of historical behavioral data prior to the occurrence of the behavioral analysis data are obtained accordingly. The purpose is to establish a comparable historical context for the current behavioral analysis data. The historical behavioral data obtained here is not arbitrarily truncated, but rather acquired continuously forward within a window length consistent with the current behavioral analysis data, ensuring consistency in the temporal structure of each set of historical behavioral data. Subsequently, based on the fluctuation differences between the current behavioral analysis data and the multiple sets of historical behavioral data across various dimensions of the multidimensional behavioral parameters, it is determined whether it is necessary to proceed to the subsequent model detection stage. In other words, the data behavioral analysis detection model primarily activates data that already exhibits abnormal fluctuations, rather than indiscriminately calling upon all behavioral analysis data. This approach reduces model resource consumption and allows the model to focus more effectively on behavioral analysis data with real analytical value, thus making the detection results more targeted and ultimately balancing detection accuracy and processing efficiency.

[0068] In one possible implementation, the multidimensional behavioral parameters of the behavioral analysis data are determined, and the base duration is determined based on the changing characteristics of the multidimensional behavioral parameters. This includes: clustering the behavioral analysis data at a preset time granularity and sorting the data in order of occurrence from oldest to youngest to obtain a behavioral data time series. Each element in the behavioral data time series represents behavioral analysis data within a preset time granularity. The multidimensional behavioral parameters include at least two of the following: number of behaviors, behavior frequency, minimum behavior interval, average load value, and load anomaly duration. The target selection value for each element in the behavioral data time series is determined, and multiple selection elements are determined from the behavioral data time series based on the target selection value. Based on the distribution position of the multiple selection elements in the behavioral data time series, the first element, each selection element, and the last element of the behavioral data time series are used as nodes to calculate the duration interval between adjacent nodes, and the minimum value among the duration intervals is determined as the base duration.

[0069] It's important to note that this implementation first clusters the behavioral analysis data using a preset time granularity, forming a behavioral data time series in chronological order of occurrence. Essentially, it organizes the originally continuous, discrete, and mixed behavioral analysis data into a sequence structure with a unified time scale. After this processing, each element corresponds to a specific time segment, facilitating the observation of changes in multi-dimensional behavioral parameters such as the number of behaviors, behavior frequency, minimum behavior interval, average load value, and duration of abnormal load over time at the same scale. In other words, subsequent identification of change characteristics is not performed directly on the scattered raw data, but rather on the already time-aligned behavioral data time series. This makes it easier to identify concentrated and relatively stable segments of behavioral change.

[0070] Based on this, by determining the target selection value for each element and filtering out multiple selection elements, and then combining the distribution position of these selection elements in the behavioral data time series, the base duration is extracted. The key is to find the key positions in the time series that better represent the nodes of change. Specifically, the first element, each selection element, and the last element of the behavioral data time series are taken as nodes, and the minimum value of the duration interval between adjacent nodes is taken as the base duration, reflecting the relatively compact change rhythm within the current segment of behavioral analysis data. In other words, the base duration is not a pre-specified fixed parameter, but a result extracted from the time distribution of the behavioral analysis data itself, thus better reflecting the actual change density exhibited by the current behavioral analysis data. Based on this, the subsequent window length is determined, which allows the selection of historical behavioral data to be closer to the actual characteristics of the current behavioral analysis data, avoiding window settings that are too coarse or too fine, which could affect subsequent comparisons.

[0071] In one possible implementation, determining the target selection value for each element in the behavioral data time series includes: initializing the current selection value of each element in the behavioral data time series to zero; for each element in the behavioral data time series, performing at least one of the following two operations on each dimension of the multidimensional behavioral parameters: comparing the element's value on the dimension with the statistical threshold corresponding to the dimension; if the value is not less than the statistical threshold, then accumulating a first preset score on the element's current selection value; comparing the element's value on the dimension with the values ​​of the element's preceding and following adjacent elements on the dimension; if the element's value on the dimension is not less than the value of the preceding and following adjacent elements, then accumulating a second preset score on the element's current selection value; after performing at least one of the above operations on all elements in the behavioral data time series across all dimensions of the multidimensional behavioral parameters, using the current selection value of each element as the target selection value.

[0072] It should be noted that in this implementation, the target selection value is used to measure the representativeness of each element in the behavioral data time series during the subsequent basic duration extraction process. Specifically, the current selection value of each element is first initialized to zero, and then scores are accumulated from both absolute values ​​and adjacent comparisons. Specifically, comparing the element's value on a certain dimension with the corresponding statistical threshold reflects whether the element has reached a noteworthy high level on that dimension; comparing the element with the values ​​of the preceding and following adjacent elements on the same dimension reflects whether the element constitutes a relatively prominent peak position within a local time range. With this setting, even if an element's absolute value is not always the highest, as long as it performs prominently during local changes, it can still be identified; conversely, if an element has a high value but does not exhibit significant changes in the time series, its target selection value will not be unduly amplified.

[0073] For example, for an element corresponding to a preset time granularity, if its behavior frequency has reached the statistical threshold corresponding to the behavior frequency, and its average load value is not less than the average load values ​​of the preceding and following adjacent elements, then the element will accumulate corresponding scores based on meeting different judgment conditions. The target selection value formed in this way can comprehensively reflect the importance of the element in multi-dimensional behavioral parameters. Finally, by using the current selection value of each element as the target selection value, and then filtering multiple selection elements accordingly, the nodes used to determine the base duration can be more concentrated in positions where behavioral changes are more obvious, thus making the extracted base duration more consistent with the true change characteristics of behavioral analysis data.

[0074] In one possible implementation, the window length is determined based on the base duration, and multiple sets of historical behavioral data prior to the occurrence of the behavioral analysis data are obtained according to the window length. This includes: determining the time span of the behavioral analysis data; calculating the ratio of the base duration to the time span, and determining the window multiple based on the ratio; determining the window length based on the window multiple and the base duration; determining the occurrence time of the behavioral analysis data, and continuously obtaining a preset number of windows of behavioral data along an earlier direction along the time axis, starting from the occurrence time, and treating the behavioral data of each window as a set of historical behavioral data to obtain multiple sets of historical behavioral data.

[0075] It's important to note that first determining the time span of the behavioral analysis data clarifies the temporal coverage of the data being analyzed. Then, the ratio of the base duration to the time span is calculated, and the window multiplier is determined based on this ratio. This demonstrates that the window length is not solely determined by the base duration but must be comprehensively considered in conjunction with the time span of the current behavioral analysis data. This ensures that the window length reflects both the pace of change and the current data coverage. Next, determining the window length based on the window multiplier and the base duration ensures that the final window length is constrained by both the base duration and the time span. Finally, the occurrence time of the behavioral analysis data is determined. Starting from this occurrence time, behavioral data for a predetermined number of windows is continuously acquired along the time axis, according to the window length. The behavioral data from each window is treated as a set of historical behavioral data, resulting in multiple sets of historical behavioral data.

[0076] In other words, instead of arbitrarily extracting behavioral data from history, we use the occurrence time of the current behavioral analysis data as a reference and the window length as a uniform scale to construct multiple historical intervals with the same window length continuously forward. This allows these historical behavioral data to form a more reasonable comparative relationship with the current behavioral analysis data in terms of time structure. Thus, by combining the base duration, time span, and window multiple to determine the window length, and continuously acquiring multiple sets of historical behavioral data accordingly, we can improve the relevance and comparability of the historical behavioral data selection.

[0077] In one possible implementation, determining the window multiple based on the ratio includes: determining whether the ratio is less than a preset ratio threshold; if the ratio is greater than or equal to the preset ratio threshold, then determining the window multiple as the preset multiple; if the ratio is less than the preset ratio threshold, then determining an adjustment coefficient based on the time span, the preset ratio threshold, and the base duration, and determining the window multiple based on the adjustment coefficient and the preset multiple.

[0078] It should be noted that the first step is to determine whether the ratio is less than a preset ratio threshold. If the ratio is greater than or equal to the preset ratio threshold, the window multiple is set to the preset multiple. This means that when the relationship between the time span of the current behavioral analysis data and the base duration is within the normal or expected range, the preset multiple can be directly used to determine the window multiple, thus maintaining the simplicity and stability of the window length determination process. However, if the ratio is less than the preset ratio threshold, an adjustment coefficient is determined based on the time span, the preset ratio threshold, and the base duration. The window multiple is then determined based on the adjustment coefficient and the preset multiple. This indicates that when the time span of the current behavioral analysis data shows a special relationship with the base duration, the window multiple is no longer mechanically set to the preset multiple, but rather an adjustment coefficient is introduced for correction, allowing the window multiple to change accordingly.

[0079] In this way, the determination of the window multiple retains the regularity brought by the preset multiple, and also has the flexibility to adapt to the current behavior analysis data when the ratio is too small, thereby avoiding the impact of the window length being too large or too small on the subsequent acquisition of historical behavior data and the judgment of fluctuation differences.

[0080] In one possible implementation, the decision to analyze and test the behavior analysis data is made based on the fluctuation differences between the behavior analysis data and multiple sets of historical behavior data across various dimensions of multidimensional behavior parameters. This includes:

[0081] Using a preset time granularity, clustering is performed on each group of historical behavior data from multiple sets of historical behavior data, and the historical behavior data is sorted in order of occurrence from oldest to most recent to obtain the historical time series corresponding to each group of historical behavior data; the values ​​of each element in the behavior data time series and each element in each historical time series are determined in each dimension of the multidimensional behavior parameters.

[0082] For each dimension of the multidimensional behavioral parameters, the following four steps are performed: Calculate the standard deviation of the values ​​of all elements in the behavioral data time series along the dimension, and use this as the first standard deviation; for each historical time series, calculate the standard deviation of the values ​​of all elements within the historical time series along the dimension, and use this as the second standard deviation for the corresponding historical time series; calculate the standard deviation of the values ​​of all elements in all historical time series along the dimension, and use this as the third standard deviation; calculate the standard deviation of the values ​​of all elements in all historical time series and all elements in the behavioral data time series along the dimension, and use this as the fourth standard deviation.

[0083] If, in any dimension of the multidimensional behavioral parameters, the first standard deviation is greater than the second standard deviation, or the fourth standard deviation is greater than the third standard deviation, then the behavioral analysis data is determined to be analyzed and tested; if, in all dimensions of the multidimensional behavioral parameters, the first standard deviation is less than or equal to the second standard deviation, and the fourth standard deviation is less than or equal to the third standard deviation, then the behavioral analysis data is determined not to be analyzed and tested.

[0084] It should be noted that in this possible implementation method, the specific judgment method for determining whether to analyze and detect the behavior analysis data based on the fluctuation differences of the behavior analysis data and multiple sets of historical behavior data in various dimensions of multidimensional behavior parameters has been further limited. Its core is to measure whether there are fluctuation differences between the current behavior analysis data and historical behavior data that are worth further analysis by comparing the relationship between multiple standard deviations.

[0085] Specifically, using a preset time granularity, each group of historical behavioral data is clustered and sorted according to the order of occurrence from oldest to most recent, resulting in a corresponding historical time series for each group. This ensures that the historical behavioral data, like the behavioral analysis data, is organized into time series with a unified time granularity and sequential structure, facilitating comparison within the same analytical framework. Subsequently, the values ​​of each element in the behavioral data time series and each element in each historical time series are determined across various dimensions of the multidimensional behavioral parameters, providing a direct computational basis for the current and historical parameter performance across each dimension. Furthermore, for each dimension of the multidimensional behavioral parameters, the standard deviation is calculated for the behavioral data time series itself, each historical time series itself, all historical time series as a whole, and the relationship between all historical time series and the behavioral data time series as a whole, yielding the first, second, third, and fourth standard deviations, respectively.

[0086] The significance of this setup is that the first standard deviation reflects the degree of fluctuation within a certain dimension of the current behavior analysis data; the second standard deviation reflects the degree of fluctuation within that dimension of each group of historical behavior data; the third standard deviation reflects the overall fluctuation background of all historical behavior data in that dimension; and the fourth standard deviation reflects the overall fluctuation performance of the current behavior analysis data and all historical behavior data combined in that dimension. If, in any dimension of the multidimensional behavior parameters, the first standard deviation is greater than the second standard deviation, or the fourth standard deviation is greater than the third standard deviation, then the behavior analysis data is determined to be analyzed and tested. If, in all dimensions of the multidimensional behavior parameters, the first standard deviation is less than or equal to the second standard deviation, and the fourth standard deviation is less than or equal to the third standard deviation, then the behavior analysis data is determined not to be analyzed and tested.

[0087] Therefore, this possible implementation establishes a detection triggering mechanism based on the differences between current internal fluctuations and historical internal fluctuations, and between the overall fluctuations after the current addition and the pure historical overall fluctuations. This ensures that the initiation of analysis and detection is based on a comparison of statistical fluctuation differences. Overall, by comparing the first, second, third, and fourth standard deviations, abnormal fluctuations in current behavioral analysis data relative to historical behavioral data can be identified more accurately, thereby improving the accuracy of analysis and detection triggering judgments.

[0088] In one possible implementation, when the multidimensional behavioral parameters include the duration of load anomalies, the multidimensional behavioral parameters for determining the behavioral analysis data include:

[0089] Obtain the device operation data of the target device contained in the behavioral analysis data, and determine the number of cores of the target device;

[0090] Based on the equipment operation data, for each moment within a preset time granularity, the average load value of the moment is calculated using multiple preset statistical windows to obtain the average load value of each moment under each preset statistical window. The multiple preset statistical windows include a first statistical window and at least two second statistical windows with a length greater than the first statistical window.

[0091] The moment when the average load value under the first statistical window is greater than or equal to the number of cores is defined as an abnormal moment;

[0092] For each abnormal moment, starting from the moment before the abnormal moment, check each moment sequentially in the direction of earlier time, and determine whether the average load value of the current checked moment under the first statistical window is greater than or equal to the average load value of the current checked moment under the second statistical window; if so, continue to check the earlier moment; otherwise, determine the moment after the current checked moment as the starting moment.

[0093] Starting from the moment after the abnormal moment, check each moment in turn in a later direction, and determine whether the average load value of the current check moment under the first statistical window is greater than or equal to the average load value of the current check moment under the second statistical window. If so, continue to check the next later moment; if not, determine the moment before the current check moment as the termination moment.

[0094] The period from the start time to the end time is defined as the abnormal interval of the abnormal time.

[0095] For overlapping abnormal intervals, merge them, calculate the duration of each merged abnormal interval, and sum the durations to obtain the total duration. The total duration is then determined as the load abnormal duration.

[0096] It's important to note that when the multidimensional behavioral parameters include the duration of load anomalies, this parameter doesn't simply count the number of discrete moments when the average load value exceeds a certain threshold. Instead, it combines the target device's operating data, the number of cores in the target device, and the relationship between average load values ​​under multiple preset statistical windows to identify a continuous abnormal load process. First, determining the number of cores in the target device provides a benchmark for judging the average load value in relation to the device's processing capacity. Then, calculating the average load value under the first statistical window and multiple second statistical windows at each moment within a preset time granularity allows for simultaneous observation of load performance over both shorter and longer time scales. This process not only identifies whether a momentary load spike exists but also further determines whether that spike has evolved into a persistent load anomaly.

[0097] Specifically, identifying the moment when the average load value under the first statistical window is greater than or equal to the number of cores as an abnormal moment is merely to find the starting point of a potential problem. Then, checking whether the average load value under the first statistical window at adjacent moments is still greater than or equal to the average load value under the corresponding moment in the second statistical window determines whether the anomaly persists over time. For example, if the average load value under the first statistical window reaches the number of cores at a certain moment, but the average load values ​​at adjacent moments are significantly higher or more stable over a longer statistical window, then that moment is more likely just a localized fluctuation. Conversely, if the average load value under the first statistical window remains consistently above the average load value under the second statistical window for a period of time, it more strongly suggests a persistently high load during that period. Finally, by determining the start and end times to form an abnormal interval, merging overlapping abnormal intervals, and accumulating the duration of each abnormal interval to obtain the load anomaly duration, this parameter more accurately reflects the duration of abnormal load experienced by the target device within the preset time granularity. The abnormal load duration obtained in this way can not only distinguish between instantaneous spikes and continuous anomalies, but is also more suitable as an effective parameter in subsequent behavioral analysis.

[0098] This section provides an overview of the data behavior analysis and detection method shown in the embodiments of this application from the perspective of specific application scenarios. For details, please refer to... Figure 2 The method consists of the following steps:

[0099] Step 1: Obtain behavioral data for analysis. For ease of description, the behavioral data obtained in Step 1 will be named "Behavioral Analysis Data." This behavioral data is comprehensive, including user behavior data and device operational data. User behavior data includes data for each user's every action (e.g., action time, action object, action content, etc.). Each accessing IP address can be considered a user, or each accessing account (e.g., username-password pair) can be considered a user. Device operational data includes device operating parameters such as traffic volume and CPU utilization.

[0100] It should be noted that the device itself records various data during its operation, such as access logs, network logs, and attack logs. This step simply reads the behavioral data from these data recording locations. The specific type of data to be retrieved can be pre-configured by relevant personnel.

[0101] Additionally, if this plan is set to execute periodically, then in step 1, you can retrieve the behavior data from the last execution to the current time, or you can pre-set a duration (such as three months) to retrieve the behavior data within that duration before the current time. If this plan is triggered by an execution command, then you can pre-set a duration (such as three months) to retrieve the behavior data within that duration before the current time.

[0102] Step 2: Determine the preprocessing behavioral data based on the behavioral analysis data.

[0103] 2.1: Cluster the behavioral analysis data on a daily basis to obtain daily behavioral analysis data, and sort the daily behavioral analysis data from oldest to newest date to obtain the daily sequence of behavioral analysis data (for ease of description, the sequence here is named the overall daily sequence).

[0104] 2.2: Determine the behavioral parameters of each element in the overall daily series.

[0105] Behavioral parameters include the number of actions, the frequency of actions, the minimum interval between actions, the average load value, and the duration of load anomalies.

[0106] Taking any element d as an example, if element d is the behavioral analysis data for day d, then:

[0107] 2.2.1 Number of behaviors: The number of behaviors is the total number of behaviors on day d.

[0108] 2.2.2 Behavior frequency: Behavior frequency is the number of behaviors / (24 * 60 points).

[0109] 2.2.3 Minimum Behavior Interval: The minimum behavior interval is the minimum time difference between two consecutive behaviors of all objects that have generated data on day d.

[0110] 2.2.4 Average load value and duration of load anomalies.

[0111] Here, the load refers to the system load of the device, which reflects the overall busyness of the device. It is determined by a combination of CPU, memory, I / O, etc. In the actual implementation, the scheme will be determined based on the existing system load, and the average load value of day d and the duration of load anomalies will be determined based on the device operation data of day d.

[0112] The process for determining the duration of abnormal load is as follows: First, determine the number of cores in the equipment, e.g., k. Second, based on the equipment operation data for day d, determine the load per minute, per 5 minutes, and per 15 minutes on day d. Third, define the moment when the load for 1 minute is not less than k as an abnormal moment. Fourth, for any abnormal moment, calculate the load for each minute backwards from that moment. If the load is not less than the corresponding 5-minute load / 15-minute load, continue processing the previous minute. If it is less, define the next moment after the current processing moment as the start moment. Fifth, calculate the load for each minute forwards from that moment. If the load is not less than the corresponding 5-minute load / 15-minute load, continue processing the next minute. If it is less, define the moment before the current processing moment as the end moment. Sixth, define the abnormal interval from the start moment to the end moment as the abnormal interval for that abnormal moment. Seventh, determine if there is any overlap between the abnormal intervals of each abnormal time. If there is overlap, merge the abnormal intervals. Eighth, define the duration (in minutes) covered by the merged abnormal interval as the duration of the abnormal load.

[0113] 2.3: Determine the selection values ​​of each element in the overall daily series based on behavioral parameters.

[0114] 2.3.1 Determine the mean frequency of each element in the overall daily series. and standard deviation Determine the mean frequency of behavior of each element in the overall daily series. and standard deviation Determine the mean of the minimum behavioral intervals for each element in the overall daily series. and standard deviation Determine the mean of the average load values ​​of each element in the overall daily series. and standard deviation Determine the mean duration of load anomalies for each element in the overall daily series. and standard deviation .

[0115] 2.3.2 Initialize the selection values ​​of all elements in the overall daily series to 0, such as... .

[0116] 2.3.3 For any element d in the overall daily series, it is the behavioral analysis data for day d.

[0117] If the number of actions of element d is not less than ,but If the number of actions of element d is not less than the number of actions of element d-1 and not less than the number of actions of element d+1, then If element d has no element d-1 (e.g., element d is the first element), then the number of actions of element d is considered to be no less than the number of actions of element d-1. If element d has no element d+1 (e.g., element d is the last element), then the number of actions of element d is considered to be no less than the number of actions of element d+1. If the frequency of action of element d is no less than... ,but If the frequency of element d is not less than the frequency of element d-1 and not less than the frequency of element d+1, then If element d has no element d-1, then the frequency of element d's behavior is considered to be no less than the frequency of element d-1's behavior. If element d has no element d+1, then the frequency of element d's behavior is considered to be no less than the frequency of element d+1's behavior. If the minimum interval of element d's behavior is no less than... ,but .

[0118] If the minimum interval of element d is not less than the minimum interval of element d-1 and not less than the minimum interval of element d+1, then If element d has no element d-1, then the minimum interval of element d's behavior is considered to be no less than the minimum interval of element d-1's behavior. If element d has no element d+1, then the minimum interval of element d's behavior is considered to be no less than the minimum interval of element d+1's behavior. If the average load value of element d is no less than... ,but If the average load value of element d is not less than the average load value of element d-1 and not less than the average load value of element d+1, then If element d has no element d-1, then the average load value of element d is considered to be no less than the average load value of element d-1. If element d has no element d+1, then the average load value of element d is considered to be no less than the average load value of element d+1. If the abnormal load duration of element d is no less than... ,but If the load anomaly duration of element d is not less than the load anomaly duration of element d-1 and not less than the load anomaly duration of element d+1, then If element d has no element d-1, then the abnormal load duration of element d is considered to be no less than the abnormal load duration of element d-1. If element d has no element d+1, then the abnormal load duration of element d is considered to be no less than the abnormal load duration of element d+1.

[0119] 2.4: Elements whose selection value is not less than the selection value of the previous element but greater than the selection value of the next element are selected as selected elements.

[0120] 2.5: The minimum value of the duration between the first selected element and the first selected element of the overall daily sequence (including the day of the first element and the day of the selected element), the duration between adjacent selected elements (excluding the day of the first selected element but including the day of the second selected element), and the duration between the last selected element and the last element of the overall daily sequence (including the day of the last element but excluding the day of the selected element) is determined as the base duration.

[0121] For example, if the overall daily series is {element 1, element 2, element 3, element 4, element 5, element 6, element 7}, and elements 2 and 5 are selected, then the minimum value (i.e., 2 days) among the durations between elements 1 and 2 (i.e., 2 days), between elements 2 and 5 (i.e., 3 days), and between elements 5 and 7 (i.e., 2 days) is determined as the base duration. The base duration reflects the minimum duration of a unit of change in the behavioral analysis data.

[0122] 2.6: with The base duration is the window length, starting from the earliest time in the behavioral analysis data (excluding the earliest time), and retrieving data backwards. The behavior data of each window is used as a set of preprocessed behavior data to obtain... Group preprocessing behavior data.

[0123] in, This is primarily used to ensure that each set of preprocessed behavioral data includes, as far as possible, a complete fluctuation cycle. For certain abnormal behaviors, there may be a period of normal behavior preceding them. It is possible that only abnormal behaviors are included in the preprocessing behaviors, while the normal behaviors preceding them are not included in this group of preprocessing behaviors. This may cause errors when processing this group of preprocessing behaviors due to inaccurate behavioral data.

[0124] Related to the length of the base duration, a longer base duration indicates a longer fluctuation cycle (e.g., the base duration / time span of behavioral analysis data is not less than 0.2). This means the relevant data can be largely covered in the preceding and following cycles. A shorter base duration indicates a shorter fluctuation cycle (e.g., the base duration / time span of behavioral analysis data is less than 0.2). Therefore, the data may not be fully covered in the preceding and following cycles. .in, This is the floor function.

[0125] These are pre-set values ​​to ensure the sufficiency of preprocessed data. For example... wait.

[0126] Step 3: Determine whether to analyze and test the behavior analysis data based on the preprocessed behavior data of each group.

[0127] 3.1: Cluster the preprocessed behavior data of each group on a daily basis to obtain the daily preprocessed behavior data of each group. Sort the daily preprocessed behavior data of each group from the oldest to the newest date to obtain the daily sequence of the preprocessed behavior data of each group (for ease of description, the daily sequence of any group i is named the daily sequence of group i). Thus, each group has a daily sequence.

[0128] 3.2: Determine the behavioral parameters of each group of daily series. It should be noted that the implementation process of this step is the same as that of "2.2: Determine the behavioral parameters of each element in the overall daily series," and will not be repeated here.

[0129] 3.3: Determine the standard deviation of the frequency of each element in each group of daily series. Standard deviation of the number of occurrences of each element in all daily sequences The standard deviation of the frequency of each element in all group daily series and the overall daily series Determine the standard deviation of the behavioral frequency of each element in each group of daily series. The standard deviation of the behavioral frequency of each element in all daily series The standard deviation of the behavioral frequencies of each element in all group daily series and the overall daily series Determine the standard deviation of the minimum behavioral interval for each element in each group of daily series. The standard deviation of the minimum interval of behavior of each element in all group daily series The standard deviation of the minimum interval of behavior of each element in all group daily series and the overall daily series. Determine the standard deviation of the average load values ​​of each element in each group of daily series. The standard deviation of the average load values ​​of each element in all daily series. The standard deviation of the average load values ​​of each element in all group daily series and the overall daily series Determine the standard deviation of the load anomaly duration for each element in each daily series. Standard deviation of the duration of load anomalies for each element in all daily series Standard deviation of the duration of load anomalies for each element in all group daily series and the overall daily series .

[0130] 3.4: If the standard deviation of the frequency of each element in the overall daily series... This indicates that the fluctuation in the frequency of behaviors in the behavioral analysis data is greater than its historical levels, suggesting that the behavioral analysis data may have changed. Therefore, further analysis and testing of the behavioral analysis data are necessary. This indicates that adding preprocessed behavioral data to the behavioral analysis data caused greater fluctuations in the number of behaviors. This suggests that the behavioral analysis data has changed significantly compared to its historical data, therefore, it is necessary to analyze and detect the behavioral analysis data.

[0131] If the standard deviation of the behavioral frequency of each element in the overall daily series This indicates that the frequency fluctuations in the behavioral analysis data are greater than historical levels, suggesting a possible change in the behavioral analysis data. Therefore, further analysis and testing of the behavioral analysis data are necessary. This indicates that adding preprocessed behavioral data to the behavioral analysis data caused greater fluctuations in behavioral frequency, suggesting that the behavioral analysis data has changed significantly compared to its historical data. Therefore, it is necessary to analyze and detect the behavioral analysis data.

[0132] If the standard deviation of the minimum interval of the behavior of each element in the overall daily series This indicates that the fluctuation of the minimum interval of behavior in the behavioral analysis data is larger than its historical value, suggesting that the behavioral analysis data may have changed. Therefore, further analysis and detection of the behavioral analysis data are necessary. This indicates that adding preprocessed behavioral data to the behavioral analysis data increases the fluctuation of the minimum behavioral interval, suggesting that the behavioral analysis data has changed significantly compared to its historical data. Therefore, it is necessary to analyze and detect the behavioral analysis data.

[0133] If the standard deviation of the average load value of each element in the overall daily series This indicates that the fluctuation in the average load value in the behavioral analysis data is larger than its historical value, suggesting that the behavioral analysis data may have changed. Therefore, further analysis and testing of the behavioral analysis data are necessary. This indicates that adding preprocessed behavioral data to the behavioral analysis data caused greater fluctuations in the average load value. This suggests that the behavioral analysis data has changed significantly compared to its historical data, therefore, it is necessary to analyze and detect the behavioral analysis data.

[0134] If the standard deviation of the load anomaly duration of each element in the overall daily series This indicates that the fluctuation in the duration of abnormal load in the behavioral analysis data is larger than its historical values, suggesting that the behavioral analysis data may have changed. Therefore, further analysis and detection of the behavioral analysis data are necessary. This indicates that adding preprocessed behavioral data to the behavioral analysis data caused greater fluctuations in the duration of abnormal loads. This suggests that the behavioral analysis data has changed significantly compared to its historical data, therefore, it is necessary to analyze and detect the behavioral analysis data.

[0135] like and and and and and and and and and Furthermore, this indicates that the behavioral analysis data is quite similar to historical data, with little change, so it is not necessary to analyze and monitor it for the time being, and the monitoring can be carried out in the next cycle.

[0136] Step 4: If it is determined that the behavior analysis data will be analyzed and detected, then the behavior analysis data will be detected using a pre-trained data behavior analysis monitoring model to obtain the detection results. The data behavior analysis monitoring model is a classification model (such as a decision tree model), which outputs a normal or abnormal detection result.

[0137] To train the data behavior analysis and monitoring model, a sample database can be maintained in real time. For example, behavioral data (including user behavior data and device operational data) can be continuously collected and acquired from various channels and data sources. This can be achieved through real-time capture of behavioral data via traffic mirroring and data acquisition tools deployed on key network nodes, and by real-time push of behavioral data generated by systems, applications, and devices through log collection agents on devices. After cleaning and integrating the acquired behavioral data, a sample database is formed.

[0138] During training, because the sample database is continuously collected and updated, the data behavior analysis and monitoring model can be periodically trained using the latest sample data. This ensures the continuous learning and evolution of the model, guaranteeing it can consistently produce accurate detection results. During training, the sample data provides the model with basic behavioral characteristics, allowing it to continuously learn the latest abnormal behavioral features, thus possessing the ability for autonomous learning and continuous evolution.

[0139] In step 4, the behavior analysis data can be input into the data behavior analysis monitoring model, which will extract features from the behavior analysis data and detect the degree of anomaly based on the extracted features, thereby obtaining the detection results.

[0140] In summary, this application provides a data behavior analysis and detection method based on dynamic cycles. The basic change cycle is determined by analyzing the changes in the number of behaviors, frequency, minimum interval, average load value, and duration of abnormal load in the behavior data to be detected. Multiple historical behavior data are acquired through this change cycle. When the behavior data to be detected is similar to historical behavior data, analysis and monitoring are not performed. Analysis and monitoring are only performed when the behavior data to be detected changes from historical behavior data. This approach reduces waste of monitoring resources while ensuring detection effectiveness. Furthermore, during the analysis and monitoring of the behavior data to be detected, a pre-trained data behavior analysis and monitoring model is used to detect the behavior data and obtain detection results. Because the data behavior analysis and monitoring model has the ability to continuously learn and evolve, it ensures the comprehensiveness of the detection and the accuracy of the results. This avoids the problem of inaccurate detection results caused by poorly set anomaly features in existing solutions.

[0141] Figure 3 This application illustrates a data behavior analysis and detection device according to an embodiment of the present application, such as... Figure 3 As shown, the device 30 includes:

[0142] The acquisition module 301 is used to acquire behavior analysis data, determine the multi-dimensional behavior parameters of the behavior analysis data, and determine the base duration based on the changing characteristics of the multi-dimensional behavior parameters.

[0143] The execution module 302 is used to determine the window length based on the base duration and to obtain multiple sets of historical behavioral data before the occurrence of behavioral analysis data according to the window length;

[0144] Based on the fluctuation differences between behavioral analysis data and multiple sets of historical behavioral data across various dimensions of multidimensional behavioral parameters, determine whether to analyze and test the behavioral analysis data.

[0145] Given that the behavior analysis data will be analyzed and detected, the behavior analysis data is input into a pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model.

[0146] In one possible implementation, the acquisition module 301 is further configured to cluster the behavior analysis data in units of a preset time granularity, and sort the behavior analysis data in order of occurrence from oldest to newest to obtain a behavior data time series. Each element in the behavior data time series is behavior analysis data within the preset time granularity. The multidimensional behavior parameters include at least two of the following: number of behaviors, behavior frequency, minimum behavior interval, average load value, and load anomaly duration.

[0147] Determine the target selection value for each element in the behavioral data time series, and based on the target selection value, determine multiple selection elements from the behavioral data time series;

[0148] Based on the distribution of multiple selected elements in the behavioral data time series, the first element of the behavioral data time series, each selected element, and the last element of the behavioral data time series are used as nodes. The duration interval between each adjacent node is calculated, and the minimum value among the duration intervals is determined as the base duration.

[0149] In one possible implementation, the acquisition module 301 is also used to initialize the current selection value of each element in the behavioral data time series to zero;

[0150] For each element in the behavioral data time series, perform at least one of the following two actions for each dimension of the multidimensional behavioral parameters:

[0151] The value of an element in a dimension is compared with the statistical threshold corresponding to that dimension. If the value is not less than the statistical threshold, the first preset score is added to the current selected value of the element.

[0152] The value of an element in a dimension is compared with the values ​​of the element's preceding and following adjacent elements in the dimension. If the value of an element in a dimension is not less than the value of the preceding adjacent element and not less than the value of the following adjacent element, then the second preset score is added to the current selected value of the element.

[0153] After performing at least one of the above operations on all elements of the behavioral data time series across all dimensions of the multidimensional behavioral parameters, the current selection value of each element is taken as the target selection value.

[0154] In one possible implementation, execution module 302 is also used to determine the time span of the behavioral analysis data;

[0155] Calculate the ratio of the base duration to the time span, and determine the window multiple based on the ratio;

[0156] The window length is determined based on the window multiplier and the base duration.

[0157] Determine the occurrence time of the behavior analysis data. Starting from the occurrence time, continuously acquire the behavior data of a preset number of windows along the time axis in an earlier direction according to the window length. Treat the behavior data of each window as a set of historical behavior data to obtain multiple sets of historical behavior data.

[0158] In one possible implementation, the execution module 302 is further configured to determine whether the ratio is less than a preset ratio threshold.

[0159] If the ratio is greater than or equal to the preset ratio threshold, the window multiple will be set to the preset multiple.

[0160] If the ratio is less than the preset ratio threshold, the adjustment coefficient is determined based on the time span, the preset ratio threshold, and the basic duration, and the window multiple is determined based on the adjustment coefficient and the preset multiple.

[0161] In one possible implementation, the execution module 302 is further configured to perform clustering processing on each group of historical behavior data in multiple groups of historical behavior data in a preset time granularity, and sort the historical behavior data in order of occurrence from farthest to most recent, so as to obtain the historical time series corresponding to each group of historical behavior data.

[0162] Determine the value of each element in the behavioral data time series and the value of each element in each historical time series in each dimension of the multidimensional behavioral parameter;

[0163] For each dimension of the multidimensional behavioral parameters, the following four steps are performed: Calculate the standard deviation of the values ​​of all elements in the behavioral data time series along the dimension, and use this as the first standard deviation; for each historical time series, calculate the standard deviation of the values ​​of all elements within the historical time series along the dimension, and use this as the second standard deviation for the corresponding historical time series; calculate the standard deviation of the values ​​of all elements in all historical time series along the dimension, and use this as the third standard deviation; calculate the standard deviation of the values ​​of all elements in all historical time series and all elements in the behavioral data time series along the dimension, and use this as the fourth standard deviation.

[0164] If, in any dimension of the multidimensional behavioral parameters, the first standard deviation is greater than the second standard deviation, or the fourth standard deviation is greater than the third standard deviation, then the behavioral analysis data is determined to be analyzed and tested.

[0165] If the first standard deviation is less than or equal to the second standard deviation and the fourth standard deviation is less than or equal to the third standard deviation across all dimensions of the multidimensional behavioral parameters, then it is determined that the behavioral analysis data will not be analyzed or tested.

[0166] In one possible implementation, when the multidimensional behavioral parameters include the duration of load anomalies, the acquisition module 302 is also used to acquire the device operation data of the target device contained in the behavioral analysis data and determine the number of cores of the target device.

[0167] Based on the equipment operation data, for each moment within a preset time granularity, the average load value of the moment is calculated using multiple preset statistical windows to obtain the average load value of each moment under each preset statistical window. The multiple preset statistical windows include a first statistical window and at least two second statistical windows with a length greater than the first statistical window.

[0168] The moment when the average load value under the first statistical window is greater than or equal to the number of cores is defined as an abnormal moment;

[0169] For each abnormal moment, starting from the moment before the abnormal moment, check each moment sequentially in the direction of earlier time, and determine whether the average load value of the current checked moment under the first statistical window is greater than or equal to the average load value of the current checked moment under the second statistical window; if so, continue to check the earlier moment; otherwise, determine the moment after the current checked moment as the starting moment.

[0170] Starting from the moment after the abnormal moment, check each moment in turn in a later direction, and determine whether the average load value of the current check moment under the first statistical window is greater than or equal to the average load value of the current check moment under the second statistical window. If so, continue to check the next later moment; if not, determine the moment before the current check moment as the termination moment.

[0171] The period from the start time to the end time is defined as the abnormal interval of the abnormal time.

[0172] For overlapping abnormal intervals, merge them, calculate the duration of each merged abnormal interval, and sum the durations to obtain the total duration. The total duration is then determined as the load abnormal duration.

[0173] In this embodiment, behavioral analysis data is first acquired, and multidimensional behavioral parameters of the data are determined. Then, a base duration is determined based on the changing characteristics of these parameters. This ensures that subsequent analyses do not use a fixed, single time scale, but rather determine a suitable time benchmark based on the changing patterns of the current behavioral analysis data across multiple dimensions. This allows for a more realistic reflection of the actual fluctuations in the behavioral analysis data. Furthermore, a window length is determined based on the base duration, and multiple sets of historical behavioral data prior to the occurrence of the behavioral analysis data are acquired according to this window length. This ensures that the selected historical behavioral data is consistent with the current behavioral analysis data in terms of time scale, avoiding weakened comparison effects due to an excessively large or small historical reference range. This allows subsequent comparisons to be based on a more comparable historical context. Furthermore, based on the fluctuation differences of behavioral analysis data and multiple sets of historical behavioral data across various dimensions of multidimensional behavioral parameters, it is determined whether to analyze and detect the behavioral analysis data. Before model detection, a preliminary judgment can be made as to whether the current behavioral analysis data shows any noteworthy abnormal fluctuations relative to historical behavioral data, thereby avoiding direct analysis and detection of behavioral analysis data with insignificant fluctuation characteristics or that are basically consistent with historical states. When it is determined that behavioral analysis data should be analyzed and detected, the behavioral analysis data is then input into a pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model. This allows model resources to be concentrated on data that are more likely to contain anomalies, improving the correspondence between the model detection results and actual abnormal behaviors.

[0174] In summary, by combining multidimensional behavioral parameters to dynamically determine the base duration, constructing historical references based on the base duration, and screening for fluctuation differences before model invocation, the accuracy, relevance, and processing efficiency of data behavior analysis and detection can be improved, thereby ensuring data security.

[0175] This application provides a network device 40, such as... Figure 4 As shown, the network device 40 includes a processor 401, a memory 402, and a program stored in the memory 402 and executable on the processor 401. When the program is executed by the processor 401, it implements the steps of a data behavior analysis and detection method as shown in the above embodiment.

[0176] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of the data behavior analysis and detection method shown in the above embodiments, achieving the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0177] This application also provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement the steps of the data behavior analysis and detection method shown in the above embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0178] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0179] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0180] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A data behavior analysis and detection method, characterized in that, The method includes: Acquire behavioral analysis data, determine the multidimensional behavioral parameters of the behavioral analysis data, and determine the base duration based on the changing characteristics of the multidimensional behavioral parameters; The window length is determined based on the base duration, and multiple sets of historical behavioral data prior to the occurrence of the behavioral analysis data are obtained according to the window length. Based on the fluctuation differences between the behavior analysis data and the multiple sets of historical behavior data in each dimension of the multidimensional behavior parameters, it is determined whether to analyze and detect the behavior analysis data. If it is determined that the behavior analysis data will be analyzed and detected, the behavior analysis data is input into a pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model.

2. The method according to claim 1, characterized in that, Determine the multidimensional behavioral parameters of the behavioral analysis data, and determine the base duration based on the variation characteristics of the multidimensional behavioral parameters, including: The behavior analysis data is clustered using a preset time granularity and sorted in order of occurrence from oldest to newest to obtain a behavior data time series. Each element in the behavior data time series is behavior analysis data within the preset time granularity. The multidimensional behavior parameters include at least two of the following: number of behaviors, behavior frequency, minimum behavior interval, average load value, and load anomaly duration. Determine the target selection value for each element in the behavioral data time series, and determine multiple selection elements from the behavioral data time series based on the target selection value; Based on the distribution positions of the multiple selected elements in the behavioral data time series, the first element of the behavioral data time series, each selected element, and the last element of the behavioral data time series are used as nodes. The duration interval between each adjacent node is calculated, and the minimum value among the duration intervals is determined as the base duration.

3. The method according to claim 1, characterized in that, Determining the target selection value for each element in the behavioral data time series includes: The current selection value of each element in the behavioral data time series is initialized to zero; For each element in the time series of the behavioral data, at least one of the following two items is performed on each dimension of the multidimensional behavioral parameters: The value of the element in the dimension is compared with the statistical threshold corresponding to the dimension. If the value is not less than the statistical threshold, the first preset score is added to the current selected value of the element. The value of the element in the dimension is compared with the values ​​of the element's preceding and following adjacent elements in the dimension. If the value of the element in the dimension is not less than the value of the preceding adjacent element and not less than the value of the following adjacent element, then a second preset score is added to the current selected value of the element. After performing at least one of the above operations on all elements of the behavioral data time series across all dimensions of the multidimensional behavioral parameters, the current selection value of each element is taken as the target selection value.

4. The method according to claim 1, characterized in that, The window length is determined based on the base duration, and multiple sets of historical behavioral data prior to the occurrence of the behavioral analysis data are obtained according to the window length, including: Determine the time span of the behavioral analysis data; Calculate the ratio of the base duration to the time span, and determine the window multiple based on the ratio; The window length is determined based on the window multiplier and the base duration; Determine the occurrence time of the behavior analysis data, and starting from the occurrence time, continuously acquire the behavior data of a preset number of windows along an earlier direction along the time axis according to the window length. Take the behavior data of each window as a group of historical behavior data to obtain the multiple groups of historical behavior data.

5. The method according to claim 4, characterized in that, Determining the window multiple based on the ratio includes: Determine whether the ratio is less than a preset ratio threshold; If the ratio is greater than or equal to the preset ratio threshold, then the window multiple is determined to be the preset multiple; If the ratio is less than the preset ratio threshold, an adjustment coefficient is determined based on the time span, the preset ratio threshold, and the base duration, and the window multiple is determined based on the adjustment coefficient and the preset multiple.

6. The method according to claim 2, characterized in that, Based on the fluctuation differences between the behavioral analysis data and the multiple sets of historical behavioral data across each dimension of the multidimensional behavioral parameters, a determination is made as to whether to analyze and detect the behavioral analysis data, including: Using the preset time granularity as the unit, each group of historical behavior data in the multiple groups of historical behavior data is clustered, and the historical behavior data is sorted in order of occurrence from oldest to most recent, to obtain the historical time series corresponding to each group of historical behavior data. Determine the value of each element in the behavioral data time series and the value of each element in each of the historical time series in each dimension of the multidimensional behavioral parameter; For each dimension of the multidimensional behavioral parameters, the following four steps are performed: Calculate the standard deviation of the values ​​of all elements in the behavioral data time series along the specified dimension, and use this as the first standard deviation; for each historical time series, calculate the standard deviation of the values ​​of all elements within that historical time series along the specified dimension, and use this as the second standard deviation for that historical time series; calculate the standard deviation of the values ​​of all elements in all historical time series along the specified dimension, and use this as the third standard deviation; calculate the standard deviation of the values ​​of all elements in all historical time series and all elements in the behavioral data time series along the specified dimension, and use this as the fourth standard deviation. If, in any dimension of the multidimensional behavioral parameters, the first standard deviation is greater than the second standard deviation, or the fourth standard deviation is greater than the third standard deviation, then it is determined that the behavioral analysis data will be analyzed and detected. If the first standard deviation is less than or equal to the second standard deviation across all dimensions of the multidimensional behavioral parameters, and the fourth standard deviation is less than or equal to the third standard deviation, then it is determined that the behavioral analysis data will not be analyzed or detected.

7. The method according to claim 2, characterized in that, When the multidimensional behavioral parameters include the duration of the load anomaly, the multidimensional behavioral parameters for determining the behavioral analysis data include: Obtain the device operation data of the target device contained in the behavior analysis data, and determine the number of cores of the target device; Based on the device operation data, for each moment within the preset time granularity, the average load value of the moment is calculated using multiple preset statistical windows to obtain the average load value of each moment under each preset statistical window. The multiple preset statistical windows include a first statistical window and at least two second statistical windows with a length greater than the first statistical window. The moment when the average load value under the first statistical window is greater than or equal to the number of cores is determined as an abnormal moment; For each of the aforementioned abnormal moments, starting from the moment before the abnormal moment, each moment is checked sequentially in the direction of earlier times to determine whether the average load value of the current checked moment under the first statistical window is greater than or equal to the average load value of the current checked moment under the second statistical window; if so, the check continues to the earlier moment before; otherwise, the moment after the current checked moment is determined as the starting moment. Starting from the moment after the abnormal moment, each moment is checked sequentially in a later direction. It is determined whether the average load value of the current checked moment under the first statistical window is greater than or equal to the average load value of the current checked moment under the second statistical window. If so, the next moment is checked. If not, the moment before the current checked moment is determined as the termination moment. The period from the start time to the end time is defined as the abnormal interval of the abnormal time; The overlapping abnormal intervals are merged, the duration of each merged abnormal interval is calculated, and the durations are summed to obtain the total duration, which is then determined as the load abnormal duration.

8. A data behavior analysis and detection device, characterized in that, The device includes: The acquisition module is used to acquire behavioral analysis data, determine the multidimensional behavioral parameters of the behavioral analysis data, and determine the base duration based on the changing characteristics of the multidimensional behavioral parameters. The execution module is used to determine the window length based on the base duration, and to obtain multiple sets of historical behavior data before the occurrence of the behavior analysis data according to the window length; Based on the fluctuation differences between the behavior analysis data and the multiple sets of historical behavior data in each dimension of the multidimensional behavior parameters, it is determined whether to analyze and detect the behavior analysis data. If it is determined that the behavior analysis data will be analyzed and detected, the behavior analysis data is input into a pre-trained data behavior analysis and detection model to obtain the detection results output by the data behavior analysis and detection model.

9. A network device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of a data behavior analysis and detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of a data behavior analysis and detection method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, It includes computer instructions, which, when executed by a processor, implement the steps of a data behavior analysis and detection method as described in any one of claims 1 to 7.

Images