Log behavior analysis and security protection system and method for operators

Abstract

This invention discloses a log behavior analysis and security protection system and method for telecom operators, relating to the fields of computer data processing and information security technology. It extracts the access relationships of each operation type to sensitive data fields from CRM system operation logs, constructs a weighted information access fingerprint vector and spans it into an information access fingerprint space, calculates a semantic affinity matrix and performs semantic equivalence clustering, generates a semantic equivalence class mapping table and cross-type aggregation thresholds, calculates the geometric difference set to generate an escape crescent domain based on the semantic equivalence class mapping table and cross-type aggregation thresholds, verifies topological inclusion relationships, generates fragmentation camouflage markers and escape penetration depths, calculates trajectory geometric feature vectors, and combines the escape penetration depths to generate a comprehensive risk score to trigger alarms, achieving accurate hierarchical alarms for hidden fragmentation leakage behavior.

Description

Technical Field

[0001] This invention relates to the field of computer data processing and information security technology, specifically to a log behavior analysis and security protection system and method for telecom operators. Background Technology

[0002] Existing audit models for operator CRM systems primarily deploy security protection rules for one-time, high-frequency, batch operations such as "database table export" or "data download and external distribution." However, in actual operating environments, systems typically provide multiple functional entry points for operators to query user information, such as number lookup, customer name lookup, and work order history lookup. These entry points are recorded in the operation logs as completely different technical operation type codes. Existing auditing techniques generally adopt an analytical granularity of "single operation type dimension," that is, setting independent frequency alarm thresholds for each operation type code.

[0003] When data breach perpetrators employ a "fragmented information acquisition" strategy, they alternate and disperse operations across multiple semantically equivalent entry paths, deliberately controlling the frequency of operations on each independent path to below its respective threshold. Because existing audit models lack the ability to compute the semantic relationships between heterogeneous operation types, this type of covert camouflage can successfully evade single-dimensional frequency detection mechanisms, creating a serious blind spot. The root cause of this camouflage escape problem lies in the fact that the operation classification system of existing audit models only stays at the technical implementation path level, failing to delve into the semantic equivalence analysis at the business intent level. In CRM systems, the technical operation type encoding reflects the execution action, and there is a many-to-one mapping relationship between this and the operator's ultimate business intent to obtain sensitive information; that is, multiple different technical operations can often achieve the same semantically equivalent result. Due to the lack of a mechanism for identifying and aggregating this semantic equivalence relationship, the access volume of sensitive data for the same business intent is fragmented and dispersed across multiple isolated technical operation counters. This "semantic equivalence fragmentation transformation" causes the system to misjudge the accumulated real leakage risks as normal operational fluctuations of various different businesses, thus enabling covert data theft to successfully circumvent the existing security protection system.

[0004] To address the aforementioned shortcomings, a technical solution is provided. Summary of the Invention

[0005] To address the technical problems raised in the background section, this invention is proposed. This invention provides a log behavior analysis and security protection system and method for telecom operators.

[0006] This invention is achieved through the following technical solution:

[0007] A method for log behavior analysis and security protection for telecom operators, the method comprising:

[0008] Extract the access relationships of each operation type to sensitive data fields in the CRM system operation log, construct a weighted information access fingerprint vector and span it to form an information access fingerprint space, calculate the semantic affinity matrix and perform semantic equivalence clustering, and generate a semantic equivalence class mapping table and cross-type aggregation threshold;

[0009] Based on the semantic equivalence class mapping table and cross-type aggregation threshold, an independent threshold hypercube and an aggregation intent simplex are constructed in the operation frequency space. The geometric difference set is calculated to generate the escape crescent domain, the topological inclusion relationship is verified, and fragmentation camouflage markers and escape penetration depth are generated.

[0010] Extract the cumulative operation trajectory curve of the target operator carrying the fragmented camouflage mark and calculate the trajectory geometric feature vector. Construct a normal behavior trajectory cone and calculate the composite deviation of the trajectory geometric feature vector relative to the normal behavior trajectory cone. Combine the escape penetration depth to generate a comprehensive risk score and trigger an alarm.

[0011] Furthermore, the steps of constructing the weighted information access fingerprint vector and spanning the information access fingerprint space are as follows:

[0012] Extract the set of sensitive fields from the CRM system and assign sensitivity weight values ​​to generate a sensitivity weight vector; extract the set of operation types and trace the execution path to construct a binary raw access vector;

[0013] The binary original access vector is multiplied element-wise with the sensitivity weight vector to generate a weighted information access fingerprint vector, and the non-zero weighted information access fingerprint vector spans the information access fingerprint space.

[0014] Furthermore, the steps for generating the sensitivity weight vector are as follows:

[0015] Sensitive fields are divided into three basic levels according to legal compliance sensitivity categories: direct user identification fields, indirect user association fields, and business attribute fields. Within each basic level, secondary weight allocation is performed based on the information recovery capability of a single field, and the sensitivity weight value of each sensitive field is output to form the sensitivity weight vector.

[0016] Furthermore, the steps of calculating the semantic affinity matrix and performing semantic equivalence clustering are as follows:

[0017] In the information access fingerprint space, the cosine similarity of the weighted information access fingerprint vectors is calculated to generate a semantic affinity matrix;

[0018] Based on the semantic affinity matrix and the preset semantic equivalence determination threshold, a semantic affinity undirected graph is constructed, the average node degree is calculated and adaptive density control is performed, and the optimized semantic affinity undirected graph is output.

[0019] Furthermore, the steps for generating the semantic equivalence class mapping table and the cross-type aggregation threshold are as follows:

[0020] The optimized semantic affinity undirected graph is subjected to a connected component decomposition algorithm to generate a set of semantic equivalence classes. For each semantic equivalence class, its aggregation information access fingerprint vector is extracted and a basic aggregation threshold is determined by combining it with a preset risk level comparison table. The fragmentation reduction coefficient is calculated based on the number of members and the basic aggregation threshold is reduced. The semantic equivalence class mapping table and the corresponding cross-type aggregation threshold are then output.

[0021] Furthermore, the calculation steps for the fragmentation reduction factor are as follows:

[0022] The number of non-zero components in the aggregated information access fingerprint vector is counted and its ratio to the total number of sensitive fields is calculated to generate an information access width ratio. Based on the preset value range of the information access width ratio, the fragmentation reduction coefficient is mapped to a high reduction value, a medium reduction value, or a low reduction value.

[0023] Furthermore, the construction steps of the independent threshold hypercube are as follows:

[0024] Extracting contains The target semantic equivalence class of each operation type and its corresponding independent alarm threshold, in In the frequency space of operations, an independent threshold hypercube is constructed with the origin as the vertex and each independent alarm threshold as the side length.

[0025] Furthermore, the steps for generating fragmented camouflage markers and escape penetration depth are as follows:

[0026] In the In the frequency space of operations, the cross-type aggregation threshold is used as the intercept constraint to construct the aggregation intent simplex; the relationship between the cross-type aggregation threshold and the sum of all independent alarm thresholds is verified, and if there is an overflow space, it is confirmed that there is an escape space.

[0027] Furthermore, the steps of generating fragmented camouflage markers and escape penetration depth also include:

[0028] Calculate the set-theoretic difference between the independent threshold hypercube and the aggregation intention simplex to generate the escape crescent domain;

[0029] If the target operator If the frequency vector of operations satisfies the independent threshold constraints for each component and violates the cross-type aggregation threshold constraint, then it is determined that it falls into the escape crescent domain, the fragmented camouflage label is output, and the calculation is performed. The escape penetration depth is output by taking the signed vertical distance from the frequency vector of the operation to the inclined simplex section of the aggregation intention.

[0030] Furthermore, the steps for calculating the trajectory geometric feature vector are as follows:

[0031] The standard basis vectors of the operation events are successively accumulated according to the operation timestamp order to generate the piecewise linear cumulative operation trajectory curve;

[0032] Calculate the terminal direction vector of the cumulative operation trajectory curve and the terminal heading deflection angle of the diagonal direction, calculate the mean of the direction change angles of adjacent line segments to generate the average trajectory curvature, and combine and output the trajectory geometric feature vector.

[0033] Furthermore, the steps for generating a comprehensive risk score are as follows:

[0034] Extract the set of terminal direction vectors of historical normal operator groups, perform spherical clustering, obtain the main direction clusters, and combine them with preset safety expansion factors to construct normal behavior trajectory cones;

[0035] The minimum angular deviation of the terminal direction vector of the trajectory geometric feature vector to the normal behavior trajectory cone is calculated and normalized to obtain the composite deviation. The escape penetration depth and the composite deviation are weighted and summed to output a comprehensive risk score.

[0036] Furthermore, the steps for constructing the normal behavior trajectory cone are as follows:

[0037] Project the set of terminal direction vectors of the historical normal operator group onto the unit hypersphere, and use the spherical K-Means algorithm to perform iterative clustering, outputting the cluster center and the corresponding angular scatter radius;

[0038] Abnormal operation pattern clusters are removed, and multiple normal behavior trajectory sub-cones are constructed with the remaining cluster centers as axes and the product of the angular scattering radius and the preset safety expansion factor as the half-cone angle. The normal behavior trajectory cone is then output as a set.

[0039] A log behavior analysis and security protection system for telecom operators, including:

[0040] The semantic equivalence clustering module extracts the access relationships of each operation type to sensitive data fields in the CRM system operation log, constructs a weighted information access fingerprint vector and spans it into an information access fingerprint space, calculates the semantic affinity matrix and performs semantic equivalence clustering, and generates a semantic equivalence class mapping table and cross-type aggregation threshold.

[0041] The escape detection module constructs an independent threshold hypercube and an aggregated intent simplex in the operation frequency space based on the semantic equivalence class mapping table and cross-type aggregation threshold, calculates the geometric difference set to generate the escape crescent domain, verifies the topological inclusion relationship, and generates fragmented camouflage markers and escape penetration depth.

[0042] The analysis alarm module extracts the cumulative operation trajectory curve of the target operator carrying the fragmented camouflage mark and calculates the trajectory geometric feature vector. It constructs a normal behavior trajectory cone and calculates the composite deviation of the trajectory geometric feature vector relative to the normal behavior trajectory cone. Combined with the escape penetration depth, it generates a comprehensive risk score to trigger an alarm.

[0043] Compared with the prior art, the beneficial effects of the present invention are:

[0044] This invention constructs an information access fingerprint space and calculates semantic affinity to accurately cluster technically independent but business intent-equivalent operation types in CRM systems, and configures cross-type aggregation thresholds, fundamentally eliminating semantic silos caused by independent counting under a single operation type dimension. Based on this, in a multi-dimensional operation frequency space, this invention geometrizes the independent threshold determination logic of existing auditing systems as a hypercube and the aggregation security constraints as a simplex, accurately generating the escape crescent domain by calculating the set-theoretic difference between the two. This transforms the detection of fragmented, disguised leakage behavior from the traditional rule-matching paradigm to a geometric space analysis paradigm, giving the escape space, originally hidden under multiple entry point alternating operations, a deterministic mathematical boundary, enabling deterministic capture of fragmented operation combinations that satisfy independent threshold constraints but violate aggregation constraints.

[0045] To address the technical challenge of distinguishing between malicious fragmented leaks and occasional fluctuations in normal business operations when determining excessive operation frequency, this paper further transforms discrete operation log sequences into piecewise linear cumulative operation trajectory curves in a multi-dimensional space, and extracts two complementary geometric features: terminal heading deflection angle and average trajectory curvature. By performing spherical clustering on the terminal direction vectors of historical normal operator groups to construct normal behavior trajectory cones, the anomaly determination is transformed from absolute frequency threshold judgment to a composite deviation assessment relative to the direction distribution of the normal group. This time-series trajectory analysis mechanism can keenly capture the approximately isotropic random walk characteristics exhibited by fragmented attackers to maintain balanced counts at each entry point, effectively filtering out unidirectional frequency surges caused by normal business rotations or concentrated return visits. Finally, combined with escape penetration depth, a comprehensive risk score is generated, achieving accurate hierarchical alerts for hidden fragmented leak behaviors. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. The following drawings are not drawn to scale according to the actual size, but are intended to show the main idea of ​​the present invention.

[0047] Figure 1 A flowchart illustrating the methodology for log behavior analysis and security protection for telecom operators;

[0048] Figure 2 This is a system block diagram for a log behavior analysis and security protection system for telecom operators.

[0049] Figure 3 A schematic diagram of the construction of independent threshold hypercubes and aggregation-intended simplexes;

[0050] Figure 4 A schematic diagram of the geometric difference set and escape penetration depth in the escape crescent region;

[0051] Figure 5 This is a schematic diagram illustrating the cumulative operation trajectory curve and trajectory geometric feature extraction.

[0052] Figure 6 This is a schematic diagram for calculating the normal behavior trajectory cone and the composite deviation. Detailed Implementation

[0053] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are also within the scope of protection of the present invention.

[0054] Example 1

[0055] This embodiment provides a log behavior analysis and security protection method for operators. This method addresses the problem that operation types in CRM systems are independent at the technical coding level but semantically equivalent at the business intent level. It achieves accurate detection and graded alarms for fragmented disguised leakage behavior by constructing an information access fingerprint space, calculating the escape crescent domain, and extracting trajectory geometric features through three stages.

[0056] In the actual operation environment of a telecom operator's CRM system, the system typically provides multiple functional entry points for operators to query user information, such as number query, customer name query, and work order history query. These entry points are recorded in the CRM system's operation log as different operation type codes, such as NumberQuery, CustomerSearch, and WorkOrderView. Existing auditing systems set independent frequency alarm thresholds for each operation type code, triggering an alarm when the cumulative frequency of a certain operation type exceeds its corresponding threshold. However, these various operation types are actually equivalent at the business intent level; that is, they all ultimately achieve the goal of obtaining specific user number information, differing only in the entry path and page display method. Leakers exploit this characteristic by distributing queries with the same purpose through different semantically equivalent paths, ensuring that the operation frequency on each path is below its respective independent threshold, thereby evading detection by existing auditing systems. The method provided in this invention is specifically designed to address the problem of disguised escape of leakage behavior caused by the aforementioned semantically equivalent fragmentation transformation.

[0057] The overall process of the method of this invention consists of three main steps: S10, S20, and S30. Step S10 is the information access fingerprint space construction and semantic equivalence clustering stage. This involves sub-step S11 extracting a set of sensitive fields and constructing a weighted information access fingerprint vector; sub-step S12 calculating the semantic affinity matrix and performing adaptive density control to generate an optimized semantic affinity undirected graph; and sub-step S13 performing connected component decomposition and configuring cross-type aggregation thresholds, ultimately outputting a semantic equivalence class mapping table and cross-type aggregation thresholds. Step S20 is the geometric construction and fragmentation camouflage detection stage for the escape crescent domain. This involves sub-step S21 geometricizing the independent threshold judgment logic of the existing audit system into a hypercube in the multi-dimensional operation frequency space; sub-step S22 geometricizing the aggregation security constraints from a semantic equivalence perspective into a simplex and performing overflow space verification; and sub-step S23 calculating the set-theoretic difference between the hypercube and the simplex to obtain the escape crescent domain and performing topological attribution determination of the operation frequency vector, accurately characterizing and detecting the operation space of fragmented attackers. Step S30 is the trajectory behavior analysis and hierarchical alarm stage. Sub-step S31 transforms the discrete operation event sequence into a cumulative operation trajectory curve in multi-dimensional space; sub-step S32 extracts two complementary trajectory geometric features: the terminal heading deflection angle and the average trajectory curvature; and sub-step S33 constructs a normal behavior trajectory cone based on spherical clustering and fuses escape penetration depth and composite deviation to generate a comprehensive risk score that triggers hierarchical alarms. These three steps form a progressive detection chain: semantic space mapping – geometric blind spot detection – temporal behavior verification.

[0058] Step S10: Extract the access relationship of each operation type to sensitive data fields in the CRM system operation log, construct a weighted information access fingerprint vector and span it to form an information access fingerprint space, calculate the semantic affinity matrix and perform semantic equivalence clustering, and generate a semantic equivalence class mapping table and cross-type aggregation threshold.

[0059] The operation types in the CRM system, named based on technical implementation paths, are encoded and remapped to a vector space with access capabilities to sensitive data fields as the dimension. By calculating the semantic affinity between operation types in this vector space, combinations of operation types that are equivalent at the business intent level are identified, and an aggregation threshold is configured for each equivalent combination to constrain its total operation volume. The core technical problem addressed in step S10 is the semantic silo problem caused by the many-to-one mapping relationship between the operation classification system of the audit model and business intent. In CRM systems, when designing system functional modules, technical developers typically encode and name operation types based on the functional implementation path; for example, a number query function is encoded as NumberQuery, and a customer search function is encoded as CustomerSearch. This encoding method reflects the technical implementation method of the operation, not what information the operator ultimately obtains. Two operations with completely different technical encodings may ultimately allow the operator to see the same user's mobile phone number and package details, making them equivalent at the information acquisition result level. Step S10 re-represents the operation type from the dimension of information acquisition result by analyzing the set of sensitive fields that each operation can actually access, thereby establishing semantic equivalence relationships between operation types. The output of step S10 is a semantic equivalence class mapping table and the corresponding cross-type aggregation threshold. This output serves as the direct input data for step S20, providing a foundation for subsequent geometric space construction and escape crescent domain detection.

[0060] Step S11: Extract the set of sensitive fields of the CRM system and assign sensitivity weight values ​​to generate a sensitivity weight vector; extract the set of operation types and trace the execution path to construct a binary original access vector; multiply the binary original access vector element by element with the sensitivity weight vector to generate a weighted information access fingerprint vector, and span the information access fingerprint space by the non-zero weighted information access fingerprint vector.

[0061] The sensitivity weight vector is generated as follows: Sensitive fields are divided into three basic levels according to legal compliance sensitivity categories: direct user identification fields, indirect user association fields, and business attribute fields; within each basic level, secondary weight allocation is performed based on the single field information restoration capability, and the sensitivity weight values ​​of each sensitive field are output to form the sensitivity weight vector.

[0062] The implementation of step S11 is divided into three stages: extraction and weight allocation of the sensitive field set, extraction and execution path tracing of the operation type set, and generation of weighted information access fingerprint vector and construction of information access fingerprint space.

[0063] Phase 1: Extraction and Weighting of Sensitive Fields. Extracting the sensitive field set requires information from two data sources within the CRM system. The first data source is the CRM system's database table structure. By querying the database's data dictionary or metadata, all database tables storing user personal information and their field names and types are obtained. The second data source is the CRM system's front-end page field configuration. By parsing the page templates or interface definition files of each functional page of the CRM system, the list of data fields displayed to the operator on each page is obtained. Combining these two data sources, all data fields involving user privacy are extracted to construct the sensitive field set. In a typical carrier CRM system, the sensitive field set usually includes the following types of fields: user mobile phone number, user ID card number, user name, user mailing address, user current package code, user current package name, user account balance, user account status, service processing time, work order number, etc. Although all of these fields involve user information, from the perspective of data leakage risk, the sensitivity of different fields varies significantly. A user's mobile phone number and ID card number are highly sensitive fields that can directly and uniquely identify an individual user. Their leakage will directly lead to the complete exposure of the user's personal information. While fields such as package name and account status also involve user information, they cannot uniquely locate a specific individual user based on these fields alone, so the risk of leakage is relatively low.

[0064] Based on the above analysis, a sensitivity weight value is assigned to each sensitive field in the sensitive field set. The weight value allocation follows two dimensions: legal compliance sensitivity category and single-field information reconstruction capability. The legal compliance sensitivity category is based on relevant regulations on personal information protection and the regulations on the protection of personal information of telecommunications and internet users, classifying sensitive fields into three basic levels: direct user identification fields, indirect user association fields, and business attribute fields. Direct user identification fields include mobile phone numbers, ID card numbers, etc. The values ​​of these fields can directly and uniquely correspond to a specific individual user, and their sensitivity weight values ​​are set in a relatively high range. The weight value range for each level is determined as follows: security management personnel refer to the enterprise data security strategy and the classification standards for sensitive personal information and general personal information in GB / T35273 Personal Information Security Specification to set the upper and lower bounds of the weight range for each level. Direct identification information corresponds to the highest security protection level, association information corresponds to the medium protection level, and attribute information corresponds to the basic protection level. In this embodiment, the value range is 0.8 to 1.0. Indirect user association fields include customer name, communication address, and package code. These fields need to be combined with other fields to locate individual users, and their sensitivity weight values ​​are set in a medium range, ranging from 0.4 to 0.7 in this embodiment. Business attribute fields include package name, account status, and service processing time. These fields are generally not used to locate individual users, and their sensitivity weight values ​​are set in a low range, ranging from 0.1 to 0.3 in this embodiment.

[0065] Within the same basic level, a secondary weight allocation is performed based on the ability to reconstruct information from a single field. The ability to reconstruct information from a single field refers to whether the value of that field can uniquely locate a specific individual user. The theoretical basis for this secondary allocation is the concept of discriminability in the field of information retrieval—the higher the discriminability of a field, the greater its risk of being exploited in user identification reconstruction attacks, and therefore it should receive a higher weight value. If unique identification is possible, the upper limit of the weight range for that level is taken; if it requires combination with other fields to identify the user, the middle value of the weight range for that level is taken; if it cannot identify the user, the lower limit of the weight range for that level is taken. For example, at the direct user identification field level, a mobile phone number can directly and uniquely identify a user, so it receives a weight value of 1.0; an ID card number can also uniquely identify a user, so it receives a weight value of 1.0; while at the indirect user association field level, customer names may be duplicated, requiring combination with an address or mobile phone number for unique identification, so it receives a weight value of 0.55; a communication address usually cannot uniquely identify a user, so it receives a weight value of 0.4. The above weighting values ​​are determined based on the following: In data leakage risk assessment, the leakage of fields that directly identify individual users will directly lead to serious consequences such as targeted harassment, fraud, or competitor-targeted marketing. Therefore, the weighting value of such fields should be higher than that of fields that require combination to be utilized. The specific values ​​of the weighting values ​​can be adjusted by security managers according to the company's own data security strategy.

[0066] The sensitivity weight vector is formed by arranging the sensitivity weight values ​​of all sensitive fields into a vector according to their order in the set. If the sensitive field set contains... If there are n elements, then the sensitivity weight vector is: A dimensional vector, where the dimensional vector is... The component is the first The sensitivity weight value of each sensitive field. The physical meaning of the sensitivity weight vector is that it encodes the relative importance of each sensitive field in the data leakage risk assessment in a vectorized form, and provides a metric for subsequently mapping the access capability of operation types to the weighted fingerprint space.

[0067] Phase Two: Extraction and Execution Path Tracking of Operation Type Sets. All deduplicated operation type codes are extracted from the CRM system's operation log record set to construct an operation type set. The operation log record set consists of structured log data generated by the CRM system during operation. Each log record typically includes the following fields: operator identifier, operation timestamp, operation type code, operation object identifier, and operation result status. By performing deduplication on the operation type code fields, all operation type codes actually used in the CRM system can be obtained. In a typical carrier CRM system, the operation type set usually contains dozens to hundreds of different operation type codes, covering various business functions such as number lookup, customer search, work order viewing, package change, and payment operations. For each operation type in the operation type set, its complete operation execution path in the CRM system needs to be tracked. The execution path is tracked by obtaining the business logic processing flow corresponding to the operation type from the CRM system's function configuration document or interface definition file, recording all database query interfaces involved in the processing flow, and the display of the query results on the front-end page. The tracking scope includes not only the fields returned by the database query directly triggered by this operation type, but also sensitive fields displayed on other pages that can be indirectly reached through page jump links on the operation results page.

[0068] For example, for a number query operation with the operation type code NumberQuery, the execution path is as follows: the operator enters a mobile phone number on the query page and submits a query request. The system calls the number query interface to retrieve the user record corresponding to the number from the user information table. The results page displays fields such as user name, package name, and account status. A details link is also provided on the results page. Clicking the details link redirects to the user details page, which additionally displays the user's communication address and the last four digits of their ID card number. Therefore, the sensitive fields reached by the complete execution path of NumberQuery include: mobile phone number (exposed by the query input itself), user name, package name, account status, communication address, and the last four digits of the ID card number.

[0069] Based on the reach of sensitive fields obtained through tracking, build a system for each operation type. A binary raw access vector. Each component of this vector corresponds to a sensitive field in the sensitive field set. A component value of 1 indicates that the sensitive field can be directly displayed or indirectly obtained through page redirection during the execution of this operation type, while a component value of 0 indicates that the sensitive field cannot be obtained during the execution of this operation type. The physical meaning of the binary raw access vector is that it describes the access capability boundary of an operation type to each field in the sensitive field set in a binary encoding manner, characterizing the functional coverage of this operation type at the information acquisition level.

[0070] In constructing the binary original access vector, attention needs to be paid to the handling of indirect access paths. An indirect access path refers to an operator's journey from the initial query result, through page jump links or related query functions on the operation result page, to the page displaying a sensitive field after several page jumps. In this embodiment, the tracking depth of the indirect access path is set to no more than two page jumps from the initial query result page. The tracking depth is determined by statistically analyzing the distribution of the length of operation chains continuously executed by the same operator within the same session (session interval not exceeding a preset session timeout, 5 minutes in this embodiment) in the CRM system's historical operation logs. The 95th percentile of this distribution is taken as a candidate value for the tracking depth, and the smaller value is selected between this distribution and the page hierarchy depth of the CRM system. The reason for limiting the tracking depth to within two jumps is that in actual CRM system operations, indirect access exceeding two jumps usually generates independent log records in the operation logs, recorded as different operation types, and therefore does not need to be repeatedly counted in the access vector of the current operation type.

[0071] If the binary raw access vector for a certain operation type is detected to be an all-zero vector, meaning that the operation type does not involve the display or retrieval of any sensitive data fields in its complete execution path, then the operation type is marked as a non-sensitive operation type and excluded from subsequent semantic affinity calculations. Non-sensitive operation types in operator CRM systems typically include pure system management operations such as system login, password modification, and interface configuration. These operations do not involve viewing or retrieving user information, and therefore have no possibility of being used for fragmented data leakage. Excluding them avoids introducing irrelevant terms in subsequent semantic affinity matrix calculations, reducing computational complexity and improving clustering accuracy.

[0072] The third stage: Generation of weighted information access fingerprint vectors and construction of the information access fingerprint space. The binary original access vector for each operation type is element-wise multiplied with the sensitivity weight vector to obtain the weighted information access fingerprint vector for that operation type. The specific element-wise multiplication operation is as follows: the weighted information access fingerprint vector... The i-th component is equal to the i-th component of the binary original access vector. The component multiplied by the sensitivity weight vector is the first... The component. If a certain operation type cannot access the first component. The sensitive field, then its binary original access vector's first sensitive field... If a component is 0, multiplying it by its weight value will still result in 0; if a certain operation type can access the first component... The sensitive field, then its binary original access vector's first sensitive field... Each component is 1, and multiplying it by the weight value equals the sensitivity weight value of that sensitive field. The technical basis for introducing sensitivity weights for weighting is that when calculating the semantic affinity between two operation types, it is necessary to distinguish the degree of contribution of different sensitive fields to the semantic equivalence relation. If both operation types can allow the operator to see the user's mobile phone number, their correlation in terms of number leakage risk should be higher than their correlation when both can allow the operator to see the package name, because the leakage risk of mobile phone number is much greater than that of package name. Through weighting, the contribution of high-sensitivity fields to semantic affinity in the subsequent cosine similarity calculation is greater than that of low-sensitivity fields, thereby ensuring that the determination of semantic equivalence relations is more in line with the actual characteristics of data leakage risk. The theoretical basis of this weighting strategy comes from the TF-IDF concept in the field of information retrieval—in TF-IDF, terms with high discriminative power are given higher weights to improve retrieval accuracy; analogously, in this embodiment, high-sensitivity fields are given higher weights to improve the sensitivity of semantic equivalence determination to leakage risk.

[0073] All weighted information access fingerprint vectors that were not excluded collectively form the basis of the information access fingerprint space. The information access fingerprint space is based on... Each sensitive field is composed of coordinate axis dimensions. In the 3D vector space, each operation type corresponds to a vector point. The coordinate axes of this space have clear physical meanings—each coordinate axis corresponds to a specific sensitive data field, and the projection value of a vector onto that axis reflects the weighted ability of the corresponding operation type to access that sensitive field. In the information access fingerprint space, operation types with similar information access capabilities will correspond to vectors with similar directions, providing a computable mathematical basis for subsequent semantic equivalence determination based on vector direction similarity.

[0074] Through the three stages described above, a spatial mapping from the technical coding space to the information access fingerprint space is achieved. The core value of this mapping lies in transforming the representation dimension of operation types from technical coding names that do not carry business intent information into weighted access vectors that reflect the actual information acquisition capability of the operation, laying the data foundation for the subsequent quantitative calculation of semantic equivalence relations. By introducing sensitivity weight vectors, the determination of semantic equivalence relations for different operation types considers not only the overlap pattern of access fields but also the risk importance of overlapping fields, avoiding the deficiency in existing technologies that ignore field sensitivity differences when making equivalence determinations based solely on operation type names or the intersection of simple field sets.

[0075] Step S12: In the information access fingerprint space, calculate the cosine similarity of the weighted information access fingerprint vectors to generate a semantic affinity matrix; construct a semantic affinity undirected graph based on the semantic affinity matrix and a preset semantic equivalence judgment threshold, calculate the average node degree and perform adaptive density control, and output the optimized semantic affinity undirected graph.

[0076] For any two weighted information access fingerprint vectors in the information access fingerprint space, their cosine similarity is calculated as the semantic affinity between the corresponding two operation types. The cosine similarity is calculated by dividing the inner product of the two vectors by the product of their magnitudes. The cosine similarity ranges from 0 to 1 (since all components of the weighted information access fingerprint vectors are non-negative, the cosine similarity will not be negative). A value of 1 indicates that the two vectors are completely aligned in direction, meaning that the sensitive field sets accessed by the two operation types are completely identical in a weighted sense; a value of 0 indicates that the two vectors are orthogonal, meaning that the sensitive field sets accessed by the two operation types do not overlap at all. The technical basis for choosing cosine similarity as a semantic affinity metric is that it measures the consistency of two vectors in direction, unaffected by the vector magnitudes. In the application scenario of this embodiment, different operation types may access different numbers of sensitive fields, resulting in differences in the magnitudes of their weighted information access fingerprint vectors. However, when determining whether two operation types are semantically equivalent, the focus is on whether the patterns of which fields they access are similar, rather than how many fields each accesses. Cosine similarity measures the consistency of vector directions while ignoring differences in magnitude, making it suitable for semantic affinity calculation in this scenario.

[0077] Iterate through all non-excluded operation type pairs, calculate the cosine similarity between each pair, and construct a semantic affinity matrix. If the number of remaining operation types after excluding insensitive operation types is... If the number of species is such that the semantic affinity matrix is... OK A square matrix of columns, the matrix of the first column Line 1 The column element is the first Type of operation and the first This matrix represents the semantic affinity values ​​between different operation types. It is a symmetric matrix with all diagonal elements being 1. The physical significance of the semantic affinity matrix lies in its ability to fully encode the semantic association strength between all operation types in the information access dimension, providing global relational data for subsequent construction of a semantic affinity graph.

[0078] A semantic equivalence threshold is set to determine whether the semantic affinity between two operation types is high enough to be considered semantically equivalent. This method constructs a semantic affinity undirected graph, where each operation type is represented as a node, and the edges between pairs of operation types with a semantic affinity threshold are used as edges. In this graph, each node represents an operation type, and edges connecting nodes indicate that the two operation types have sufficiently high similarity in the information access dimension, thus qualifying them as semantically equivalent. The theoretical basis for this construction method is the threshold graph model in graph theory—transforming the similarity matrix into an adjacency matrix through threshold truncation is a standard preprocessing step in graph clustering algorithms such as spectral clustering, and its effectiveness in community detection tasks has been widely verified in social network analysis and bioinformatics.

[0079] The initial value of the semantic equivalence determination threshold is determined as follows: Calculate the mean and standard deviation of all non-zero elements in the entire off-diagonal element matrix, and set the initial threshold to the mean plus one standard deviation. This setting is based on the fact that, statistically, the quantile of the mean plus one standard deviation corresponds to approximately 16% of the distribution range, meaning that only about 16% of operation type pairs have an affinity higher than this threshold. These high-affinity operation type pairs are most likely to be truly semantically equivalent. This method is based on the outlier detection principle under the normal distribution assumption: under the condition that the affinity distribution is approximately normal, data points with a mean plus one standard deviation belong to the statistically significant high-value region, corresponding to operation type pairs with a semantic affinity significantly stronger than the average level. The initial threshold can also be set directly by security managers based on experience, generally ranging from 0.7 to 0.95.

[0080] After constructing the semantically affinity undirected graph, the average node degree is calculated. The average node degree is calculated by multiplying the number of edges by 2 and then dividing by the number of nodes. The average node degree reflects the connection density between nodes in the graph. If the average node degree exceeds a preset density upper limit, the current semantic equivalence threshold is considered too low, leading to too many operation type pairs being incorrectly classified as semantically equivalent. In this case, the semantic equivalence threshold is increased by a preset step size, and then the edge set of the graph is redefined based on the increased threshold, and the average node degree is recalculated. This process is repeated until the average node degree falls below the density upper limit, or the semantic equivalence threshold reaches the upper limit of 1.0.

[0081] The predetermined density upper limit is determined based on the following: In a carrier CRM system, truly semantically equivalent operation type groups typically constitute only a small fraction of all operation types, with each equivalence group generally containing 2 to 5 operation types. If the average number of nodes is too high, it means that a large number of unrelated operation types are incorrectly connected, leading to excessively large semantic equivalence classes during subsequent connected component decomposition, thus losing the ability to distinguish between different business intentions. The specific value of the density upper limit is determined as follows: Let the expected average number of members in a semantic equivalence class in a carrier CRM system be... (Based on expert review of the CRM system functional module design documents, generally 2 to 5), the upper limit of density is set to... Multiply by an adjustment factor. The adjustment factor ranges from 1.5 to 2.5 and is used to compensate for the deviation of the actual cluster size from the expected value due to the transitivity of connected components. In this embodiment, the upper limit of density is set to... The threshold is set at 20%, meaning that the average number of neighbors for each node does not exceed one-fifth of the total number of nodes. The preset step size is set to 0.05, meaning that the increment is 0.05 each time. The technical significance of the adaptive density control mechanism lies in that it provides an automatic optimization method based on graph structure feedback for determining the semantic equivalence threshold. Different operators' CRM systems differ in their operation type design. Some systems have more refined operation type designs with low functional overlap between different operation types, in which case a lower threshold is sufficient to obtain a reasonable graph density. Other systems have more coarse operation type designs with significant functional overlap between different operation types, requiring a higher threshold to distinguish between truly semantically equivalent pairs and general functionally overlapping pairs. The adaptive density control mechanism enables this method to automatically adapt to the operation type design characteristics of different CRM systems, eliminating the need for manual threshold tuning for each system.

[0082] This approach transforms the semantic equivalence relationships between operation types from qualitative judgments relying on the subjective experience of security management personnel into quantitative calculations based on cosine similarity. Adaptive density control ensures the stability of clustering accuracy across different CRM systems, providing a structurally sound graph input for the connected component decomposition in step S13. Compared to existing technologies that rely on manually configuring equivalence rule tables, this step automatically discovers newly added semantically equivalent operation type pairs during CRM system function iterations, exhibiting greater adaptability and maintainability.

[0083] Step S13: Perform connected component decomposition algorithm on the optimized semantic affinity undirected graph to generate a set of semantic equivalence classes; for semantic equivalence classes with more than or equal to 2 members, extract their aggregation information access fingerprint vector and determine the basic aggregation threshold by combining it with a preset risk level comparison table, calculate the fragmentation reduction coefficient based on the number of members and reduce the basic aggregation threshold, and output the semantic equivalence class mapping table and the corresponding cross-type aggregation threshold.

[0084] The fragmentation reduction coefficient is calculated as follows: the number of non-zero components in the aggregated information access fingerprint vector is counted and the ratio of the number of components to the total number of sensitive fields is calculated to generate the information access width ratio; according to the preset value range of the information access width ratio, the fragmentation reduction coefficient is mapped to a high reduction value, a medium reduction value, or a low reduction value.

[0085] The optimized semantic affinity undirected graph output in step S12 is then subjected to a connected component decomposition algorithm. This algorithm uses breadth-first search or depth-first search to traverse each node in the graph, grouping all nodes directly or indirectly connected by edges into the same connected component. All operation types within each connected component are categorized into the same semantic equivalence class. Connected component decomposition is a classic algorithm in graph theory; its time complexity is linearly related to the number of nodes and edges in the graph, making it suitable for processing semantic affinity undirected graphs typically ranging from tens to hundreds of nodes in this embodiment.

[0086] The technical basis for choosing Connected Component Decomposition (CFD) instead of other clustering algorithms (such as K-Means clustering or hierarchical clustering) as the equivalence class partitioning method is that the edges in the semantically affinity undirected graph have already been thresholded to ensure that the two connected operation types have sufficiently high semantic affinity. Based on this, operation types within the same connected component are either directly semantically equivalent (with direct edges) or transitively associated through a series of semantically equivalent intermediate operation types (with indirect paths). This equivalence class partitioning method based on transitive closure aligns with the transitive nature of semantic equivalence relations: if operation A is semantically equivalent to operation B, and operation B is semantically equivalent to operation C, then operation A and operation C are also equivalent at the business intent level. From a mathematical perspective, semantic equivalence relations are a type of equivalence relation, satisfying the three axioms of reflexivity, symmetry, and transitivity. Connected Component Decomposition precisely corresponds to the construction of the quotient set of equivalence relations—connected components in the graph correspond to equivalence classes of equivalence relations. This correspondence ensures that the equivalence class partitioning generated by connected component decomposition is mathematically a strictly mathematical set of equivalence relation quotients, without ambiguity or overlap.

[0087] After connected component decomposition, a set of semantic equivalence classes is obtained. Each semantic equivalence class contains one or more operation types. If a semantic equivalence class has only one member, meaning it contains only a single operation type, it is determined that there is no semantically equivalent alternative entry point for that operation type. In this case, the independent threshold rule already configured for that operation type in the original audit system is retained without modification. This approach is based on the premise that fragmented disguised leakage behavior requires the existence of multiple semantically equivalent operation entry points available for rotation. If a certain operation type is the only entry point capable of obtaining specific sensitive information, the leaker cannot distribute the operation to other entry points to circumvent threshold detection, and the original independent threshold rule is sufficiently effective in this situation. If the number of members in a semantic equivalence class is greater than or equal to two, it is necessary to calculate the aggregated information access fingerprint vector and cross-type aggregation threshold for that equivalence class.

[0088] The method for calculating the aggregated information access fingerprint vector is as follows: Take the maximum value element-wise from all member operation types within the equivalence class, using the weighted information access fingerprint vector. That is, the th element of the aggregated information access fingerprint vector... The component is equal to all members of the equivalence class at the th element. The maximum value among the components. The technical basis for taking the maximum value instead of the average or union is that the aggregated information access fingerprint vector is used to determine the risk level of the equivalence class in data leakage risk assessment. From a security strategy perspective, the risk level of an equivalence class should be determined by the type of operation among its members that can access the most sensitive field. This principle follows the highest waterline principle in information security—the security level of a system should be determined by its most vulnerable link. The mechanism of this principle is: even if only one type of operation in an equivalence class can access a user's mobile phone number, an attacker can still obtain the mobile phone number through that operation type; therefore, the security threshold of the entire equivalence class should be based on the security requirements of that highest-risk field.

[0089] Determining the cross-type aggregation threshold involves two steps. The first step is to determine the basic aggregation threshold: find the component with the largest weight value from the aggregated information access fingerprint vector, determine the security risk level of the sensitive field corresponding to this component, and then query the preset risk level-operation volume lookup table to obtain the basic aggregation threshold. The risk level-operation volume lookup table is a mapping table pre-configured by security managers according to the enterprise data security policy. This table defines the maximum total number of operations allowed for sensitive fields of different risk levels within the statistical window. The method for determining the maximum operation volume corresponding to each risk level in this lookup table is as follows: first, obtain the daily average operation volume distribution of various operations under normal business scenarios based on the operator's business volume statistics report, and take the 99th percentile of this distribution as the upper bound estimate of the normal business operation volume; then, take the 5th percentile of the daily average operation volume distribution of leaked operations in historically confirmed leakage cases as the lower bound estimate of the leakage behavior operation volume; the maximum operation volume is set between the above two estimates, and the specific value is determined through ROC curve analysis to achieve the optimal value for the comprehensive index of detection rate and false alarm rate (such as the Youden index). For example, the maximum number of operations allowed per day for direct user identification fields (such as mobile phone numbers) is 100, the maximum number of operations allowed per day for indirect user association fields (such as customer names) is 200, and the maximum number of operations allowed per day for business attribute fields is 500. These values ​​are determined by security management personnel based on actual business needs and security compliance requirements.

[0090] The second step is fragmentation reduction based on the number of members. The logic of fragmentation reduction is: the more operation types a semantic equivalence class contains, the more fragmented entry points an attacker can utilize, the more dispersed the operations become, and the lower the count of a single entry point. Therefore, stricter constraints need to be imposed on the aggregation threshold. The fragmentation reduction coefficient is determined by counting the number of non-zero components in the aggregated information access fingerprint vector and calculating its ratio to the total number of sensitive fields to obtain the information access width ratio. The information access width ratio reflects the breadth of sensitive information involved in the equivalence class. The threshold for the information access width ratio is determined based on set coverage theory. When the information access width ratio of an equivalence class reaches 0.5, it means that the operations in the equivalence class can cover more than half of the sensitive fields. At this point, through the combination of operations within the equivalence class, attackers can reconstruct most of the user's personal information profile, and the attack's harmfulness undergoes a qualitative change. Therefore, 0.5 is used as the lower bound of the high reduction interval. When the information access width ratio is below 0.2, the sensitive fields covered by the equivalence class are limited, and even if a fragmentation attack succeeds, it is difficult to cause serious information leakage. Therefore, 0.2 is used as the upper limit of the low reduction interval. If the information access width ratio is greater than or equal to 0.5, it means that the operation of the equivalence class covers more than half of the sensitive fields, involving a wide range of sensitive information, and the harm of the fragmentation attack is higher. The fragmentation reduction coefficient is set to a high reduction value, which is 0.15 in this embodiment. If the information access width ratio is greater than or equal to 0.2 and less than 0.5, the fragmentation reduction coefficient is set to a medium reduction value, which is 0.1 in this embodiment. If the information access width ratio is less than 0.2, the fragmentation reduction coefficient is set to a low reduction value, which is 0.05 in this embodiment. The specific values ​​of the above reduction coefficients are determined through Monte Carlo simulation: for a given reduction coefficient candidate value, the aggregation threshold judgment results of equivalence classes with different numbers of members are simulated under two scenarios: fragmentation attack and normal operation. The reduction coefficient value that makes the fragmentation attack detection rate not less than 95% and the false alarm rate of normal operation not higher than 5% is selected.

[0091] The reduced cross-type aggregation threshold equals the base aggregation threshold multiplied by the reduction factor, where the reduction factor equals 1 minus the fragmentation reduction coefficient multiplied by the natural logarithm of the number of members in the equivalence class. The technical basis for using the natural logarithm function is that fragmentation reduction should increase with the number of members, but the rate of increase should decrease. When the number of equivalence classes increases from 2 to 3 operation types, the additional risk increment from adding a new fragmentation entry point is significant; however, when the number of equivalence classes increases from 10 to 11, the marginal risk increment from adding a new entry point is relatively small. The natural logarithm function has this concave function characteristic, accurately reflecting the decreasing relationship between the number of fragmentation entry points and the risk increment.

[0092] The reduced cross-type aggregation threshold also needs to be adjusted to a lower bound: if the reduced value is less than the minimum of the independent thresholds for each member operation type in the equivalence class, the cross-type aggregation threshold is adjusted to that minimum value. The purpose of the lower bound adjustment is to avoid excessive reduction that causes the aggregation threshold to fall below the independent threshold for any single operation type, thereby generating a large number of false alarms in normal business operations.

[0093] Finally, the mapping relationship between operation types and semantic equivalence classes, as well as the cross-type aggregation threshold of each equivalence class, are recorded in the semantic equivalence class mapping table. The semantic equivalence class mapping table is the final output of step S10, and its data structure includes: a unique identifier for each semantic equivalence class, a list of all operation type codes included in that equivalence class, the independent alarm threshold for each operation type in the original audit system, and the cross-type aggregation threshold for that equivalence class. This mapping table serves as the direct input data for step S20.

[0094] It should be noted that the independent alarm thresholds for each operation type recorded in the semantic equivalence class mapping table refer to the frequency alarm thresholds for a single operation type that have been pre-configured in the existing audit system. The independent alarm threshold is the upper limit of frequency set by security administrators for each operation type during deployment of the operator's existing audit system, based on the business usage frequency and security risk level of each operation type. When the cumulative execution count of a certain operation type within the statistical window exceeds this threshold, the existing audit system will trigger an alarm. The method for determining the independent alarm threshold is as follows: security administrators obtain the daily average operation volume distribution of each operation type under normal business scenarios from the operator's business volume statistics report, take the 95th to 99th percentile values ​​of this distribution as the upper limit reference for normal business operation volume, and then make appropriate adjustments based on the leniency of security policy requirements. For example, in this embodiment, the independent alarm threshold for NumberQuery is 200 times / day, the independent alarm threshold for CustomerSearch is 200 times / day, and the independent alarm threshold for WorkOrderView is 300 times / day. The independent alarm threshold is an existing configuration parameter of the original audit system. The method of this invention directly reads this parameter from the original audit system and uses it as the side length input for constructing the independent threshold hypercube in the subsequent step S20.

[0095] By using connected component decomposition, the independent operation type counters in the original audit system are reorganized into several semantic equivalence classes, each equipped with a unified cross-type aggregation threshold. This reorganization transforms the audit system from independently monitoring each operation type to jointly monitoring all equivalent operations under the same business intent, fundamentally eliminating the escape space for fragmented spoofing and leakage. Through semantic affinity-driven fine-grained equivalence class partitioning, only truly semantically equivalent operation types are grouped into the same class, avoiding both the high false positive rate caused by coarse-grained merging and the false negative problem caused by fine-grained independent counting. The introduction of a fragmentation reduction factor further enables the aggregation threshold to adaptively adjust according to the size and information coverage of the equivalence class, achieving a fine balance between security and availability.

[0096] Step S20: Based on the semantic equivalence class mapping table and cross-type aggregation threshold, construct an independent threshold hypercube and an aggregation intent simplex in the operation frequency space, calculate the geometric difference between the two to generate an escape crescent domain, verify the topological inclusion relationship between the target operator's operation frequency vector and the escape crescent domain, and generate a fragmented camouflage marker and escape penetration depth if the target operator's operation frequency vector falls into the range.

[0097] In the multidimensional operation frequency space, by comparing the security domain (independent threshold hypercube) of the original audit system with the correct security domain (aggregate intent simplex) considering semantic equivalence, the operational activity space (escape crescent domain) of the fragmented attacker is accurately characterized, and it is determined whether the combination of operation frequencies of the target operator falls into this region. The core technical problem solved by step S20 is the blind spot problem generated by the independent threshold determination mechanism of the original audit system when facing the fragmentation and dispersion of semantically equivalent operations. Geometrically, this blind spot corresponds to the difference set region between the independent threshold hypercube and the aggregate intent simplex. This step transforms this blind spot from an implicit system defect into an explicit geometric object for accurate calculation.

[0098] Step S20 specifically includes three sub-steps: Step S21 is responsible for... Step S21 constructs an independent threshold hypercube representing the security domain of the original audit system in the frequency space of operations; Step S22 is responsible for constructing an aggregate intent simplex representing the correct security domain in the same space and verifying the existence of the escape space; Step S23 is responsible for calculating the geometric difference between the two to generate the escape crescent domain and performing a space attribution determination on the target operator. The three sub-steps are executed sequentially, with steps S21 and S22 constructing two geometries as inputs for the difference calculation in step S23.

[0099] Figure 3 A schematic diagram of the construction of independent threshold hypercubes and aggregated simplex.

[0100] like Figure 3As shown in the figure, this diagram illustrates the geometric representation of two different security constraints in a three-dimensional operation frequency space (corresponding to operation type 1, operation type 2, and operation type 3). The blue wireframe represents the independent threshold hypercube, constructed with the origin as its vertex and the independent alarm thresholds for each operation type in the original audit system as its side lengths, representing the security domain of the original system. The red tetrahedral region represents the aggregation intent simplex, constructed with cross-type aggregation thresholds as its intercept constraint; its red diagonal section visually demonstrates the boundary of the cross-type aggregation threshold constraint. This diagram clearly reveals the geometric differences between the original independent threshold determination logic (independent constraints in each dimension) and the aggregation constraint logic (unified constraints in the aggregation dimension) from a semantically equivalent perspective in multidimensional space.

[0101] Step S21, extract the contents The target semantic equivalence class of each operation type and its corresponding independent alarm threshold, in In the frequency space of operations, an independent threshold hypercube is constructed with the origin as the vertex and each independent alarm threshold as the side length.

[0102] From the semantic equivalence class mapping table output in step S10, read the semantic equivalence classes with a member count greater than or equal to 2 one by one. For the first... Let there be a semantic equivalence class, which contains... This type of operation, and this Each operation type has its own independent alarm threshold configured in the original audit system. The meaning and source of the independent alarm threshold have been explained in step S13. That is, the original audit system pre-configures the upper limit of the frequency of alarms for a single operation type for each operation type. This step directly reads this parameter from the semantic equivalence class mapping table output in step S10.

[0103] With this The frequency of operation for each operation type is respectively used as A base for each coordinate axis, constructing Dimensional operation frequency space. Each point in the frequency space of operations corresponds to a set This refers to the combination of operation frequencies for different operation types. For example, if a semantic equivalence class contains three operation types: NumberQuery, CustomerSearch, and WorkOrderView, then in the corresponding three-dimensional operation frequency space, the first coordinate axis represents the operation frequency of NumberQuery, the second coordinate axis represents the operation frequency of CustomerSearch, and the third coordinate axis represents the operation frequency of WorkOrderView. Points in the space... This indicates that the operator performed 150 NumberQuery operations, 120 CustomerSearch operations, and 80 WorkOrderView operations within the statistics window.

[0104] exist In the dimensional operation frequency space, an independent threshold hypercube is defined with the origin as a vertex, the positive half-axis of each coordinate axis as the direction of the edge, and each independent alarm threshold as the length of the corresponding edge. The mathematical definition of an independent threshold hypercube is: the set of all points in the space that satisfy the condition that each coordinate component is greater than or equal to 0 and less than or equal to the corresponding independent threshold.

[0105] Map the independent threshold determination logic of the original audit system to The 3D hypercube possesses strict mathematical equivalence, based on the feasible region definition principle in constrained optimization theory. In constrained optimization theory, the feasible region, defined by a set of inequalities, is the spatial region comprised of the set of points satisfying all constraints. The original auditing system independently sets thresholds for each operation type and independently determines whether it exceeds the limit. A threshold is set if and only if all... If the frequency of each type of operation does not exceed its respective independent threshold, the existing auditing system considers the operation to be normal. This judgment condition can be expressed as follows: Several independent inequality constraints are simultaneously true: the frequency of the first type of operation does not exceed a threshold. The second type does not exceed And so on. In 3D space, each inequality constraint defines a half-space. The intersection of the 100 half-spaces (plus the non-negative constrained half-spaces of each component) is geometrically a hyperrectangle with the origin as the vertex and each threshold as the side length. Specifically, the hypercube is a high-dimensional generalization of the Cartesian product interval, that is, an interval in one-dimensional space is generalized to a rectangle in two-dimensional space, and further generalized to... The hyperrectangle / hypercube in 3D space. Therefore, the independent threshold hypercube is not an approximation or metaphor for the audit decision logic, but a precise geometric expression of the independent threshold decision conditions. There is a one-to-one bijective relationship between the points inside the hypercube and the combination of operation frequencies that pass the independent threshold decision.

[0106] The volume of the independent threshold hypercube is equal to the product of all independent thresholds. Physically, this volume represents the total number of combinations of operations deemed safe by the original auditing system in continuous space, reflecting the capacity of the original auditing system's security domain.

[0107] For example, if a semantic equivalence class contains three operation types: NumberQuery (200 independent queries / day), CustomerSearch (200 independent queries / day), and WorkOrderView (300 independent queries / day), then the independent threshold hypercube constructed in the three-dimensional operation frequency space is a cuboid with three sides of lengths 200, 200, and 300. The points inside this cuboid... This indicates that the operator executed 180 NumberQuery, 190 CustomerSearch, and 280 WorkOrderView queries in one day. Since none of these three components exceeded their respective independent thresholds, the existing auditing system considered the operator's behavior normal. The volume of the hypercube is... This represents the capacity of the security domain of the original audit system.

[0108] Through the above process, the security domains of the original audit system are explicitly geometrized into hypercube objects, providing a geometric basis for the comparative analysis with the correct security domains in subsequent steps. This explicit geometrization transforms the security domains into mathematical objects capable of set operations (such as intersection, difference, and volume calculations), providing a computational foundation for precise comparison with the correct security domains. This geometrization transforms the discovery of audit blind spots from relying on manual experience-based judgment into an automated mathematical process.

[0109] Step S22, in the In the frequency space of operations, the cross-type aggregation threshold is used as the intercept constraint to construct the aggregation intent simplex; the relationship between the cross-type aggregation threshold and the sum of all independent alarm thresholds is verified, and if there is an overflow space, it is confirmed that there is an escape space.

[0110] Read the first from the semantic equivalence class map. Cross-type aggregation threshold for semantic equivalence classes. In the same... In the frequency space of operations, the aggregation intention simplex is defined with the cross-type aggregation threshold as the intercept constraint. The mathematical definition of the aggregation intention simplex is: the set of all points in the space that satisfy the condition that each coordinate component is greater than or equal to 0 and the sum of all coordinate components is less than or equal to the cross-type aggregation threshold.

[0111] Mapping security constraints from the semantic equivalence perspective to The 3D simplex also has a strict geometric correspondence, its theoretical basis being the definition of the standard simplex in linear programming theory. In linear programming, the standard simplex is defined as a set of points satisfying that all components are non-negative and the sum of the components does not exceed a constant; it is one of the simplest convex polyhedra defined by linear constraints. When operation types are semantically equivalent at the business intent level, the correct form of security constraint should not be that each operation type does not exceed the limit, but rather that the total frequency of all equivalent operations does not exceed the limit. This total constraint is... The security region defined in a 3D nonnegative space is determined by The region enclosed by a coordinate hyperplane and a total constraint hyperplane is geometrically a standard The simplex. A 2D simplex is a generalization of triangles in higher-dimensional spaces: in the two-dimensional case ( The simplex degenerates into a triangular region bounded by two coordinate axes and a diagonal line; in the three-dimensional case ( The simplex is a tetrahedron. Each vertex of the simplex corresponds to the extreme case where all operations are concentrated on a single type of operation, and the inclined section corresponds to... The combination of operation frequencies whose total frequency is exactly equal to the aggregation threshold.

[0112] Hypercubes and simplexes correspond to two fundamentally different security auditing philosophies. The auditing philosophy of hypercubes is based on independent constraints across dimensions—each type of operation operates independently, and security is maintained as long as each operation doesn't exceed its limits. The auditing philosophy of simplexes, on the other hand, is based on unified constraints across aggregate dimensions—semantically equivalent operations should be counted together, and security is maintained only when the total number doesn't exceed its limit. Fragmentation masquerading attacks can evade detection precisely because existing auditing systems employ the former philosophy rather than the latter. When the aggregation threshold is less than the sum of the independent thresholds, the simplex is strictly smaller than the hypercube; the difference between the two represents the operational space for fragmentation attackers.

[0113] Continuing with the examples of the three operation types above, if the cross-type aggregation threshold is 300 times / day, then the aggregation intention simplex in three-dimensional space is centered at the origin, , and A tetrahedron with vertices 1 and 2. Points inside the tetrahedron. The sum of 280 < 300 is within the safe range, while the point The sum of 330 > 300 exceeds the safety boundary, even though each of the three components does not exceed its own independent threshold.

[0114] After constructing the aggregation intent simplex, it is necessary to verify the relationship between the cross-type aggregation threshold and the sum of all independent alarm thresholds to determine if an escape space exists. The mathematical basis for this verification step is the necessary and sufficient condition for the inclusion relationship of convex sets. A hypercube is a convex set, and so is the simplex. The maximum value of the sum of components at any point within the hypercube is obtained at the diagonal vertex of the hypercube, and this maximum value is equal to the sum of all independent thresholds. If the cross-type aggregation threshold is greater than or equal to the sum of all independent thresholds, then the aggregation intent simplex completely contains the independent threshold hypercube. In this case, the total number of any combination of operation frequencies within the hypercube (i.e., where each operation does not exceed the independent threshold) will not exceed the aggregation threshold, thus eliminating the possibility of fragmentation spoofing. The independent threshold determination for this equivalence class in the existing auditing system is already sufficiently strict, and no additional fragmentation detection is needed. For this type of equivalence class, the subsequent escape crescent domain calculation is skipped, and it is removed from the fragmentation detection range to avoid unnecessary computational overhead.

[0115] If the cross-type aggregation threshold is less than the sum of all independent thresholds, then a portion of the independent threshold hypercube overflows outside the aggregation intent simplex. This overflowed area represents the operational space that a fragmentation attacker might exploit, confirming the existence of an escape space, and proceeding to step S23. In the example above, the sum of all independent thresholds is... The cross-type aggregation threshold is 300. If 300 < 700, it is confirmed that there is an escape space.

[0116] By filtering out semantic equivalence classes without escape space through preconditional judgment, the efficiency of subsequent computation is improved, while false positives are avoided for equivalence classes without fragmentation risk. The preconditional judgment is based on the mathematical properties of convex set inclusion relations, resulting in a deterministic determination. This avoids unnecessary computation of equivalence classes without fragmentation risk to improve efficiency, while ensuring that no equivalence classes with risk are missed, achieving a balance between computational efficiency and detection completeness.

[0117] Figure 4 A schematic diagram of the geometric difference set and escape penetration depth of the escape crescent region.

[0118] like Figure 4As shown in the figure, this diagram visually represents the set-theoretic difference between the independent threshold hypercube (the rectangular area enclosed by the blue dashed independent alarm thresholds) and the aggregation intent simplex (the area constrained by the red solid cross-type aggregation threshold), i.e., the escape crescent region filled in yellow in the figure. When the target operation frequency vector (the black dot in the figure) falls into this yellow area, it means that none of its components exceed their respective independent alarm thresholds, but the sum exceeds the cross-type aggregation threshold, thus successfully evading the original detection. The green vertical dashed line drawn from the target operation frequency vector to the simplex's oblique section in the figure represents the escape penetration depth. This depth is used to quantitatively characterize the severity of the total number of operations exceeding the safety boundary, providing a refined and continuous quantitative input for subsequent risk scoring.

[0119] Step S23: Calculate the set-theoretic difference between the independent threshold hypercube and the aggregation intention simplex to generate the escape crescent domain; if the target operator's If the frequency vector of operations satisfies the independent threshold constraints for each component and violates the cross-type aggregation threshold constraint, then it is determined that it falls into the escape crescent domain, the fragmented camouflage label is output, and the calculation is performed. The escape penetration depth is output by taking the signed vertical distance from the frequency vector of the operation to the inclined simplex section of the aggregation intention.

[0120] The escape crescent region is defined as the intersection of the independent threshold hypercube and the simplex complement of the aggregation intent, i.e., the set of all operation frequency combinations that simultaneously satisfy the following two conditions: Condition 1, each coordinate component is greater than or equal to 0 and less than or equal to its corresponding independent threshold (located inside the hypercube); Condition 2, the sum of all coordinate components is greater than the cross-type aggregation threshold (located outside the simplex). The geometric meaning of the escape crescent region is very clear: the operation frequency combinations within this region satisfy all the independent threshold judgment conditions of the original audit system (each operation does not exceed the limit), but violate the correct security constraint after considering semantic equivalence (the total number of equivalent operations exceeds the limit). In other words, the escape crescent region is the precise operation space of fragmented camouflage behavior—the leaker disperses operations to multiple equivalent entry points, making the operation frequency of each entry point lower than its respective independent threshold, but the total number of operations of all entry points exceeds the security limit.

[0121] The formation of the escape crescent region has profound auditing mechanism roots and a clear geometric explanation. From a set theory perspective, the escape crescent region is the set-theoretic difference between two convex sets (the hypercube and the simplex). According to convex set theory, the difference between two convex sets is generally not a convex set, but a non-convex region enclosed by convex boundary surfaces. Each point within the escape crescent region corresponds to a fragmentation operation strategy—each coordinate component of the point gives the specific number of operations allocated at each operation entry point; each component is within the limit, but the sum exceeds the limit. The boundary of the escape crescent region is jointly formed by the face of the hypercube and the oblique section of the simplex—the face of the hypercube corresponds to the threshold boundary of the original auditing system, and the oblique section corresponds to the correct aggregation security boundary; the intersection of the two is the turning line from the security region to the escape region for fragmentation behavior.

[0122] In the two-dimensional case ( The escape crescent region is represented by a diagonal region of a rectangle that has been truncated by a diagonal line. For example, if the independent thresholds for the two operation types are 200 and 200 respectively, and the cross-type aggregation threshold is 300, then the escape crescent region is a triangular region within the rectangular area where the sum of the two components is greater than 300. The operation frequency combination point... It falls into this region because 160 < 200 and 180 < 200 (satisfying two independent thresholds), but (Violation of aggregation threshold). The fragmentation strategy corresponding to this point is to allocate 160 times at the first entry point and 180 times at the second entry point. Each entry point individually does not exceed the limit, but the total amount exceeds the limit. Continuing with the examples of the above three operation types in the three-dimensional case (independent thresholds 200, 200, 300, aggregation threshold 300), the escape crescent region is the area inside the cuboid where the sum of the three components is greater than 300. Point The sum of 310 > 300 falls into the escape crescent domain. The fragmentation strategy corresponding to this point allocates 120, 100, and 90 operations to the three entry points respectively. Each component is within its own independent threshold range, but the total exceeds the aggregation threshold.

[0123] The escape crescent domain volume ratio is equal to the escape crescent domain volume divided by the volume of the independent threshold hypercube, representing the proportion of the original audit system's blind spot in this semantic equivalence class. The larger this ratio, the greater the vulnerability in the original audit system, and the wider the operational space for fragmented, disguised leaks. The escape crescent domain volume is calculated based on multidimensional integral theory: the hypercube volume is the product of each independent threshold, and the volume of the intersection of the hypercube and the simplex is calculated using piecewise integration. The escape crescent domain volume equals the hypercube volume minus the intersection volume. In actual operator systems, when the cross-type aggregation threshold is much smaller than the sum of the independent thresholds, this ratio can reach 30% to over 60%, indicating a serious blind spot in the original audit system. This means that 30% to 60% of the security domain of the original audit system is actually insecure, giving fragmented attackers ample room to evade detection.

[0124] Get the target operator's views on semantic equivalence classes within the preset statistics window. The number of operations performed for each operation type constitutes the total number of operations performed. The frequency vector of operations is used. The length of the preset statistical window is determined according to the following principles: the window should be long enough to accumulate meaningful operation data to avoid false positives triggered by a single operation, while it should be short enough to ensure the timeliness of detection. Based on the business cycle characteristics (daily settlement) of the operator's CRM system, the default value in this embodiment is one calendar day (24 hours). The statistical window can also be set to a longer time period such as one week or one month to adapt to different detection accuracy requirements. A shorter statistical window can detect fragmented behavior more promptly, but may increase the false positive rate due to insufficient sample size; a longer statistical window can accumulate more sufficient operation data to improve the reliability of judgment, but the real-time performance of detection is correspondingly reduced.

[0125] right The frequency vector of operations performs an escape crescent domain attribution determination. The logic of this attribution determination involves simultaneously checking two conditions: first, whether each component of the vector does not exceed its corresponding independent threshold; and second, whether the sum of all components of the vector exceeds a cross-type aggregation threshold. If both conditions are met, the vector is determined to fall into the escape crescent domain, and a fragmented camouflage flag is generated for the target operator. The fragmented camouflage flag is a Boolean flag; a true value indicates that the operator's behavior characteristics conform to the fragmented camouflage leakage operation pattern. The mathematical essence of this determination is a membership check of a point within a convex set difference set—first checking whether the point belongs to a hypercube (through…). (One independent interval test), then test whether the point does not belong to the simplex (by a summation test). If both are true, then it is confirmed that it belongs to the difference set.

[0126] Once the operation frequency vector falls into the escape crescent region, the signed perpendicular distance from this vector to the inclined section of the convergent simplex is further calculated, serving as the escape penetration depth. The inclined section of the convergent simplex is... A hyperplane is defined in 3D space whose equation is such that the sum of all coordinate components equals the cross-type aggregation threshold. The theoretical basis for this distance calculation is the distance formula from a point to the hyperplane in analytic geometry. The normal vector of this hyperplane is a vector with all components equal to 1, and its magnitude is... According to the point-to-hyperplane distance formula, the signed perpendicular distance from the operation frequency vector to the hyperplane is calculated as follows: subtract the cross-type aggregation threshold from the sum of all components, and then divide by... Divide by The goal is to transform the sum and difference of coordinates into the true Euclidean distance in the direction normal to the hyperplane.

[0127] The physical significance of escape penetration depth lies in its quantification of the extent to which the total amount of equivalent operations performed by an operator exceeds the aggregated safety boundary. A greater penetration depth indicates that the total amount of equivalent operations exceeds the safety boundary further, and the degree of fragmentation is more severe. Penetration depth is a continuous value, not a binary label, providing a refined quantitative input for the comprehensive risk score in step S30. For example, a penetration depth of 5 indicates that the total amount of operations slightly exceeds the safety boundary, possibly due to normal business fluctuations; a penetration depth of 50 indicates that the total amount of operations significantly exceeds the safety boundary, significantly increasing the suspicion of fragmentation spoofing.

[0128] If the operation frequency vector does not fall into the escape crescent domain (i.e., the two judgment conditions are not met simultaneously), it is necessary to further determine whether the vector is located within the boundary warning zone of the aggregation intent simplex. The boundary warning zone is defined as the area inside the simplex whose distance from the inclined section does not exceed the preset warning zone width. If the operation frequency vector is located within the boundary warning zone, an aggregation frequency warning mark is generated for the target operator, but no fragmentation camouflage mark is generated. The warning zone width is determined by multiplying the cross-type aggregation threshold by a preset warning ratio coefficient. This ratio coefficient is set according to the sensitivity requirements of safety management, based on the 10% safety margin principle commonly used in engineering safety. In this embodiment, the warning zone width is set to 10% of the cross-type aggregation threshold. The design of the boundary warning zone follows the safety principle of warning upon approaching danger, enabling the audit system to issue a warning signal in advance when the operator has approached the aggregation boundary before actually falling into the escape domain. The escape penetration depth, as one of the key outputs of step S20, is output to step S30 along with the fragmentation camouflage mark.

[0129] This transforms fragmented camouflage-based leakage behavior from a latent threat undetectable by existing auditing systems into an explicit detection target with defined geometric boundaries. By performing precise spatial attribution determination within the escape crescent domain, deterministic detection of fragmented camouflage behavior is achieved. Simultaneously, the escape penetration depth provides a continuous quantitative measure of risk level, laying the foundation for subsequent tiered alerts.

[0130] The overall beneficial effect of step S20 is as follows: Compared to existing auditing techniques that only perform frequency threshold detection on a single operation type dimension, step S20 transforms the detection problem of fragmented disguised leakage behavior from a rule-matching paradigm to a geometric space analysis paradigm by constructing two security domain geometries in a multi-dimensional operation frequency space and calculating their difference set. In existing auditing techniques, a common attempt to detect fragmented behavior is to manually pre-set association rules across operation types, but this method requires security managers to enumerate all possible fragmented combinations in advance, lacking completeness and scalability. This invention, by accurately calculating the escape crescent domain in the operation frequency space, incorporates all possible fragmented operation strategies into a unified geometric region for detection, possessing mathematical completeness—any operation combination that satisfies the independent threshold constraint but violates the aggregation constraint will inevitably fall into the escape crescent domain. The independent threshold hypercube and the aggregation intent simplex are precise geometric expressions of the security domain at two different audit granularities, rather than approximations or analogies. The escape penetration depth provides a continuous quantitative measure of risk level rather than simply outputting a binary judgment result. The design of the boundary warning zone allows the system to issue an early warning when the operator approaches the aggregation boundary, reflecting the design concept of proactive safety protection and having a predictive advantage compared to the post-event detection mode of existing audit systems.

[0131] Step S30: Extract the cumulative operation trajectory curve of the target operator carrying the fragmented camouflage mark and calculate the trajectory geometric feature vector, construct the normal behavior trajectory cone and calculate the composite deviation of the trajectory geometric feature vector relative to the normal behavior trajectory cone, and generate a comprehensive risk score based on the escape penetration depth to trigger an alarm.

[0132] For target operators marked as fragmented camouflage in step S20, a deep analysis of the geometric characteristics of their operational behavior patterns is conducted in the time dimension. By comparing these patterns with those of historical normal operators, the degree of behavioral abnormality is assessed. Finally, a comprehensive risk score is generated by combining the escape penetration depth in the spatial dimension and the trajectory deviation in the time dimension, triggering a tiered alarm. The core technical problem addressed by step S30 is that simply judging based on the total number of operations exceeding the limit is insufficient to distinguish between malicious fragmented leakage behavior and occasional frequency fluctuations in normal business operations. In the actual operation of operator CRM systems, certain special business scenarios (such as concentrated customer follow-ups during marketing campaigns) may cause operators to query a large amount of user information through multiple entry points in a short period. In this case, the operation frequency vector may accidentally fall into the escape crescent domain, but the operation behavior itself is not malicious fragmented leakage. Step S30 analyzes the operator's... The geometric characteristics (heading direction and curvature) of the cumulative operational trajectory in the frequency space of operations can distinguish between systematic fragmented camouflage behavior and occasional normal business fluctuations.

[0133] Step S30 specifically includes three sub-steps: Step S31 is responsible for converting the discrete operation log sequence into... The cumulative operational trajectory curve in 3D space; step S32 is responsible for extracting two complementary geometric features from the trajectory curve: the terminal heading deflection angle and the average trajectory curvature; step S33 is responsible for constructing the normal behavior trajectory cone, calculating the composite deviation, and generating a comprehensive risk score. The three sub-steps are executed sequentially. The trajectory curve output by step S31 serves as the feature extraction input for step S32, and the feature vector output by step S32, together with the escape penetration depth output by step S20, serves as the scoring input for step S33.

[0134] Figure 5 This is a schematic diagram for the cumulative operation trajectory curve and trajectory geometric feature extraction.

[0135] like Figure 5 As shown in the figure, this diagram illustrates the process of transforming a discrete sequence of operational events into a continuous geometric form in a multidimensional space. The blue stepped broken lines in the figure represent the cumulative operational trajectory curve, generated by successively accumulating the standard basis vectors of the operational events. The red leading ray in the figure represents the terminal direction vector; the angle between it and the gray evenly divided diagonal direction (representing an ideal uniform fragmented distribution) is extracted as the terminal heading deflection angle, used to measure the macroscopic uniformity of the operational distribution. Simultaneously, the figure also indicates the direction change angle at the trajectory broken lines; this angle corresponds to the direction change of adjacent line segments and is used to calculate the average trajectory curvature, characterizing the microscopic frequency of operator switching between different operational types. These two complementary geometric features together constitute the trajectory geometric feature vector.

[0136] Step S31: Accumulate the standard basis vectors of the operation events sequentially according to the operation timestamps to generate the piecewise linear cumulative operation trajectory curve.

[0137] For a target operator carrying fragmented camouflage tags, extract the operator's semantic equivalence classes from the operation log record set during the complete observation period. All operation records for each operation type are processed. The length of the complete observation period is typically set to be greater than or equal to the time range of a preset statistical window to ensure sufficient operation data for trajectory analysis. In this embodiment, the complete observation period is set to three times the length of the statistical window by default. All extracted operation records are sorted in ascending order by operation timestamp to obtain an operation event sequence. Each operation event in the sequence has an operation type index, which identifies the operation as belonging to an equivalence class. Which type of operation?

[0138] A cumulative operation vector is introduced. This K-dimensional vector represents the cumulative number of operations performed by the target operator on the i-th operation type within the semantic equivalence class from the initial observation time to the current time. The cumulative operation vector is updated progressively with each operation event. For each operation event, the component corresponding to that operation type in the cumulative operation vector increases by 1, while the other components remain unchanged. The ordered sequence of the cumulative operation vector records the operator's movement within the operation frequency space, and its trajectory reflects the operator's usage distribution pattern across different operation types. Initialization The cumulative operation vector is a zero vector, meaning all coordinate components are 0. For each operation event in the sequence, the cumulative operation vector is increased by one unit along the coordinate axis corresponding to the operation type, based on its operation type index. Specifically, the operation is as follows: The first dimension in space A standard basis vector is added to the current cumulative operation vector. A standard basis vector is a unit vector whose component is 1 only in the corresponding coordinate axis direction and whose other components are 0. For example, in the three-dimensional operation frequency space, if the operation type index of the 5th operation event is 2 (i.e., the second operation type CustomerSearch was executed), then the second component of the cumulative operation vector is incremented by 1, and the other components remain unchanged.

[0139] Concatenate all cumulative operation vectors sequentially in chronological order. A piecewise linear cumulative operation trajectory curve is formed in the multidimensional operation frequency space. This curve starts at the origin and ends at the final cumulative operation vector. Each segment of the curve extends along a certain coordinate axis, corresponding to the type of the operation. The theoretical basis for transforming the discrete operation log sequence into a continuous trajectory curve in multidimensional space is the path embedding method in random walk theory. In random walk theory, the state transition sequence at discrete time steps can be embedded as a piecewise linear path in continuous space, and the geometric properties of the path (such as drift direction, diffusion coefficient, and turning angle distribution) encode the statistical characteristics of the stochastic process. In this method, each operation event moves the cumulative vector one step along the corresponding coordinate axis, and the entire sequence of operation events constitutes a piecewise linear path. A random walk path through a grid point in a 3D space. A normal operator habitually uses one or a few query entry points in their daily work, and their accumulated operation trajectory will advance approximately in a straight line along a certain coordinate axis, with the overall direction biased towards that coordinate axis. The random walk of a normal operator has strong anisotropy—due to the habitual use of a certain entry point, the path mainly drifts along the coordinate axis direction corresponding to that entry point. A fragmented attacker, however, needs to systematically rotate different entry points to maintain a balanced count across them, and their accumulated operation trajectory will alternate between multiple coordinate axis directions, with the overall direction tending towards... The diagonal direction of the dimensional space is evenly distributed. The random walk of a fragmentation attacker is approximately isotropic—due to the uniform distribution of operations to each entry point, the path drifts uniformly in all coordinate axis directions, tending towards the diagonal direction. This behavioral difference has quantifiable geometric distinctions in both the terminal direction of the trajectory and the frequency of direction changes.

[0140] For example, under the three operation types, if a normal operator executes 200 NumberQuery, 10 CustomerSearch, and 5 WorkOrderView operations in a day, their trajectory will mostly move along the first coordinate axis, occasionally deviating in other directions, with the terminal direction clearly biased towards the first coordinate axis. If a fragmented attacker executes 80 NumberQuery, 80 CustomerSearch, and 80 WorkOrderView operations, their trajectory will alternate between the three coordinate axes, with the terminal direction approximating the evenly divided diagonal direction of three-dimensional space. This difference in terminal direction and the frequency of direction changes is fundamentally distinguishable in terms of trajectory geometry.

[0141] If the length of the operation event sequence is less than the preset minimum number of trajectory analysis points, it is determined that the operation samples are insufficient to support reliable trajectory geometric feature extraction. Steps S32 and S33 are then suspended, and the observation window is extended to continue collecting operation data. The preset minimum number of trajectory analysis points is determined based on the sample size requirement for trajectory direction statistics—stable estimation of the terminal direction vector and mean curvature requires sufficient operation event samples to eliminate random fluctuations. According to the convergence rate estimation based on the law of large numbers in statistics, for the direction mean estimation in K-dimensional space, at least several dozen sample points are needed for the angular error of the direction estimation to converge to an acceptable range. In this embodiment, the preset minimum number of trajectory analysis points is set to 30 operation events.

[0142] Transform discrete operation log time series into Trajectory curves with continuous geometric shapes in 3D space allow for the subsequent use of geometric properties such as the direction and curvature of the curves to characterize operator behavior patterns, providing an analytical object for distinguishing between malicious fragmented behavior and normal operations. This transformation utilizes a random walk path embedding method to encode temporal behavioral information into spatial geometric information, elevating behavioral analysis from one-dimensional frequency statistics to a more comprehensive approach. The geometric morphology analysis level provides an analytical framework for capturing temporal structural patterns.

[0143] Step S32: Calculate the terminal direction vector of the cumulative operation trajectory curve and the terminal heading deflection angle of the diagonal direction; calculate the mean of the direction change angles of adjacent line segments to generate the average trajectory curvature; combine the terminal heading deflection angle and the average trajectory curvature to output the trajectory geometric feature vector.

[0144] Step S32 extracts two complementary geometric features to characterize the operator's behavior pattern from two dimensions: the uniformity of operation distribution and the frequency of operation type switching.

[0145] The terminal direction vector of the cumulative operation trajectory curve is calculated; it is the unit vector obtained by dividing the final cumulative operation vector by its magnitude. The terminal direction vector reflects the cumulative usage distribution direction of various operation types by the operator throughout the observation period. Definition A unit vector that evenly divides the diagonal direction in 3D space, where each component of the vector is equal to The physical meaning of equally bisecting the diagonal direction is: The ideal fragmentation direction is when all operation types are used with completely equal frequency—if the operator distributes all operations evenly to In this type of operation, the terminal direction vector will be exactly along the diagonal direction.

[0146] The terminal heading deflection angle is calculated by taking the inverse cosine function of the product of the two vectors and dividing by the product of their magnitudes. The terminal heading deflection angle ranges from 0 to... , where 0 indicates that the terminal direction completely coincides with the diagonal of the even distribution, that is, the operation is completely and evenly distributed across all operation types, and the fragmentation and dispersion characteristics are most significant; the larger the value, the more concentrated the operation is on a few operation types, and the more obvious the normal and focused use characteristics are.

[0147] The theoretical basis for choosing the evenly divided diagonal as the reference direction is the analysis of optimal distribution strategies in game theory. In the game model of fragmentation attack, the attacker's goal is to maximize the total number of equivalent operations while satisfying all independent threshold constraints. Solving this constraint optimization problem using the Lagrange multiplier method, the optimal strategy when all independent thresholds are equal is to evenly distribute the operations across all... In this scenario, the terminal's direction is precisely along the evenly divided diagonal. When the independent thresholds are unequal, the optimal strategy favors the entry with the larger threshold but still tends towards the diagonal region. Therefore, the evenly divided diagonal direction serves as the directional benchmark for the ideal fragmentation strategy, and the terminal heading deflection angle measures the directional deviation between the operator's actual operational distribution and the ideal fragmentation distribution.

[0148] For example, in In this case, the components of the unit vector along the diagonal direction are approximately 0.577. If the operator's terminal cumulative vector is... After normalization, it is approximately The angle between this angle and the diagonal direction is approximately 54°, indicating a normal operating mode that is clearly biased towards the first coordinate axis. If the operator's terminal cumulative vector is... After normalization, it is approximately The angle between the axial direction and the diagonal direction is approximately 4°, exhibiting a highly fragmented uniform dispersion pattern.

[0149] For two adjacent line segments on the cumulative operation trajectory curve, calculate the direction change angle. The direction vector of each line segment is equal to the standard basis vector corresponding to that operation. When two adjacent line segments correspond to the same operation type, the two direction vectors are the same, and the direction change angle is 0, indicating that the operator used the same operation type twice consecutively. When two adjacent line segments correspond to different operation types, the two direction vectors are different standard basis vectors, and the angle between them is 90° (because...). In Euclidean space, any two standard basis vectors are orthogonal, and the angle of change of direction is 90°, indicating a switch in the operation type. The calculation of the angle of change of direction is based on the definition of the curvature of discrete curves in differential geometry. In differential geometry, the curvature of a continuous curve is defined as the magnitude of the derivative of the unit tangent vector with respect to the arc length parameter. For piecewise linear curves, its discrete approximation is the angle between the direction vectors of adjacent line segments. The property that the angle between standard basis vectors is always 90° originates from the definition of orthogonal basis in Euclidean space— The standard basis vectors of a 3D space form an orthonormal basis, and the inner product of any two different basis vectors is 0, corresponding to an angle of 90°.

[0150] The arithmetic mean of the directional change angles at all turning points is used to obtain the average trajectory curvature. The average trajectory curvature ranges from 0° to 90°, where 0° indicates that the operator uses the same operation type throughout the entire observation period (without switching), and 90° indicates that the operator switches operation types between every two adjacent operations (changing the entry point for each operation). The physical meaning of the average trajectory curvature is to measure the frequency of operation type switching. Fragmentation attackers need to frequently alternate between different entry points to maintain a balanced count across them, resulting in an average trajectory curvature close to 90°; while normal operators typically use the same entry point for continuous queries, resulting in an average trajectory curvature far below 90°.

[0151] The complementarity analysis of the two features is as follows. The heading deflection angle measures the macroscopic uniformity of operation distribution—whether the total usage ratio of each operation type by operators tends to be evenly distributed throughout the observation period. The average curvature measures the microscopic frequency of operation type switching—whether operators frequently change entry points between adjacent operations. The necessity of their complementarity lies in the fact that a single feature can create confusing scenarios—if operators concentrate on using entry point A in one period and entry point B in another, the macroscopic distribution may be even (small deflection angle), but the microscopic switching is not frequent (low curvature). This pattern is more consistent with normal business rotation than fragmentation attacks. A typical characteristic of fragmentation attackers is a combination of small deflection angles and high curvature—even operation distribution and frequent alternation of entry point switching. The joint analysis of the two features can effectively eliminate the aforementioned confusing scenarios.

[0152] The terminal heading yaw angle and the average trajectory curvature are combined into a two-dimensional vector, which is the trajectory geometric feature vector, and output to step S33.

[0153] Two complementary quantitative features were extracted from the geometric morphology of the operational trajectory. These features capture different aspects of fragmented behavior from different angles, forming a multi-dimensional behavioral profile and providing a reliable quantitative basis for subsequent comparison with normal behavior and risk scoring. The two features are based on two different mathematical tools: optimal dispersion strategy analysis in game theory and the definition of discrete curvature in differential geometry. Their joint analysis significantly improves the ability to distinguish between fragmented behavior and the boundary scenarios of normal behavior.

[0154] Figure 6 This is a schematic diagram for calculating the normal behavior trajectory cone and the composite deviation.

[0155] like Figure 6 As shown in the figure, this diagram illustrates the process of constructing a baseline and calculating abnormal deviations based on historical normal operation data. The gray dashed arcs represent unit hyperspheres, and the green fan-shaped areas represent the constructed normal behavior trajectory sub-cones. These sub-cones are constructed with the cluster center direction obtained from spherical clustering as the axis, and the product of the angular scatter radius and a preset expansion factor as the semi-cone angle, representing the directional distribution baseline of the normal operation mode. The red arrows represent the target operator's target trajectory geometric feature vector. When this vector is outside the normal sub-cone, the angle between it and the sub-cone boundary is extracted as the minimum angular deviation. This deviation is then normalized and fused with the escape penetration depth to generate the final comprehensive risk score to trigger a tiered alarm.

[0156] Step S33: Extract the set of terminal direction vectors of historical normal operator groups, perform spherical clustering, obtain the main direction cluster, and combine it with the preset safety expansion factor to construct the normal behavior trajectory cone; calculate the minimum angular deviation of the terminal direction vector of the trajectory geometric feature vector to the normal behavior trajectory cone, and normalize it to obtain the composite deviation; weight the escape penetration depth and the composite deviation to output the comprehensive risk score.

[0157] In step S33, constructing the normal behavior trajectory cone includes: projecting the set of terminal direction vectors of the historical normal operator group onto a unit hypersphere, performing iterative clustering using the spherical K-Means algorithm, and outputting the cluster center and the corresponding angular dispersion radius; removing abnormal operation mode clusters with a member number lower than a preset minimum cluster capacity threshold, constructing multiple normal behavior trajectory sub-cones with the remaining cluster center as the axis and the product of the angular dispersion radius and the preset safety expansion factor as the half-cone angle, and outputting the union of all normal behavior trajectory sub-cones as the normal behavior trajectory cone.

[0158] The idea behind the normal behavior trajectory cone is to establish a directional distribution benchmark for normal operating patterns using operational behavior data from a historical group of normal operators. This benchmark is then used to assess the degree of abnormal behavior of the target operator. Operational data for a group of operators whose behavior has been audited and confirmed as normal (referred to as the historical normal operator group) is extracted from historical operation logs. For each historical normal operator, their cumulative operational trajectory curve is constructed according to steps S31 and S32, and their terminal direction vector is extracted. The terminal direction vectors of all historical normal operators constitute the terminal direction vector set.

[0159] Project the terminal direction vector set onto On the unit hypersphere in 3D space, each terminal direction vector is normalized to a unit vector. The spherical K-Means clustering algorithm is then performed on this hypersphere. The difference between spherical K-Means clustering and standard K-Means clustering lies in the distance metric: angular distance (the angle between two unit vectors) is used instead of Euclidean distance, and the cluster centers are updated by taking the normalized arithmetic mean of all member vectors within the cluster instead of a simple arithmetic mean. The theoretical basis for choosing spherical clustering over standard Euclidean space clustering is the fundamental principle of directional statistics. Directional statistics is a branch of statistics that specifically deals with the directional information of data. When data points are normalized to unit vectors and all fall on the unit hypersphere, the information of the data is entirely determined by direction and independent of magnitude. The core principle of directional statistics is that the difference between two directions on the hypersphere should be measured using geodesic distance (i.e., the arc length of a great circle or equivalently, the angle) rather than Euclidean chordal distance, because the hypersphere is a Riemannian manifold, not Euclidean space. Spherical K-Means ensures that cluster centers always lie on the hypersphere by reprojecting (normalizing) the cluster centers back onto the hypersphere after each iteration, thus achieving correct clustering under spherical geodesics. Standard K-Means, using Euclidean distance, introduces systematic bias on spherical data, leading to distorted clustering results. Normal operator habits typically fall into several patterns. Some operators primarily use the NumberQuery entry point, with their terminal direction vectors concentrated near the first coordinate axis; others primarily use the CustomerSearch entry point, with their terminal direction vectors concentrated near the second coordinate axis. These different operating habits form several direction clusters on a unit hypersphere, each corresponding to a typical normal operating pattern. Spherical clustering can automatically identify these direction clusters.

[0160] The number of clusters in spherical clustering can be determined using the silhouette coefficient method or the elbow method. In this embodiment, the search range for the number of clusters is set to 2 to the number of operation types contained in the semantic equivalence class. Spherical K-Means clustering is performed on each candidate cluster number, and the average silhouette coefficient is calculated. The cluster number with the largest average silhouette coefficient is selected as the final cluster number. The convergence condition for clustering is that the change in cluster centers (the angular distance between the cluster center vectors in two adjacent iterations) is less than a preset convergence threshold or the maximum number of iterations is reached. In this embodiment, the preset convergence threshold is set to 0.001 radians, and the maximum number of iterations is set to 100.

[0161] After clustering is completed, if the number of members in a cluster is lower than a preset minimum cluster capacity threshold, the cluster is identified as an abnormal operation pattern cluster and excluded from the construction of the normal behavior trajectory cone. The preset minimum cluster capacity threshold is determined by multiplying the total number of historical normal operators by a preset minimum proportion coefficient. In this embodiment, the minimum proportion coefficient is set to 0.05, meaning that clusters with fewer than 5% of the total number of normal operators are excluded. Clusters with too few members may represent atypical, occasional operation patterns or data noise; including them in the normal behavior trajectory cone may result in an excessively large cone coverage area, reducing detection sensitivity.

[0162] by The origin of the dimensional space is the apex of the cone. The axis of the cone is the central direction vector of each retained cluster. The half-cone angle is obtained by multiplying the maximum angle between the terminal direction vectors of all members within the cluster and the central direction by a preset safety expansion factor. This constructs a sub-cone for the normal behavior trajectory. The union of all normal behavior trajectory sub-cones constitutes the normal behavior trajectory cone. The geometric rationale for modeling the normal operating mode as a cone comes from the von Mises-Fisher distribution theory in directional statistics. The von Mises-Fisher distribution is a probability distribution defined on a unit hypersphere, a natural generalization of the normal distribution onto a sphere. This distribution is completely determined by a mean direction (mode direction) and a concentration parameter (similar to the precision parameter of the normal distribution). Given the mean direction and concentration parameter, the equiprobability density surface of the von Mises-Fisher distribution is precisely a set of concentric cones with the mean direction as their axis. Therefore, the cone constructed with the cluster center direction as the axis and the angular scatter radius as the semi-cone angle is essentially a geometric approximation of the high probability density region of the von Mises-Fisher distribution—the interior of the cone contains the vast majority of the probability mass of the directional distribution. Thus, the cone is a standard parameterized form of the directional distribution's confidence region, not a rough analogy of normal behavior patterns.

[0163] The purpose of the preset security expansion factor is to moderately expand the directional dispersion range of the normal operating mode to cover normal operating behaviors that may slightly deviate from the typical mode due to business fluctuations. The security expansion factor is determined by calculating the angle from the terminal direction to the nearest cluster center using known normal operator samples in the verification dataset, statistically analyzing the percentiles of this angle distribution, and selecting an expansion factor value that ensures at least a preset coverage rate (e.g., 99%) of normal samples fall within the expanded cone. In this embodiment, the security expansion factor is set to 1.5, with a range of 1.2 to 2.0. A larger security expansion factor results in a wider coverage range for the normal behavior trajectory cone and a lower false alarm rate for normal operators, but also lower sensitivity to fragmented behaviors; a smaller security expansion factor results in higher detection sensitivity but also a higher false alarm rate. Security managers can adjust the tolerance for false alarm and false negative rates according to the business scenario.

[0164] The geometric meaning of the normal behavior trajectory cone is: The coverage area of ​​the terminal orientation distribution of normal operators in the frequency space of operations. Terminal orientations falling inside the cone are considered to be within the normal operating mode range, while terminal orientations falling outside the cone are considered to deviate from the normal operating mode.

[0165] For example, in In the case where spherical clustering yields two main directional clusters, the first cluster's center direction has an angular dispersion radius of 15° near the first coordinate axis, and the second cluster's center direction has an angular dispersion radius of 20° near the second coordinate axis, and the safety expansion factor is set to 1.5, then the semi-cone angle of the first sub-cone is... The semi-cone angle of the second sub-cone is The normal behavior trajectory cone is the union of these two sub-cones. If an operator's terminal direction vector makes an angle of 20° (<22.5°) with the first coordinate axis, it falls inside the first sub-cone and is considered a normal direction. If an operator's terminal direction makes an angle of only 5° with the evenly divided diagonal direction (far from all coordinate axis directions), it falls outside all sub-cones, and the angle deviation is positive, indicating that its operation distribution pattern deviates from all known normal patterns.

[0166] Calculate the minimum angular deviation of the target operator's terminal direction vector from the normal behavior trajectory cone. The calculation method is as follows: calculate the angle between the target operator's terminal direction vector and the axis of each sub-cone in the normal behavior trajectory cone, subtract the half-cone angle of the corresponding sub-cone, and take the minimum value among all sub-cones. If the minimum value ≤ 0, it means the target operator's terminal direction falls inside at least one sub-cone, and the angular deviation is set to 0. If the minimum value > 0, it means the target operator's terminal direction falls outside all sub-cones, and the angular deviation is a positive value.

[0167] The angular deviation is normalized by dividing the angular deviation by 90° to obtain the normalized angular deviation, with a value ranging from 0 to 1. Simultaneously, other components in the trajectory geometric feature vector are also normalized. The terminal heading deflection angle is normalized by subtracting the terminal heading deflection angle from the value of the maximum possible deflection angle (1). This normalization ensures that the smaller the deflection angle (the more fragmented), the larger the normalized value, consistent with the direction of risk growth. The average trajectory curvature is normalized by dividing it by 90°. These three normalized feature values—normalized angular deviation, normalized terminal heading deflection, and normalized average trajectory curvature—are combined into a three-dimensional composite deviation vector. The composite deviation vector as a whole characterizes the comprehensive degree of deviation of the target operator's trajectory behavior pattern from the normal behavior trajectory cone. Its three components characterize the level of abnormality from three aspects: the degree of directional deviation, the uniformity of operation distribution, and the frequency of switching. The composite deviation vector is not calculated separately here, but is treated as a whole and then summed together with the escape penetration depth in a unified weighted manner to generate a comprehensive risk score.

[0168] The comprehensive risk score is obtained by weighting and summing the normalized values ​​of escape penetration depth, angle deviation (included in the composite deviation), terminal heading deflection angle, and average trajectory curvature. The weight coefficients are determined as follows: initial weights are set by safety management personnel based on experience during the initial system deployment; after accumulating sufficient labeled samples, known fragmented leakage case data and normal operation data are used as training samples. Logistic regression or other linear discriminant methods are used to learn the contribution of each feature to fragmented behavior judgment, and the learned coefficients are normalized and used as weights. The weight coefficients of each indicator are set by safety management personnel based on business experience. In this embodiment, the default settings are: escape penetration depth weight 0.35, angle deviation weight 0.25, heading deflection angle weight 0.25, and average curvature weight 0.15, with a total weight of 1.

[0169] Tiered alerts are issued based on a comprehensive risk score. In this embodiment, a high-risk threshold of 0.75 and a medium-risk threshold of 0.45 are set. If the comprehensive risk score is greater than or equal to the high-risk threshold, a high-risk alert signal is generated, triggering immediate account freezing and operation blocking. Simultaneously, a high-priority work order is automatically issued to the security management team via the SOAR work order platform for handling. If the comprehensive risk score is greater than or equal to the medium-risk threshold but less than the high-risk threshold, a medium-risk alert signal is generated, and the operator is marked as a suspicious person and transferred to a manual review queue for further investigation and verification by a security analyst. If the comprehensive risk score is less than the medium-risk threshold, only the operator's fragmented camouflage markers, trajectory geometric features, and comprehensive risk score are recorded in the risk log for subsequent traceability analysis. The high-risk and medium-risk thresholds are set based on the following: In the initial stage of system deployment, comprehensive risk scores are calculated using known fragmented leakage case data and confirmed normal operation data. Score distribution curves for the two types of samples are plotted. The high-risk threshold is selected based on a score that results in a fragmented leakage sample recall rate of over 95% and a normal sample false alarm rate of less than 1%. Similarly, the medium-risk threshold is selected based on a score that results in a fragmented leakage sample recall rate of over 99% and a normal sample false alarm rate of less than 5%. During system operation, the threshold settings can be further optimized based on actual alarm handling results.

[0170] By constructing a normal behavior trajectory cone, a quantitative benchmark for normal operating patterns was established, transforming the judgment of fragmented behavior from absolute threshold assessment to deviation evaluation relative to the normal group. The comprehensive risk score integrates information from both the frequency of exceedances in the spatial dimension and the degree of abnormality in behavioral patterns in the temporal dimension, making it more accurate and reliable than single-dimensional judgments. A tiered alarm mechanism ensures that high-risk behaviors receive immediate response, medium-risk behaviors are manually reviewed, and low-risk behaviors are recorded and traced, achieving a rational allocation of security resources.

[0171] Compared to existing auditing techniques that rely solely on static anomaly detection based on operation frequency statistics, step S30 introduces various mathematical tools such as random walk path embedding and differential geometric curvature analysis to achieve multi-dimensional geometric feature analysis of the temporal patterns of operational behavior. The normal behavior trajectory cone transforms anomaly judgment from absolute threshold judgment to directional deviation assessment relative to the normal group, enabling the detection results to automatically adapt to the operational habits of different roles—operators primarily using NumberQuery and those primarily using CustomerSearch have different normal trajectory directions, each covered by different sub-cones, preventing false alarms as fragmented behavior due to different entry points. Compared to existing auditing systems that can only detect explicit leakage behaviors such as batch export and data download, the method of this invention can effectively detect implicit leakage behaviors through semantically equivalent fragmentation transformation, filling a significant detection blind spot in the operator's CRM system auditing system.

[0172] The three main steps of this invention follow a strict data flow logic. Step S10 takes the CRM system's operation log set and system configuration information as input, and outputs a semantic equivalence class mapping table and a cross-type aggregation threshold. Step S20 takes the semantic equivalence class mapping table and cross-type aggregation threshold output from Step S10, as well as the target operator's operation records within the statistical window, and outputs fragmentation camouflage markers and escape penetration depth. Step S30 takes the fragmentation camouflage markers and escape penetration depth output from Step S20, as well as the target operator's operation records during the complete observation period and the operation records of historical normal operator groups, and outputs a comprehensive risk score and a graded alarm signal. The output of each step strictly serves as the input for the next step; the three steps are interconnected, forming a complete fragmentation camouflage leakage behavior detection and alarm processing chain.

[0173] Example 2

[0174] A log behavior analysis and security protection system for operators is provided, which includes a semantic clustering module, an escape detection module, and an analysis and alarm module.

[0175] The semantic equivalence clustering module is used to extract the access relationship of each operation type to sensitive data fields in the CRM system operation log, construct a weighted information access fingerprint vector and span it to form an information access fingerprint space, calculate the semantic affinity matrix and perform semantic equivalence clustering, and generate a semantic equivalence class mapping table and cross-type aggregation threshold.

[0176] The escape detection module is used to construct an independent threshold hypercube and an aggregated intent simplex in the operation frequency space according to the semantic equivalence class mapping table and cross-type aggregation threshold, calculate the geometric difference between the two to generate an escape crescent domain, verify the topological inclusion relationship between the target operator's operation frequency vector and the escape crescent domain, and generate a fragmented camouflage marker and escape penetration depth if it falls into the range.

[0177] The analysis alarm module extracts the cumulative operation trajectory curve of the target operator carrying the fragmented camouflage mark and calculates the trajectory geometric feature vector. It constructs a normal behavior trajectory cone and calculates the composite deviation of the trajectory geometric feature vector relative to the normal behavior trajectory cone. Combined with the escape penetration depth, it generates a comprehensive risk score to trigger an alarm.

[0178] This embodiment also provides an electronic device, including a processor and a memory. The memory stores computer-readable instructions, which, when executed by the processor, cause the processor to perform all the steps of the aforementioned log behavior analysis and security protection method for operators. The electronic device can be a server, a workstation, or a dedicated computing device deployed in an operator's intranet environment. In this embodiment, the electronic device is deployed in the operator's intranet environment, and all data processing is completed within the intranet, without involving any external data transmission, ensuring the security and privacy of user data.

[0179] This embodiment also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements all the steps of the aforementioned log behavior analysis and security protection method for operators. The computer-readable storage medium includes, but is not limited to, random access memory, read-only memory, flash memory, hard disk drive, or optical disk, or any medium capable of storing computer program code.

[0180] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0181] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0182] The foregoing description is illustrative of the invention and should not be construed as limiting it. Although several exemplary embodiments of the invention have been described, those skilled in the art will readily understand that many modifications can be made to the exemplary embodiments without departing from the novel teachings and advantages of the invention. Therefore, all such modifications are intended to be included within the scope of the invention as defined in the claims. It should be understood that the foregoing description is illustrative of the invention and should not be construed as limiting it to the specific embodiments disclosed, and modifications to the disclosed embodiments and other embodiments are intended to be included within the scope of the appended claims. The invention is defined by the claims and their equivalents.

Claims

1. A method for operator-oriented log behavior analysis and security protection, characterized in that, The method includes: Extract the access relationships of each operation type to sensitive data fields in the CRM system operation log, construct a weighted information access fingerprint vector and span it to form an information access fingerprint space, calculate the semantic affinity matrix and perform semantic equivalence clustering, and generate a semantic equivalence class mapping table and cross-type aggregation threshold; Based on the semantic equivalence class mapping table and cross-type aggregation threshold, an independent threshold hypercube and an aggregation intent simplex are constructed in the operation frequency space. The geometric difference set is calculated to generate the escape crescent domain, the topological inclusion relationship is verified, and fragmentation camouflage markers and escape penetration depth are generated. Extract the cumulative operation trajectory curve of the target operator carrying the fragmented camouflage mark and calculate the trajectory geometric feature vector. Construct a normal behavior trajectory cone and calculate the composite deviation of the trajectory geometric feature vector relative to the normal behavior trajectory cone. Combine the escape penetration depth to generate a comprehensive risk score and trigger an alarm.

2. The method of claim 1, wherein the method further comprises: The steps for constructing the weighted information access fingerprint vector and spanning the information access fingerprint space are as follows: Extract the set of sensitive fields from the CRM system and assign sensitivity weight values ​​to generate a sensitivity weight vector; extract the set of operation types and trace the execution path to construct a binary raw access vector; The binary original access vector is multiplied element-wise with the sensitivity weight vector to generate a weighted information access fingerprint vector, and the non-zero weighted information access fingerprint vector spans the information access fingerprint space.

3. The log behavior analysis and security protection method for operators according to claim 2, characterized in that, The steps for generating the sensitivity weight vector are as follows: Sensitive fields are divided into three basic levels according to legal compliance sensitivity categories: direct user identification fields, indirect user association fields, and business attribute fields. Within each basic level, secondary weight allocation is performed based on the information recovery capability of a single field, and the sensitivity weight value of each sensitive field is output to form the sensitivity weight vector.

4. The method of claim 3, wherein the method further comprises: The steps for calculating the semantic affinity matrix and performing semantic equivalence clustering are as follows: In the information access fingerprint space, the cosine similarity of the weighted information access fingerprint vectors is calculated to generate a semantic affinity matrix; Based on the semantic affinity matrix and the preset semantic equivalence determination threshold, a semantic affinity undirected graph is constructed, the average node degree is calculated and adaptive density control is performed, and the optimized semantic affinity undirected graph is output.

5. The method of claim 4, wherein the method further comprises: The steps for generating the semantic equivalence class mapping table and the cross-type aggregation threshold are as follows: The optimized semantic affinity undirected graph is subjected to a connected component decomposition algorithm to generate a set of semantic equivalence classes. For each semantic equivalence class, its aggregation information access fingerprint vector is extracted and a basic aggregation threshold is determined by combining it with a preset risk level comparison table. The fragmentation reduction coefficient is calculated based on the number of members and the basic aggregation threshold is reduced. The semantic equivalence class mapping table and the corresponding cross-type aggregation threshold are output.

6. The method of claim 5, wherein the method further comprises: The calculation steps for the fragmentation reduction factor are as follows: The number of non-zero components in the aggregated information access fingerprint vector is counted and its ratio to the total number of sensitive fields is calculated to generate an information access width ratio. Based on the preset value range of the information access width ratio, the fragmentation reduction coefficient is mapped to a high reduction value, a medium reduction value, or a low reduction value.

7. The method of claim 1, wherein the method further comprises: The construction steps of the independent threshold hypercube are as follows: extracting comprises A target semantic equivalence class of an operation type and a corresponding independent alarm threshold value are determined, and An origin is taken as a vertex and each independent alarm threshold value is taken as an edge length in a dimension operation frequency space to construct an independent threshold hypercube.

8. The method of claim 7, wherein the method further comprises: The steps for generating fragmented camouflage markers and escape penetration depth are as follows: In the In the frequency space of operations, the cross-type aggregation threshold is used as the intercept constraint to construct the aggregation intent simplex; the relationship between the cross-type aggregation threshold and the sum of all independent alarm thresholds is verified, and if there is an overflow space, it is confirmed that there is an escape space.

9. The method of claim 8, wherein the method further comprises: The steps of generating fragmented camouflage markers and escape penetration depth also include: Calculate the set-theoretic difference between the independent threshold hypercube and the aggregation intention simplex to generate the escape crescent domain; If the target operator If the frequency vector of operations satisfies the independent threshold constraints for each component and violates the cross-type aggregation threshold constraint, then it is determined that it falls into the escape crescent domain, the fragmented camouflage label is output, and the calculation is performed. The escape penetration depth is output by taking the signed vertical distance from the frequency vector of the operation to the inclined simplex section of the aggregation intention.

10. The method of claim 1, wherein the method further comprises: The steps for calculating the geometric feature vector of the trajectory are as follows: The standard basis vectors of the operation events are successively accumulated according to the operation timestamp order to generate the piecewise linear cumulative operation trajectory curve; Calculate the terminal direction vector of the cumulative operation trajectory curve and the terminal heading deflection angle of the diagonal direction, calculate the mean of the direction change angles of adjacent line segments to generate the average trajectory curvature, and combine and output the trajectory geometric feature vector.

11. The method of claim 10, wherein the method further comprises: The steps for generating a comprehensive risk score are as follows: Extract the set of terminal direction vectors of historical normal operator groups, perform spherical clustering, obtain the main direction clusters, and combine them with preset safety expansion factors to construct normal behavior trajectory cones; The minimum angular deviation of the terminal direction vector of the trajectory geometric feature vector to the normal behavior trajectory cone is calculated and normalized to obtain the composite deviation. The escape penetration depth and the composite deviation are weighted and summed to output a comprehensive risk score.

12. The method of claim 11, wherein the method further comprises: The steps for constructing the normal behavior trajectory cone are as follows: Project the set of terminal direction vectors of the historical normal operator group onto the unit hypersphere, and use the spherical K-Means algorithm to perform iterative clustering, outputting the cluster center and the corresponding angular scatter radius; Abnormal operation pattern clusters are removed, and multiple normal behavior trajectory sub-cones are constructed with the remaining cluster centers as axes and the product of the angular scattering radius and the preset safety expansion factor as the half-cone angle. The normal behavior trajectory cone is then output as a set.

13. An operator-facing log behavior analysis and security protection system, characterized in that, The method for performing log behavior analysis and security protection for operators according to any one of claims 1-12 includes: The semantic equivalence clustering module extracts the access relationships of each operation type to sensitive data fields in the CRM system operation log, constructs a weighted information access fingerprint vector and spans it into an information access fingerprint space, calculates the semantic affinity matrix and performs semantic equivalence clustering, and generates a semantic equivalence class mapping table and cross-type aggregation threshold. The escape detection module constructs an independent threshold hypercube and an aggregated intent simplex in the operation frequency space based on the semantic equivalence class mapping table and cross-type aggregation threshold, calculates the geometric difference set to generate the escape crescent domain, verifies the topological inclusion relationship, and generates fragmented camouflage markers and escape penetration depth. The analysis alarm module extracts the cumulative operation trajectory curve of the target operator carrying the fragmented camouflage mark and calculates the trajectory geometric feature vector. It constructs a normal behavior trajectory cone and calculates the composite deviation of the trajectory geometric feature vector relative to the normal behavior trajectory cone. Combined with the escape penetration depth, it generates a comprehensive risk score to trigger an alarm.

Images