Method for detecting abnormal operation behavior of user and related device

Abstract

The application provides an abnormal operation behavior detection method for a user and related equipment, the method comprising: obtaining operation attribute information generated by the user when accessing an application this time, and splitting the operation attribute information to obtain a plurality of short operation attribute information; performing operation topology coding on the plurality of short operation attribute information to obtain a topology feature matrix; performing time interval coding on the plurality of short operation attribute information to obtain a time sequence feature matrix; determining an operation abnormal score of the user based on the topology feature matrix and the time sequence feature matrix; and in response to determining that the operation abnormal score is greater than a predetermined abnormal score, determining that the user has an abnormal operation behavior when accessing the application this time, thereby solving the technical problem that the existing technology does not accurately detect the abnormal operation behavior of the user, and improving the detection capability for complex abnormal behaviors such as process skipping and rhythm abnormality.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and related equipment for detecting abnormal user behavior. Background Technology

[0002] With the deepening development of mobile internet and digital transformation, the user base and frequency of operation of various new business systems and related applications have exploded. Users generate massive amounts of operational behavior every day while using e-commerce and other business applications. At the same time, various security issues are becoming increasingly prominent. Users may perform abnormal behaviors due to subjective or unintentional misoperations, thereby affecting the normal operation of business systems and even leading to serious consequences such as data leakage.

[0003] In traditional fixed-process business applications (such as the linear process of "browse → add to cart → pay" in early e-commerce websites), user operation paths are relatively simple, and the difficulty of detecting abnormal behavior is relatively low. Effective compliance baselines can be established using methods such as Markov chains or frequent pattern mining. However, in modern new business systems, there are multiple business applications (web applications or mobile apps), and user operation paths are highly flexible and unstructured. There can be hundreds of operation types, each with multi-dimensional attributes such as operation time, execution environment, and business parameters. This increased complexity directly leads to a significant difference in the difficulty of anomaly detection. In fixed-process scenarios, most anomalies (such as multiple incorrect password entries in a short period) can be intercepted based on single-point thresholds or simple sequence rules. However, in new business systems, a single operation itself may be completely compliant (such as a normal "release" operation), but its context (such as the lack of a "test" step) or time rhythm (such as continuous execution at millisecond levels) may expose malicious intent, making it difficult for traditional methods to effectively identify abnormal user behavior. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose a method and related equipment for detecting abnormal user behavior, so as to overcome all or part of the shortcomings of the prior art.

[0005] To achieve the above objectives, this application provides a method for detecting abnormal user behavior, comprising: acquiring operation attribute information generated by the user during the current access to the application, and segmenting the operation attribute information to obtain multiple short operation attribute information; performing operation topology encoding on the multiple short operation attribute information to obtain a topology feature matrix; performing temporal interval encoding on the multiple short operation attribute information to obtain a temporal feature matrix; determining the user's operation anomaly score based on the topology feature matrix and the temporal feature matrix; and determining that the user has engaged in abnormal operation behavior during the current access to the application in response to determining that the operation anomaly score is greater than a predetermined anomaly score.

[0006] Optionally, the step of performing operational topological encoding on the plurality of short operation attribute information to obtain a topological feature matrix includes: performing positional encoding on the plurality of short operation attribute information using a predetermined positional encoding matrix to obtain a short operation attribute code corresponding to each short operation attribute information, wherein each short operation attribute code carries its corresponding positional information; performing feature extraction on each short operation attribute code using an alternating attention mechanism to obtain an operational topological feature corresponding to each short operation attribute code; and concatenating and merging all operational topological features to obtain the topological feature matrix.

[0007] Optionally, the step of using an alternating attention mechanism to extract features from each short operation attribute code to obtain the operation topology features corresponding to each short operation attribute code includes: for each short operation attribute code, using each attention head in a multi-head attention mechanism to extract the topology dependency features of the short operation attribute code from all short operation attribute codes, and concatenating the topology dependency features of each attention head to obtain the concatenated topology features of the short operation attribute code; and using a single-head attention mechanism to map and reduce the dimensionality of the concatenated topology features to obtain the operation topology features of the short operation attribute code.

[0008] Optionally, the short operation attribute information includes multiple first operation types and operation timestamps corresponding to each first operation type; the step of temporally interval encoding the multiple short operation attribute information to obtain a temporal feature matrix includes: taking two adjacent first operation types in the short operation attribute information as operation type combinations; for each operation type combination, determining the time interval corresponding to the operation type combination based on the operation timestamps corresponding to each first operation type in the operation type combination; performing logarithmic compression normalization on the time interval to obtain a compressed time, and replacing the larger of the two operation timestamps corresponding to the operation type combination with the compressed time to obtain updated short operation attribute information; using all the updated short operation attribute information as temporal data, and using a two-layer long short-term memory network to extract the sequence feature matrix corresponding to each time step of the temporal data; performing dimensional alignment and merging on the sequence feature matrix of each time step to obtain the temporal feature matrix.

[0009] Optionally, determining the user's operation anomaly score based on the topological feature matrix and the temporal feature matrix includes: mapping, aligning, and fusing the topological feature matrix and the temporal feature matrix to obtain a joint latent space representation matrix; using a gated recurrent unit with a self-attention mechanism to decode the joint latent space representation matrix step-by-step to obtain the spatiotemporal joint state features for each time step; performing dimensional mapping and classification prediction on the spatiotemporal joint state features for each time step to obtain the probability distribution of predicted operation attribute information for each time step; and determining the operation anomaly score based on the probability distribution of predicted operation attribute information for each time step.

[0010] Optionally, the mapping, alignment, and fusion of the topological feature matrix and the temporal feature matrix to obtain the joint latent space representation matrix includes: performing attention-weighted mapping on the topological feature matrix to obtain a topological attention feature matrix; performing attention-weighted mapping on the temporal feature matrix to obtain a temporal attention feature matrix; concatenating the topological attention feature matrix and the temporal attention feature matrix to obtain a concatenated attention feature matrix; segmenting the concatenated attention feature matrix along a predetermined feature dimension to obtain a segmented topological feature matrix and a segmented temporal feature matrix; performing element-wise multiplication on the segmented topological feature matrix and the topological feature matrix to obtain a multiplied topological feature matrix; performing element-wise multiplication on the segmented temporal feature matrix and the temporal feature matrix to obtain a multiplied temporal feature matrix; concatenating the multiplied topological feature matrix and the multiplied temporal feature matrix to obtain a concatenated multiplied feature matrix; and performing dimensionality reduction processing on the concatenated multiplied feature matrix using a predetermined activation function to obtain the joint latent space representation matrix.

[0011] Optionally, the operation attribute information includes a second operation type corresponding to at least one operation dimension for each time step; determining the operation anomaly score based on the probability distribution of the predicted operation attribute information for each time step includes: for each time step, classifying the predicted operation attribute information corresponding to the time step according to the operation dimension to obtain predicted operation attribute information corresponding to at least one operation dimension; for each operation dimension corresponding to the time step, searching for the predicted probability corresponding to the second operation type in the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension as the second operation type corresponding to the time step; searching for at least one predicted probability greater than or equal to the predicted probability corresponding to the second operation type in the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension; calculating the sum of the at least one predicted probability; summing the predicted probabilities corresponding to all operation dimensions to obtain the sub-operation anomaly score of the time step; arranging the sub-operation anomaly scores of all time steps in descending order to obtain a sequence containing multiple sub-operation anomaly scores; selecting a predetermined number of sub-operation anomaly scores in the sequence in order from front to back, and calculating the average sum of the predetermined number of sub-operation anomaly scores to obtain the operation anomaly score.

[0012] Based on the same inventive concept, this application also provides a device for detecting abnormal user operation behavior, comprising: an acquisition module configured to acquire operation attribute information generated by the user during the current access to the application, and segment the operation attribute information to obtain multiple short operation attribute information; a first encoding module configured to perform operation topology encoding on the multiple short operation attribute information to obtain a topology feature matrix; a second encoding module configured to perform temporal interval encoding on the multiple short operation attribute information to obtain a temporal feature matrix; a first determination module configured to determine the user's operation abnormality score based on the topology feature matrix and the temporal feature matrix; and a second determination module configured to determine that the user has engaged in abnormal operation behavior during the current access to the application in response to determining that the operation abnormality score is greater than a predetermined abnormality score.

[0013] Based on the same inventive concept, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method described above when executing the computer program.

[0014] Based on the same inventive concept, this application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing a computer to perform the method described above.

[0015] As can be seen from the above, the user abnormal operation behavior detection method and related equipment provided in this application include obtaining operation attribute information generated by the user during the current access to the application, incorporating multi-dimensional operation fields, and making up for the deficiency of missing data in traditional methods. The operation attribute information is then segmented to obtain multiple short operation attribute information, adapting to complex operation scenarios of ultra-long sessions and reducing the complexity of processing single data entries. Operation topology encoding is performed on the multiple short operation attribute information to obtain a topology feature matrix. This characterizes the connection relationship of operation nodes and business behavior links from the topological structure dimension, effectively identifying structural hidden anomalies such as reversed operation order, missing key processes, and disordered business logic. Simultaneously, discrete operation behaviors and multi-dimensional attributes are transformed into a standardized and computable matrix form, providing stable structural feature support for anomaly discrimination. Temporal interval encoding is performed on the multiple short operation attribute information to obtain a temporal feature matrix. By using temporal interval encoding, user behavior patterns across time dimensions, such as operation speed, millisecond-level continuous operations, and abnormally long dwell times, can be quantified and mined. This transforms disordered temporal attributes into a unified temporal feature matrix, compensating for the shortcomings of topological structures that only represent business logic and lack dynamic temporal features, thus enriching the dimensions of behavioral representation. Based on the topological feature matrix and the temporal feature matrix, a user's operation anomaly score is determined. By fusing structural-level business logic features and temporal-level time interval features, the degree of deviation in user operation behavior can be comprehensively quantified and evaluated, determining an accurate operation anomaly score and enabling reliable identification of abnormal user behavior under unstructured, highly flexible operation paths in new business systems. Upon determining that the operation anomaly score is greater than a predetermined anomaly score, it is determined that the user engaged in abnormal operation behavior during the current application access. Employing a threshold comparison method enables automated discrimination, unifies the anomaly judgment scale, and quickly identifies hidden abnormal user operations. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the abnormal user behavior detection method according to an embodiment of this application.

[0018] Figure 2 This is a schematic diagram illustrating the training and detection process of the detection model in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a user's abnormal operation behavior detection device according to an embodiment of this application; Figure 4This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0020] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0021] As described in the background section, with the deepening development of mobile internet and digital transformation, the user base and frequency of operation of various new business systems and related applications have experienced explosive growth. Users generate massive amounts of operational behavior every day while using e-commerce and other business applications. At the same time, various security issues are becoming increasingly prominent. Users may perform abnormal behaviors due to subjective or unintentional misoperations, thereby affecting the normal operation of business systems and even leading to serious consequences such as data leaks. However, during the system construction phase, there is a common problem of "emphasizing functionality while neglecting security." Security protection capabilities are not embedded synchronously during development, and security mechanisms often lag behind feature deployment, making them vulnerable to exploitation by attackers.

[0022] User behavior anomaly detection is a core technology in business security. In traditional fixed-process business applications (such as the linear process of "browse → add to cart → pay" in early e-commerce websites), user operation paths are relatively simple, and anomaly detection is relatively easy. Effective compliance baselines can be established using methods such as Markov chains or frequent pattern mining. However, in modern new business systems, there are multiple business applications (web applications or mobile apps), and user operation paths are highly flexible and unstructured. There can be hundreds of operation types, and each operation includes multi-dimensional attributes such as operation time, execution environment, and business parameters. This increased complexity directly leads to a significant difference in the difficulty of anomaly detection. In fixed-process scenarios, most anomalies (such as multiple incorrect password entries in a short period of time) can be intercepted based on single-point thresholds or simple sequence rules. However, in new business systems, a single point of operation may be completely compliant (such as a normal "release" operation), but its context (such as the lack of a "test" step) or time rhythm (such as continuous execution at millisecond levels) may expose malicious intent, making it difficult for traditional methods to effectively identify abnormal user behavior.

[0023] In recent years, academia and industry have proposed many methods for detecting user behavior anomalies. Based on whether they rely on predefined business processes, these methods can be broadly categorized into two types: 1) methods with predefined processes and methods without predefined processes. Methods with predefined processes typically require business experts to pre-draw standard operation flowcharts or define frequent sub-sequence patterns. For example, in an e-commerce scenario, "search → add to cart → place order → payment" is defined as the normal path. These methods identify anomalies by comparing the user's actual sequence with the predefined process, effectively detecting anomalies such as process jumps and missing steps. However, their limitations are also obvious. The construction of predefined processes relies on human experience and is difficult to cover long-tail scenarios. Furthermore, when business systems are flexible and changeable, predefined processes are difficult to update in a timely manner, leading to a decline in detection capabilities. 2) Methods without pre-defined processes do not rely on manually defined business processes. Instead, they automatically learn statistical patterns or time series patterns of user behavior from historical normal data. Common techniques include clustering-based methods (such as Isolation Forest and DBSCAN (Density-Based Spatial Clustering of Applications with Noise)), which cluster normal behaviors into clusters and identify points far from all clusters as anomalous; sequence prediction-based methods (such as LSTM (Long Short-Term Memory) and Transformer), which predict the probability of the next event and identify low-probability sequences as anomalous; and reconstruction-based methods (such as autoencoders), which train reconstruction models using normal data, but have larger reconstruction errors for anomalous samples.

[0024] Currently, techniques for detecting user behavior anomalies without pre-defined workflows mainly fall into two categories: methods based on operation type sequences and methods based on single-point attribute thresholds. Methods based on operation type sequences focus on sequence prediction models (such as LSTM and Transformer) and sequence autoencoders (such as LSTM-AE (Long Short-Term Memory Autoencoder)). These methods extract event types from user operation logs into discrete symbol sequences, train the model to predict the next event or reconstruct the complete sequence, and use the reconstruction error or the negative logarithm of the prediction probability as the anomaly score. This method does not rely on pre-defined business processes and can automatically learn the transition patterns between operations from normal data. Methods based on single-point attribute thresholds focus on the numerical attributes carried by each operation. Using unsupervised algorithms such as statistical thresholding or isolated forests, single operations that deviate from the normal distribution are judged as anomalies. These methods are simple and efficient, and are suitable for detecting point anomalies such as numerical mutations and frequency mutations.

[0025] In addition, a few methods attempt to combine sequence order with time intervals, such as concatenating time difference features into LSTM inputs or using Hawkes processes to model event intensity. However, these methods still supplement the sequence of operation types and fail to systematically integrate multidimensional operation attributes with temporal rhythms.

[0026] Traditional user behavior anomaly detection technologies for business applications without pre-defined workflows have the following shortcomings: 1) Most methods only utilize operation types and lack joint modeling of multi-dimensional attributes, resulting in the missed detection of some abnormal behaviors that cannot be distinguished by operation type alone; 2) Insufficient ability to model the time rhythm between operations, often simply splicing time intervals or discretizing them into "fast / slow" categories, making it difficult to accurately depict the essential difference between the natural rhythm of manual operations (second-level to minute-level thinking intervals) and the abnormal rhythm of automated scripts (millisecond-level continuous execution), resulting in low sensitivity to high-frequency attack detection; 3) Local anomalies are easily diluted in long sessions. When a session lasts for hundreds or thousands of steps, the signals of a few abnormal steps can be masked by the average of a large number of normal steps, leading to missed detections; 4) Lack of joint review of "business compliance" and "time rhythm rationality". Existing methods either only focus on the operation sequence or only focus on the time interval, failing to align the two in the same implicit space. Composite anomalies in actual business (such as rapid execution after bypassing approval) are difficult to detect by single-dimensional detection.

[0027] While methods with and without pre-defined processes have addressed the challenge of pre-setting processes to some extent, they still have shortcomings in the high-degree-of-freedom scenarios of new business systems. On one hand, most methods only utilize the sequence of operation types, ignoring other attributes carried by the operations, which are often key to determining the compliance of user behavior. On the other hand, existing methods provide relatively coarse modeling of the temporal rhythm between operations, making it difficult to effectively distinguish between the normal rhythm of manual operations and the abnormally high-frequency behavior of automated scripts. Furthermore, user sessions may last for hundreds of steps, while anomalies often only involve a few steps; using global average reconstruction error can easily dilute local anomaly signals, leading to missed detections. These shortcomings result in inaccurate detection of abnormal user behavior.

[0028] In view of this, embodiments of this application propose a method for detecting abnormal user behavior, referring to... Figure 1 This includes the following steps: Step 101: Obtain the operation attribute information generated by the user during the current access to the application, and segment the operation attribute information to obtain multiple short operation attribute information.

[0029] In this step, with the deepening development of mobile internet and digital transformation, various new business systems have emerged. These new systems differ from traditional business systems with fixed linear processes and single operation paths. They feature non-linear operation processes and diversified operation paths, making them highly flexible in operation paths, unstructured in business processes, multi-dimensional in operation, and multi-dimensional in behavioral attributes. To detect abnormal user behavior, this paper obtains the operation attribute information generated by the user during their current application visit. The application can be any application within the new business system, and the current application visit can be from the moment the user starts and enters the application until the current detection time. The operation attribute information can be user operation logs recorded within the application. Each log entry includes at least the following fields: user identifier, operation type, operation timestamp, and business attribute information. Business attribute information includes, but is not limited to, resource identifier, operation object type, and operation result status. Most existing anomaly detection methods only use pure operation type sequence modeling, relying solely on single behavioral tags such as clicks, browsing, and publishing. This application comprehensively collects all operation attribute information from the moment the user enters the application until the current detection time, incorporating multi-dimensional operation fields, thus overcoming the data deficiency of traditional methods.

[0030] Before acquiring the user's operation attribute information during the current application visit, the application's raw log data is grouped according to user identifiers and sorted in ascending order by timestamp to form a user-level operation attribute sequence, i.e., the user's operation attribute information (i.e., a detection instance). Outliers or missing values ​​in the user's operation attribute information are preprocessed using methods such as deletion, imputation, or interpolation to ensure the stability of subsequent modeling.

[0031] Before performing topological encoding on multiple short operation attribute information, the operation attribute information is converted into a target structure. The outermost layer of the target structure contains global information for the current access, such as session ID and user ID. The inner layer is divided into two parts: one part contains session attributes, including some basic user information, and the other part contains all operation records of the session user. These operations are arranged in ascending order of time, and each operation contains attribute information for that behavior, recording the name, time, etc., of each operation. The original operation sequence X=[x] can be obtained through the above structure model. _1 ,x _2 ,…,x _N ], where N may be hundreds or even thousands of steps long.

[0032] During a user's initial application visit, multiple operations may be performed over a prolonged period, resulting in an extremely long session. To accommodate the characteristics of such long sessions in new business systems, this application segments the operation attribute information into multiple shorter operation attribute information segments. Specifically, a local context segmentation mechanism based on a sliding window is introduced. By setting a window size and a sliding step size, the operation attribute information is segmented into multiple shorter operation attribute information segments. For example, a local context segmentation mechanism based on a sliding window is introduced, setting a window size L and a sliding step size S to segment the operation attribute information into multiple shorter operation attribute information segments with overlap. A window overlap mechanism ensures that the sequence of business actions is not fragmented. Each window contains L consecutive operations, forming the basic unit for subsequent modeling. The window size and sliding step size are set based on historical experience. For example, the window size L is set according to the length of typical intent segments in the business scenario (e.g., 5-500), and the step size is usually set to L / 2 to ensure smooth transitions between windows. When the sequence length is less than L, forward padding or discarding is used.

[0033] To adapt to the characteristics of ultra-long sessions in new business systems where user session operations can reach hundreds or even thousands of steps, and to avoid the local abnormal features being easily submerged due to direct global long sequence modeling, this application uses a sliding window mechanism to segment the complete operation attribute information containing multi-dimensional behavioral attributes, obtaining multiple short operation attribute information. This adapts to the complex operation scenarios of ultra-long sessions, reduces the processing complexity of a single data item, and focuses on local context fragments in subsequent processing. It can accurately capture hidden anomalies in the timing of adjacent operations and attribute associations, avoiding the problem that global modeling of long sequences easily weakens local behavioral features.

[0034] Step 102: Perform operational topology encoding on the multiple short operational attribute information to obtain a topology feature matrix.

[0035] In this step, operational topology encoding is performed on multiple short operation attribute information to obtain a topology feature matrix. User operations exhibit topological constraints such as business jumps, sequential dependencies, and logical connections. Simply relying on the original operation sequence cannot characterize this structured relationship; therefore, operational topology encoding of short operation attribute information is necessary. This topological encoding characterizes the connection relationships between operation nodes and business behavior links, effectively identifying structural hidden anomalies such as reversed operation order, missing key processes, and disordered business logic. Simultaneously, it transforms discrete operation behaviors and multidimensional attributes into a standardized and computable matrix form, providing stable structural feature support for anomaly detection.

[0036] Step 103: Perform time-series interval encoding on the multiple short operation attribute information to obtain a time-series feature matrix.

[0037] In this step, multiple short operation attribute information is encoded using temporal interval encoding to obtain a temporal feature matrix. User operation behavior also possesses temporal rhythm features such as operation interval, dwell time, and operation rate. To comprehensively mine multiple short operation attribute information, this application also introduces temporal interval encoding. Through temporal interval encoding, time-dimensional behavioral patterns such as user operation speed, millisecond-level continuous operations, and abnormally long dwell times can be quantitatively mined, transforming disordered time attributes into a unified temporal feature matrix. This compensates for the shortcomings of topological structures that only represent business logic and lack dynamic temporal features, enriching the dimensions of behavioral representation.

[0038] Step 104: Determine the user's operation anomaly score based on the topological feature matrix and the temporal feature matrix.

[0039] In this step, user operation anomaly scores are determined based on the topological feature matrix and the temporal feature matrix, taking into account both business topology anomalies and temporal rhythm anomalies, thus avoiding the problems of one-sided judgment and easy misjudgment or omission by single feature discrimination. By integrating business logic features at the structural level and time interval features at the temporal level, the degree of deviation of user operation behavior can be comprehensively and quantitatively evaluated, and accurate operation anomaly scores can be determined, enabling reliable identification of user anomaly behavior under unstructured and highly flexible operation paths in new business systems.

[0040] Step 105: In response to determining that the operation anomaly score is greater than a predetermined anomaly score, determine that the user has engaged in abnormal operation behavior during the current access to the application.

[0041] In this step, if the anomaly score exceeds a predetermined anomaly score, it is determined that the user engaged in abnormal behavior during their current application visit. The location with the highest anomaly score is used as the location of the suspicious operation. The predetermined anomaly score is determined based on historical experience. For example, a dynamic threshold obtained from normal sample statistics during the training phase can be used as the predetermined anomaly score. Using threshold comparison enables automated discrimination, standardizes anomaly judgment criteria, and quickly identifies hidden abnormal user operations.

[0042] This application redefines the detection boundary and threat model of abnormal behavior, accurately pointing out that existing detection models based on control flow topology only focus on the operational logic structure and have an inherent blind spot that cannot identify abnormal behavior in time rhythm despite compliant topology structure. It makes up for the shortcomings of traditional models that ignore temporal features and are prone to diluting local abnormal signals, effectively expanding the research boundary and application scope of abnormal user behavior detection in scenarios without fixed preset business processes, and improving the accuracy of determining abnormal user operation behavior.

[0043] The above scheme acquires the operation attribute information generated by the user during the current application visit, incorporating it into multi-dimensional operation fields to overcome the shortcomings of traditional methods in detecting missing data. The operation attribute information is then segmented into multiple short operation attribute information segments, adapting to complex operation scenarios with ultra-long sessions and reducing the complexity of processing single data entries. Operation topology encoding is performed on these multiple short operation attribute information segments to obtain a topology feature matrix. This topology structure characterizes the connection relationships of operation nodes and business behavior links, effectively identifying structural hidden anomalies such as reversed operation order, missing key processes, and disordered business logic. Simultaneously, discrete operation behaviors and multi-dimensional attributes are transformed into a standardized and computable matrix form, providing stable structural feature support for anomaly detection. Temporal interval encoding is performed on these multiple short operation attribute information segments to obtain a temporal feature matrix. Temporal interval encoding allows for the quantification and mining of user operation speed, millisecond-level continuous operations, and abnormal long-term dwell time behavioral patterns, transforming disordered time attributes into a unified temporal feature matrix. This overcomes the shortcomings of topology structures, which only represent business logic and lack dynamic time features, enriching the dimensions of behavioral representation. Based on the topological feature matrix and the temporal feature matrix, a user's operation anomaly score is determined. By fusing business logic features at the structural level and time interval features at the temporal level, the degree of deviation of user operation behavior can be comprehensively and quantitatively evaluated, and an accurate operation anomaly score can be determined, enabling reliable identification of abnormal user behavior under unstructured, highly flexible operation paths in new business systems. In response to determining that the operation anomaly score is greater than a predetermined anomaly score, it is determined that the user engaged in abnormal operation behavior during the current application access. Using a threshold comparison method enables automated discrimination, unifies the anomaly judgment scale, and can quickly identify hidden abnormal user operations.

[0044] In some embodiments, the step of performing operational topological encoding on the plurality of short operational attribute information to obtain a topological feature matrix includes: performing positional encoding on the plurality of short operational attribute information using a predetermined positional encoding matrix to obtain a short operational attribute code corresponding to each short operational attribute information, wherein each short operational attribute code carries its corresponding positional information; performing feature extraction on each short operational attribute code using an alternating attention mechanism to obtain operational topological features corresponding to each short operational attribute code; and concatenating and merging all operational topological features to obtain the topological feature matrix.

[0045] In this embodiment, to compensate for the loss of absolute temporal information in the graph structure, it is necessary to perform positional encoding on multiple short operation attribute information. A predetermined positional encoding matrix is ​​used to assign unique and fixed positional representations to the multiple short operation attribute information. Positional encoding of the multiple short operation attribute information using the predetermined positional encoding matrix yields a short operation attribute code corresponding to each short operation attribute information. Each short operation attribute code carries its corresponding positional information, enabling the reconstruction of the temporal order of user operations. Specifically, the multiple short operation attribute information is converted into a predetermined-dimensional original node encoding matrix. The multiple short operation attribute information is an ordered sequence composed of the chronological order of operations. The original node encoding matrix is ​​a numerical matrix formed by converting each short operation attribute information in this ordered sequence into an encoded vector of a predetermined dimension and arranging them row by row according to the chronological order of the ordered sequence. Each node in each original node encoding matrix is ​​associated with a multi-dimensional attribute vector, which is composed of encoded attributes of each operation behavior concatenated together. Since short operation attribute information is discrete and heterogeneous semantic information, it cannot directly participate in neural network matrix operations and needs to be converted into a uniform numerical vector form.

[0046] The method for constructing the predetermined location coding matrix includes: determining the location coding value for each location using the following formula: (1) (2), where, and The code value for the position coding matrix PE is specified at a specified position and dimension in the matrix. Even-numbered feature dimensions use sine values ​​(i.e., formula (1)) and odd-numbered feature dimensions use cosine values ​​(i.e., formula (2)). Represents the first in the matrix The position i represents the i-th feature dimension of the matrix. The total feature dimension for encoding short operation attributes. All positional encoding values ​​are combined into a predetermined positional encoding matrix, for example, according to a predetermined rule that rows correspond to position indices and columns correspond to feature dimensions.

[0047] Typically, the number of rows in the predetermined position encoding matrix is ​​relatively large, which may not match the number of rows in the original node encoding matrix. Therefore, the predetermined position encoding matrix is ​​truncated based on the original node encoding matrix. By dynamically slicing, a position matrix that matches the actual number of rows n in the current original node encoding matrix is ​​extracted, achieving physical truncation and broadcast alignment.

[0048] The truncated predetermined position encoding matrix and the original node encoding matrix are fused to obtain the short operation attribute code corresponding to each short operation attribute information. The fusion of the truncated predetermined position encoding matrix and the original node encoding matrix is ​​performed using the following formula: (3), among which, A matrix containing the short operation attribute encodings corresponding to each short operation attribute information. The original node encoding matrix, This represents a pre-defined position encoding matrix of length L after truncation.

[0049] To fully capture the multidimensional business dependencies implicit in the operation sequence, this application employs a graph attention network with multi-attribute independent graph construction and multi-stream parallelism to encode the business topology. Based on the attribute encoding of each short operation, multiple independent sets of directed attribute subgraphs are constructed. Where M is the number of attribute dimensions included in the business operation. Each short operation attribute code is associated with a sub-value in the directed attribute subgraph set. Figure 1 One-to-one correspondence. For any subgraph Node V represents an operation within the window, and directed edges E represent the order of operations. In each specific subgraph... In this system, the initial features of a node are composed of only the business attributes of a single dimension after being embedded and encoded, thereby achieving physical isolation of different business semantic spaces at the topology graph level.

[0050] A pre-constructed graph attention encoder group, matching the number of attribute dimensions M, performs independent and parallel topological encoding on each subgraph. Each encoder uses a two-layer graph convolutional network (GATConv) to extract features: an alternating attention mechanism is used to extract topological features from the subgraph, obtaining the corresponding operational topological features. Different short operational attribute encodings exhibit strong heterogeneity; independent and parallel encoding avoids interference and improves efficiency. Furthermore, the alternating attention mechanism balances feature diversity and information refinement, enhancing the expressive power of complex topologies while effectively controlling oversmoothing and computational complexity. The alternating attention mechanism refers to the specific alternation pattern of attention configuration between the two layers of graph convolutional networks in each encoder of the graph attention encoder group: the first layer uses a multi-head graph attention network (Multi... The first layer uses a multi-head GAT (Head GAT) to compute multiple independent attention distributions in parallel to capture the topological dependencies of different subspaces, and then concatenates the results of each head for output. The second layer disables the multi-head mechanism and switches to single-head attention. Head GAT further refines compliance information in the neighborhood and reduces the dimensionality of features to a unified hidden layer dimension.

[0051] All operational topological features are concatenated and merged to obtain a topological feature matrix. After all parallel graph attention encoders have completed feature learning for their respective subgraphs, they obtain the operational topological features corresponding to each short operational attribute encoding. Operational topological features belonging to the same attribute dimension are grouped into a local feature matrix. All local feature matrices of M attribute dimensions are concatenated and merged along the feature dimensions to finally obtain a node-level topological feature matrix that combines multi-dimensional attributes. This matrix deeply characterizes the compliant dependency topology relationships between operations within a window across multiple dimensions, such as operation status codes and operation durations. By concatenating and merging all operation topology features, the topology dependency features extracted from each node under different attribute dimensions can be seamlessly integrated into a unified and compact matrix representation. This preserves the independent discriminative information of each attribute dimension while providing complete multi-view node feature inputs for downstream tasks.

[0052] In some embodiments, the step of using an alternating attention mechanism to extract features from each short operation attribute code to obtain the operation topology features corresponding to each short operation attribute code includes: for each short operation attribute code, using each attention head in a multi-head attention mechanism to extract the topology dependency features of the short operation attribute code from all short operation attribute codes, and concatenating the topology dependency features of each attention head to obtain the concatenated topology features of the short operation attribute code; and using a single-head attention mechanism to map and reduce the dimensionality of the concatenated topology features to obtain the operation topology features of the short operation attribute code.

[0053] In this embodiment, for each subgraph corresponding to the short operation attribute encoding, a multi-head graph attention network is first used as the first layer of the encoder's graph convolutional network. Multiple attention heads are computed in parallel. Each head dynamically evaluates the importance weights between the target node and its neighboring nodes in the subgraph through a self-attention mechanism, capturing diverse topological dependency features from different subspaces. Then, the outputs of each head are concatenated along the feature dimension. Dropout can also be introduced to alleviate overfitting. The multi-head mechanism enhances the expressive power of complex dependencies, and the concatenation preserves the complementary information of each subspace, avoiding information loss. Subsequently, the second layer of the graph convolutional network switches to a single-head attention network to continue feature extraction, disables feature concatenation, further refines the neighborhood compliance information of the concatenated topological features output from the previous layer, and maps and reduces its dimensionality to a unified hidden layer dimension. It outputs node-level operational topological features of a single attribute. The reason for using single-head dimensionality reduction is that, on the one hand, it can effectively control complexity and computational overhead, and on the other hand, it can alleviate the oversmoothing problem that may be caused by multi-layer graph networks. At the same time, it aligns the output features of all attribute subgraphs to the same dimension, which facilitates subsequent splicing and fusion along the feature dimension, thereby improving the efficiency and versatility of the overall framework while maintaining the discriminative power of the features.

[0054] In some embodiments, the short operation attribute information includes multiple first operation types and operation timestamps corresponding to each first operation type; the step of temporally interval encoding the multiple short operation attribute information to obtain a temporal feature matrix includes: taking two adjacent first operation types in the short operation attribute information as operation type combinations; for each operation type combination, determining the time interval corresponding to the operation type combination based on the operation timestamps corresponding to each first operation type in the operation type combination; performing logarithmic compression normalization on the time interval to obtain a compressed time, and replacing the larger of the two operation timestamps corresponding to the operation type combination with the compressed time to obtain updated short operation attribute information; using all the updated short operation attribute information as temporal data, and using a two-layer long short-term memory network to extract the sequence feature matrix corresponding to each time step of the temporal data; performing dimensional alignment and merging on the sequence feature matrix of each time step to obtain the temporal feature matrix.

[0055] In this embodiment, the first operation type that is adjacent to each other in the short operation attribute information is used as an operation type combination. The operation type reflects the specific business behavior performed by the user at each step; for example, the operation type is browsing, data entry, or approval. The time interval Δt (in seconds) between adjacent operations is calculated based on the operation timestamp corresponding to each operation type. This aims to uncover the local temporal correlation and operational rhythm characteristics of adjacent business operations, eliminating the interference of starting offset caused by absolute timestamps, and using relative time differences to characterize the dynamic rules of the process. For example, a user sequentially performs three operations in a business processing flow: "Browse," "Data Entry," and "Approval." The adjacent operation type combinations are (Browse → Data Entry) and (Data Entry → Approval). The timestamp for "Browse" is recorded as 10:00:05, and for "Data Entry" as 10:00:23, then Δt1 = 18 seconds; and for "Approval" as 10:00:35, then Δt2 = 12 seconds. These relative time intervals reflect the user's local rhythm from browsing to data entry and from data entry to approval, avoiding interference caused by different users having different starting times.

[0056] Given the extremely long tail of the distribution of real-world business time intervals, directly inputting raw values ​​would cause network parameter collapse. Therefore, logarithmic compression and normalization are applied to the time intervals to obtain the compressed time. The logarithmic compression and normalization of the time intervals is performed using the following formula: (4), where, The compression time is the value corresponding to the j-th combination of operation types. Let be the time interval corresponding to the j-th combination of operation types. This application employs a nonlinear logarithmic smoothing normalization strategy. Logarithmic smoothing can compress the dynamic range of the time interval. Through this processing, not only are potential negative time difference anomalies (caused by clock asynchrony) eliminated, but the long-tailed distribution is also effectively flattened, while retaining a keen perception of extremely small time intervals. The larger of the two operation timestamps corresponding to the operation type combination is replaced with the compressed time, resulting in the updated short operation attribute information corresponding to that operation type combination. Compared to the previous short operation attribute information, the updated short operation attribute information only changes the operation timestamps; that is, the operation timestamp of the first operation type corresponding to the larger operation timestamp is replaced with the compressed time. Without changing the original operation order and data structure, the normalized operation interval time information is integrated into the time series data, while taking into account both global time series position information and local operation density rhythm. This provides high-quality data for subsequent models to accurately learn the time series change patterns and long-term dependencies of business operations.

[0057] The updated short operation attribute information is used as time series data. In this case, except for the first first operation type in all short operation attribute information, the operation timestamps of other first operation types are replaced with compressed timestamps. The operation timestamp of the first first operation type can be replaced with a predetermined value, such as 0. A two-layer Long Short-Term Memory (LSTM) network is used to extract the sequence feature matrix for each time step corresponding to the time series data. The two-layer LSTM network can be a time series feature extraction structure that stacks and concatenates two standard LSTM layers. The output of all time steps of the first LSTM layer is directly used as the input of the second LSTM layer. A single-layer LSTM can only capture shallow, simple short-term temporal associations, and its ability to model long-sequence, rhythmically complex, and intervalically variable time series data such as business operations is limited. The two-layer stacked structure learns features through two progressive layers: the first LSTM layer is responsible for initially extracting the basic temporal patterns, local interval rhythms, and short dependencies of the time series data; the second LSTM layer, based on the features output by the first layer, further refines and abstracts higher-order long-term temporal dependencies and global rhythmic features. Leveraging the unique input, forget, and output gating mechanisms of Long Short-Term Memory (LSTM) networks, this method effectively captures the temporal correlations and long-term dependencies of consecutive operations within a window, fully exploring hidden temporal rhythm features such as operation speed and interval density, and ultimately outputting a sequence feature matrix containing hidden state information from all time steps. This enables the refined and stable extraction of dynamic temporal characteristics of business operations.

[0058] The sequence feature matrices at each time step are dimension-aligned and merged to obtain the temporal feature matrix. This matrix is ​​then passed through a Dropout layer and a fully connected mapping layer to align its feature dimensions to the hidden layer dimensions. (Consistent with the hidden layer output dimension of the topologically encoded stream), resulting in the final temporal feature matrix. By aligning and merging the sequence feature matrices at each time step, fragmented temporal information scattered across various time steps can be integrated into a complete and unified overall temporal feature matrix, avoiding the problem of scattered and disjointed feature information at single time steps. Simultaneously, unifying the dimensions of the temporal feature matrix and the topological feature matrix ensures that the two types of features can be smoothly spliced ​​and fused for subsequent feature inference calculations.

[0059] In some embodiments, determining the user's operation anomaly score based on the topological feature matrix and the temporal feature matrix includes: mapping, aligning, and fusing the topological feature matrix and the temporal feature matrix to obtain a joint latent space representation matrix; using a gated recurrent unit with a self-attention mechanism to decode the joint latent space representation matrix step-by-step to obtain the spatiotemporal joint state features for each time step; performing dimensional mapping and classification prediction on the spatiotemporal joint state features for each time step to obtain the probability distribution of predicted operation attribute information for each time step; and determining the operation anomaly score based on the probability distribution of predicted operation attribute information for each time step.

[0060] In this embodiment, the topological feature matrix and the temporal feature matrix are mapped, aligned, and fused to obtain a joint latent space representation matrix. Mapping and alignment unify the latent space representation scales of the two types of features, eliminate feature offsets and distribution differences between branches, and achieve effective complementary fusion of topological structure information and temporal rhythm information. This integrates the static correlation topological features and dynamic temporal change features of the operation into a unified joint latent space representation matrix, avoiding the problem of one-sided representation by a single feature.

[0061] A gated recurrent unit (GRU) with self-attention mechanism is used as the decoder to decode the joint latent space representation matrix Hfusion step by step, reconstructing the original operation type and business attribute bit by bit, and realizing the fine-grained restoration of spatiotemporal joint features. During decoding, the current hidden state of the decoder is used as the query matrix and the joint representation is used as the key matrix. Dimension scaling and masking mechanisms are introduced to calculate the attention score, eliminate invalid padding interference and normalize to obtain context features. Then, the attribute embedding vector processed by Dropout is concatenated with the context features and input into the GRU. Relying on the gating advantage of GRU to capture temporal dependencies, combined with the self-attention global association modeling capability, it takes into account both local temporal progression and global feature association, and finally outputs the spatiotemporal joint state features step by step and completes the reconstruction of business attributes.

[0062] In each decoding time step t, the decoder's current hidden state is used. Using the query matrix Q and the global joint representation Hfusion from the encoder output as the key matrix K, the attention score is calculated by scaling with a dot product and determined by the following formula: (5), where T represents the matrix transpose operation performed on the key matrix K. The feature vector dimension is used as a scaling factor to scale the Q and K dot product results. This balances the distribution of dot product values ​​under high-dimensional features, preventing excessively large attention scores from causing Softmax gradient failure and effectively ensuring the training stability and weight allocation accuracy of the self-attention mechanism. A masking mechanism is introduced to set the attention scores at invalid padding positions in the sequence to negative infinity, completely shielding the interference of padding noise on the decoding process. Softmax normalization then yields a context feature vector that accurately focuses on globally effective information. Then, the current time step attribute embedding vector, after Dropout noise reduction, is combined with the context vector. The concatenation, as the input feature of GRU, relies on the GRU gated recurrent mechanism to efficiently capture the dependencies between sequences and alleviate the gradient problem of traditional recurrent networks. Finally, the hidden state output by GRU, context features and original input features are combined, and the predicted probability distribution vector of the next time step is output through a fully connected layer to complete the temporal and spatial joint state feature decoding and attribute reconstruction step by step.

[0063] Based on the spatiotemporal joint state features output at each time step, the predicted probability distribution of the corresponding operation attribute information at each time step is obtained through dimensional mapping and classification prediction. Instead of using traditional reconstruction error calculation methods, the probability distribution of predicted operation attribute information is output step-by-step, such as the predicted probability distribution of operation type and various business attributes. This preserves complete prediction uncertainty information, providing a continuous and quantifiable numerical basis for subsequent refined anomaly scoring, and avoiding the loss of subtle anomaly features in discrete classification results. The operation anomaly score is then calculated based on the predicted probability distribution at each time step. The probability distribution itself has fine-grained quantification capabilities, which can intuitively reflect the degree of deviation between the actual operation and the expected behavior, effectively avoiding the problems of coarse granularity and insufficient discrimination in traditional evaluation methods. This ensures the accuracy and reliability of the operation anomaly score calculation from a numerical perspective.

[0064] In some embodiments, the mapping, alignment, and fusion of the topological feature matrix and the temporal feature matrix to obtain a joint latent space representation matrix includes: performing attention-weighted mapping on the topological feature matrix to obtain a topological attention feature matrix; performing attention-weighted mapping on the temporal feature matrix to obtain a temporal attention feature matrix; concatenating the topological attention feature matrix and the temporal attention feature matrix to obtain a concatenated attention feature matrix; segmenting the concatenated attention feature matrix along a predetermined feature dimension to obtain a segmented topological feature matrix and a segmented temporal feature matrix; performing element-wise multiplication on the segmented topological feature matrix and the topological feature matrix to obtain a multiplied topological feature matrix; performing element-wise multiplication on the segmented temporal feature matrix and the temporal feature matrix to obtain a multiplied temporal feature matrix; concatenating the multiplied topological feature matrix and the multiplied temporal feature matrix to obtain a concatenated multiplied feature matrix; and performing dimensionality reduction processing on the concatenated multiplied feature matrix using a predetermined activation function to obtain the joint latent space representation matrix.

[0065] In this embodiment, to jointly review "business operation compliance" and "time rhythm rationality," this application designs a cross-modal adaptive fusion attention module and introduces temporal consistency alignment loss. This allows for simultaneous review of both business operation compliance and time rhythm rationality, constraining the semantic alignment of topological structure features and temporal rhythm features to prevent representation misalignment. This enables the system to learn latent space representations that match business paths and time rhythms, improving the relevance and overall rigor of anomaly detection. This is achieved by obtaining the topological attention feature matrix. With temporal attention feature matrix Then, the business logic and timing are aligned in the latent space through a cross-modal adaptive fusion layer. and Attention tendency vectors are obtained separately through independent linear transformation networks. Attention-weighted mapping is applied to the topological feature matrix to obtain the topological attention feature matrix; attention-weighted mapping is applied to the temporal feature matrix to obtain the temporal attention feature matrix. Dedicated transformation mappings are set for the topological branch and the temporal branch to adapt to the distribution differences of the two modal features, avoid mutual interference of feature representations caused by sharing the network, and accurately mine the inherent attention tendency of each modality.

[0066] The topological attention feature matrix and the temporal attention feature matrix are concatenated to obtain the concatenated attention feature matrix. and After concatenation, the feature importance distribution is calculated using the Softmax function to obtain the concatenated attention feature matrix: (6), among which, For a fully connected layer t, For a fully connected layer s, the features from both branches are fused and normalized to generate a unified importance weight distribution. This adaptively and automatically distinguishes the contribution levels of topological features and temporal features, automatically strengthening effective features and weakening redundant and irrelevant features. The concatenated attention feature matrix is ​​segmented along a predetermined feature dimension to obtain a segmented topological feature matrix and a segmented temporal feature matrix. The attention feature matrix is ​​then segmented along the feature dimension. Segmentation into segmentation topological feature matrix and segmentation time series feature matrix First, the topological attention feature matrix and the temporal attention feature matrix are concatenated. This enables global interactive modeling of topological structure information and temporal rhythm information through a joint attention mechanism, allowing the two types of attention features to perceive each other and learn their dependencies, thus compensating for the lack of cross-linking in independent bi-branch modeling. Subsequently, the concatenated attention feature matrix is ​​segmented along the feature dimension. This allows for the decoupling of topological and temporal features while preserving the correlation information learned through joint attention, restoring the independent branch structure. This lays the foundation for introducing attention weights to adaptively weight and enhance the topological and temporal features and refine their representation. Without this concatenation and segmentation process, and instead using a completely independent bi-branch approach, the two types of attention features cannot exchange information or mine correlations, making it difficult to fully leverage the attention mechanism's ability to model cross-dimensional features.

[0067] Element-wise multiplication of the segmented topological feature matrix and the temporal feature matrix yields a multiplied topological feature matrix. Similarly, element-wise multiplication of the segmented temporal feature matrix and the temporal feature matrix yields a multiplied temporal feature matrix. This allows the feature information carrying the attention weight distribution after concatenation to be applied to the original features. Through the attention mechanism, key effective features in the topological structure association and temporal rhythm evolution are adaptively strengthened, noise and invalid feature interference are suppressed, and single-branch modality representations are refined. The multiplied topological feature matrix and the multiplied temporal feature matrix are concatenated to obtain a concatenated multiplied feature matrix. The topological attention feature matrix and the temporal attention feature matrix are then multiplied element-wise with their corresponding weights (Hadamard product). The weighted independent features are extracted and then concatenated. The concatenation is represented by the following formula: Concatenated Multiplied Feature Matrix (7). The dual-modal features that have been adaptively purified by attention are re-fused, retaining their respective effective information while achieving feature complementarity, thus providing a high-quality fusion foundation for subsequent joint representation.

[0068] By using a predetermined activation function to reduce the dimensionality of the concatenated and multiplied feature matrix, a joint latent space representation matrix is ​​obtained. This matrix is ​​then mapped through a fully connected layer and activated by ReLU, resulting in the dimensionality-reduced joint latent space representation matrix Hfusion, achieving deep fusion of multimodal information. While compressing feature dimensions and reducing model parameters and computational cost, the activation function introduces nonlinear expressive power, enabling deep fusion of topological and temporal multimodal information. This outputs a dimensionally regular and semantically unified joint representation, facilitating subsequent decoding and anomaly scoring tasks. In this application, structural features and temporal features in the latent space are forced to have similar representations for the same window. The consistency alignment loss is defined as the cosine distance between the structural feature vector and the temporal feature vector. This loss function encourages the model to learn implicit representations that are consistent between "compliance of business paths" and "reasonable timing," avoiding semantic misalignment between the two. The similarity between structural features and temporal features is measured by the vector cosine distance. This forces the two types of latent feature representations to approximate each other within the same window, constrains the consistency between business logic and temporal rhythm semantics, effectively avoids the problems of disjointed modal representations and logical misalignment, and improves the overall robustness of modeling.

[0069] In some embodiments, the operation attribute information includes a second operation type corresponding to at least one operation dimension for each time step; determining the operation anomaly score based on the probability distribution of the predicted operation attribute information for each time step includes: for each time step, classifying the predicted operation attribute information corresponding to the time step according to the operation dimension to obtain predicted operation attribute information corresponding to at least one operation dimension; for each operation dimension corresponding to the time step, searching for the predicted probability corresponding to the second operation type in the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension as the second operation type corresponding to the time step; searching for at least one predicted probability greater than or equal to the predicted probability corresponding to the second operation type in the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension; calculating the sum of the at least one predicted probability; summing the predicted probabilities corresponding to all operation dimensions to obtain the sub-operation anomaly score of the time step; arranging the sub-operation anomaly scores of all time steps in descending order to obtain a sequence containing multiple sub-operation anomaly scores; selecting a predetermined number of sub-operation anomaly scores in the sequence in order from front to back, and calculating the average sum of the predetermined number of sub-operation anomaly scores to obtain the operation anomaly score.

[0070] In this embodiment, to address the issue that local anomalies in long sessions are easily diluted by the global average error, this application proposes an anomaly assessment mechanism that combines fine-grained tensor scoring with a pessimistic maximum aggregation strategy. For each time step, the predicted operation attribute information corresponding to the time step is classified according to the operation dimension, obtaining predicted operation attribute information corresponding to at least one operation dimension, achieving multi-dimensional decoupled assessment and laying the foundation for fine-grained anomaly scoring. For each operation dimension corresponding to the time step, in the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension as the second operation type corresponding to the time step, the predicted probability corresponding to the second operation type is searched, and the predicted probability value corresponding to the real operation attribute information is extracted. In the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension, at least one predicted probability greater than the predicted probability corresponding to the second operation type is searched, and the sum of at least one predicted probability is calculated, which can balance the overall deviation within the dimension, avoid extreme value interference, and steadily improve the sensitivity of weak anomaly identification.

[0071] For example, taking the behavior dimension, the predicted probability for the actual operation type "Submit for Approval" is 0.2. Within the same dimension, various candidate operations and attributes, such as saving a draft, withdrawing an application, redirecting to a new page, short-term operations, frequent clicks, and cross-module redirects, have predicted probabilities of 0.5, 0.3, 0.1, 0.25, 0.15, and 0.08, respectively. Predicted probabilities greater than or equal to 0.2 are 0.2, 0.5, 0.3, and 0.25, summing to 1.25. This sum measures the deviation of the current actual operation and attribute from the overall probability distribution within this dimension. It comprehensively considers the overall differences between operation types and behavior attributes while avoiding interference from single extreme probabilities, enabling sensitive detection of subtle, weakly anomalous behaviors.

[0072] The sub-operation anomaly score is obtained by summing the probabilities and values ​​of all operation dimensions at the same time step. This allows for a balanced contribution of anomalies across multiple dimensions, providing a comprehensive and robust representation of the anomaly severity of a single-step operation. Simultaneously, an effective mask is used to eliminate interference from invalid padding scores, ensuring that only valid operations participate in the scoring, resulting in a more realistic and reliable score. The sub-operation anomaly scores for all time steps are sorted in descending order, and a predetermined number of high scores are summed before averaging to obtain the final operation anomaly score. For example, the average of the top K maximum values ​​is calculated. A pessimistic maximum aggregation strategy is employed to effectively address the problem of local minor anomalies being diluted by the global average error in long session scenarios, avoiding the defect of global averaging smoothing out anomalies.

[0073] The pseudocode for the pessimistic maximum aggregation scoring algorithm based on probabilistic quality is shown below:

[0074] This application proposes an innovative fusion and evaluation mechanism, which designs a cross-modal alignment loss and a pessimistic aggregation scoring strategy, effectively solving the fusion problem caused by spatiotemporal feature heterogeneity and significantly improving the punishment for covert attacks.

[0075] In another embodiment, a pre-trained detection model is used to perform topological encoding on multiple short operation attribute information to obtain a topological feature matrix; temporal interval encoding is also performed on the multiple short operation attribute information to obtain a temporal feature matrix; based on the topological feature matrix and the temporal feature matrix, a user's operation anomaly score is determined; in response to determining that the operation anomaly score is greater than a predetermined anomaly score, it is determined that the user has engaged in abnormal operation behavior during the current access to the application. Multiple short operation attribute information can be input into a judgment model, which outputs whether the user has engaged in abnormal operation behavior during the current access to the application.

[0076] The detection model in this application can automatically adapt the attribute dimensions based on the raw data of different business applications and adjust the dimension of the feature representation accordingly. During the training phase, only normal user behavior data is used. The detection model optimizes its parameters by minimizing the operation type reconstruction loss, business attribute reconstruction loss, and temporal consistency alignment loss. During the detection phase, anomaly scores are calculated for the test window and compared with a dynamic threshold, outputting the anomaly judgment result and location information. This application proposes a dual-stream spatiotemporal architecture detection model that deeply decouples and fuses a graph attention network with a recurrent neural network with temporal smoothing, achieving a joint deep representation of the multi-attribute spatial topology and dynamic temporal rhythm in the user operation trajectory.

[0077] like Figure 2 As shown, Figure 2 This is a schematic diagram illustrating the training and detection process of the detection model according to an embodiment of this application. The training and detection process of the detection model is described below: (1) Data Acquisition and Preprocessing: The operation attribute information (i.e., operation log data) generated by the user during the current application access is input into the detection model. The operation attribute information consists of user operation logs recorded in the business application. Each log entry includes at least the following fields: user identifier, operation type, operation timestamp, and business attribute information. The business attribute information includes, but is not limited to, resource identifier, operation object type, and operation result status. The raw log data is grouped according to the user identifier and sorted in ascending order by timestamp to form a user-level behavior sequence, i.e., a user session (i.e., a detection instance). For outlier or missing value data, preprocessing methods such as deletion, filling, or interpolation can be used to ensure the stability of subsequent modeling.

[0078] (2) Sliding Window Construction: A sliding window is used to segment the user session sequence to obtain multiple short operation attribute information. Let the window length be L and the step size be S, preferably L is 5~500 and S is L / 2. The detection model supports forward propagation of dynamic sequence length, which can adapt to global or local sequence length. For each session, it is divided into multiple windows with a length of L and a step size of S. When the sequence length is less than L, forward padding or discarding is used.

[0079] (3) Feature Construction: For multiple short operation attribute information within each window, the following three types of features are constructed: ① Operation type features: Map operation types to discrete codes and further convert them into one-hot vectors or low-dimensional embedded vector representations; ② Business attribute features: Encode each type of business attribute field separately, convert them into vector representations, and then concatenate them to form a multi-dimensional attribute feature vector; ③ Temporal enhancement features: Calculate the time difference between adjacent operations, perform logarithmic transformation (or smoothing), and concatenate it with the absolute position index of the current operation within the window to form a two-dimensional temporal feature vector, so as to provide both time span and local position information.

[0080] (4) Model Training or Model Detection: Unsupervised modeling is performed using a two-stream coding structure. One stream constructs the topological relationship of the operation sequence based on a multi-attribute graph attention network, using operations as nodes and sequences as directed edges, and constructs subgraphs under different business attribute dimensions to extract the topological feature matrix. The other stream models the temporal features containing time intervals and position indices based on a two-layer long short-term memory network to extract the temporal feature matrix. Subsequently, the features from the two streams are aligned and fused through a cross-modal adaptive fusion mechanism, and the operation type and business attributes are reconstructed using a gated recurrent unit decoder with a self-attention mechanism. Only normal data is used during model training. The loss function includes: cross-entropy loss for discrete attributes, mean squared error loss for continuous attributes, and cross-modal feature alignment loss, which are jointly optimized through backpropagation.

[0081] (5) Anomaly score calculation: During the detection phase, the detection model outputs the predicted probability distribution of the predicted operation type and attribute at each time step. For each attribute dimension, the predicted probability corresponding to the true category is extracted, and the probabilities of all candidate categories that are greater than or equal to the probability are accumulated as the anomaly score for that dimension. Then, the scores of each attribute dimension are superimposed, and the padding bits are removed by masking to obtain the time step-level anomaly score. Finally, the anomaly scores within the window are sorted in descending order, and the average of the top K maximum values ​​is taken as the window anomaly score, where K is 10% to 30% of the window length L.

[0082] (6) Threshold setting and anomaly detection: During the training phase, the mean μ and standard deviation σ are calculated based on the distribution characteristics of the anomaly scores in the statistical window of normal behavior samples. During the detection phase, the anomaly detection threshold is set as: threshold = μ + kσ, where k is an adjustment parameter, preferably 2 to 4. When the anomaly score in a window is greater than the threshold, the window is determined to have abnormal behavior. At the same time, the operation corresponding to the time step with the largest anomaly score in the window is taken as the location result of the abnormal behavior.

[0083] This application redefines the detection boundary and threat model: it points out the blind spots and defects of existing control flow topology-based detection models when faced with "perfect topology but temporal anomalies," and systematically broadens the research perspective on user behavior anomaly detection in scenarios without pre-defined business processes. A dual-stream spatiotemporal architecture detection model is proposed, which deeply decouples and fuses graph attention networks with recurrent neural networks with temporal smoothing, achieving a joint deep representation of multi-attribute spatial topology and dynamic temporal rhythms in user operation trajectories. For user behavior anomaly detection in business applications without pre-defined processes, a detection method based on sliding window segmentation, dual-stream encoding, cross-modal fusion alignment, and pessimistic maximum aggregation scoring is proposed to jointly model business compliance and temporal rhythm rationality, and improve the detection sensitivity of local anomalies in long sessions. It should be noted that the window length, step size, feature encoding method, and model structure can all be adjusted according to specific business scenarios. For example, different types of neural network structures can be used to replace recurrent neural networks, or the anomaly score calculation method can be adjusted, but all remain within the core ideas of this application.

[0084] In another embodiment, a user behavior anomaly detection method for novel business system applications is proposed. This method addresses the difficulty in jointly analyzing the compliance of business operations and the rationality of time rhythms in existing technologies, as well as the problem of local anomalies being easily diluted in long sessions. First, user operation logs are acquired and structured. Then, a sliding window mechanism is used to divide long sessions into multiple local sub-sequences. Next, a dual-stream coding model is constructed, where one stream extracts business topology features based on a multi-attribute graph attention network, and the other stream extracts time rhythm features based on a long short-term memory network. A cross-modal fusion mechanism is used to align and fuse the two types of features. Finally, a decoder is used to reconstruct the original sequence, and anomaly scores are calculated and anomaly determinations are made based on the reconstruction results. This method is mainly used for the detection and localization of complex anomalies such as process jumps and time rhythm anomalies in user operation sequences of business applications without pre-defined processes. It can simultaneously characterize operation paths and time rhythm features, improving the detection capability for complex abnormal behaviors such as process jumps and rhythm anomalies.

[0085] Among them, Graph Attention Network (GAT) is a deep learning model based on graph structure. Its core lies in introducing an attention mechanism to assign different weights to neighboring nodes. Unlike traditional graph convolutional networks that use a fixed adjacency matrix for normalization, GAT learns the importance coefficients between nodes through self-attention adaptive learning. It can extract more discriminative structural features from multi-attribute nodes and is widely used in tasks such as social network analysis and knowledge graph reasoning.

[0086] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0087] It should be noted that some embodiments of this application have been described above. In some cases, the actions or steps described in the above embodiments can be performed in a different order than that shown in the above embodiments and the desired result can still be achieved. In addition, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0088] Based on the same inventive concept, corresponding to any of the above embodiments, this application also provides a device for detecting abnormal user behavior.

[0089] refer to Figure 3 The user's abnormal operation behavior detection device includes: The acquisition module 10 is configured to acquire the operation attribute information generated by the user during the current access to the application, and to segment the operation attribute information to obtain multiple short operation attribute information.

[0090] The first encoding module 20 is configured to perform topological encoding on the multiple short operational attribute information to obtain a topological feature matrix.

[0091] The second encoding module 30 is configured to perform time-series interval encoding on the multiple short operation attribute information to obtain a time-series feature matrix.

[0092] The first determining module 40 is configured to determine the user's operation anomaly score based on the topological feature matrix and the temporal feature matrix.

[0093] The second determining module 50 is configured to determine that the user has engaged in abnormal operation behavior during the current access to the application in response to determining that the operation abnormality score is greater than a predetermined abnormality score.

[0094] The aforementioned device acquires user operation attribute information generated during the user's current application visit, incorporating it into multi-dimensional operation fields to overcome the shortcomings of traditional methods in detecting missing data. This operation attribute information is then segmented into multiple short operation attribute information segments, adapting to complex operation scenarios with extremely long sessions and reducing the complexity of processing individual data entries. Operation topology encoding is performed on these multiple short operation attribute information segments to obtain a topology feature matrix. This topology structure characterizes the connection relationships of operation nodes and business behavior links, effectively identifying structural hidden anomalies such as reversed operation order, missing key processes, and disordered business logic. Simultaneously, it transforms discrete operation behaviors and multi-dimensional attributes into a standardized and computable matrix form, providing stable structural feature support for anomaly detection. Temporal interval encoding is then performed on these multiple short operation attribute information segments to obtain a temporal feature matrix. Temporal interval encoding allows for the quantification and mining of user operation speed, millisecond-level continuous operations, and abnormal long-term dwell time behavioral patterns, transforming disordered temporal attributes into a unified temporal feature matrix. This overcomes the shortcomings of topology structures, which only represent business logic and lack dynamic temporal features, enriching the dimensions of behavioral representation. Based on the topological feature matrix and the temporal feature matrix, a user's operation anomaly score is determined. By fusing business logic features at the structural level and time interval features at the temporal level, the degree of deviation of user operation behavior can be comprehensively and quantitatively evaluated, and an accurate operation anomaly score can be determined, enabling reliable identification of abnormal user behavior under unstructured, highly flexible operation paths in new business systems. In response to determining that the operation anomaly score is greater than a predetermined anomaly score, it is determined that the user engaged in abnormal operation behavior during the current application access. Using a threshold comparison method enables automated discrimination, unifies the anomaly judgment scale, and can quickly identify hidden abnormal user operations.

[0095] In some embodiments, the first encoding module 20 is further configured to perform position encoding on the plurality of short operation attribute information using a predetermined position encoding matrix to obtain a short operation attribute code corresponding to each short operation attribute information, wherein each short operation attribute code carries its corresponding position information; to perform feature extraction on each short operation attribute code using an alternating attention mechanism to obtain an operation topology feature corresponding to each short operation attribute code; and to concatenate and merge all operation topology features to obtain the topology feature matrix.

[0096] In some embodiments, the first encoding module 20 is further configured to, for each short operation attribute encoding, use each attention head in a multi-head attention mechanism to extract the topological dependency features of the short operation attribute encoding from all short operation attribute encodings, and concatenate the topological dependency features of each attention head to obtain the concatenated topological features of the short operation attribute encoding; and use a single-head attention mechanism to map and reduce the dimensionality of the concatenated topological features to obtain the operation topological features of the short operation attribute encoding.

[0097] In some embodiments, the short operation attribute information includes multiple first operation types and operation timestamps corresponding to each first operation type; the second encoding module 30 is further configured to take two adjacent first operation types in the short operation attribute information as operation type combinations; for each operation type combination, based on the operation timestamps corresponding to each first operation type in the operation type combination, determine the time interval corresponding to the operation type combination; perform logarithmic compression normalization on the time interval to obtain a compressed time, and replace the larger of the two operation timestamps corresponding to the operation type combination with the compressed time to obtain updated short operation attribute information; take all the updated short operation attribute information as time series data; use a two-layer long short-term memory network to extract the sequence feature matrix corresponding to each time step of the time series data; perform dimensional alignment and merging on the sequence feature matrix of each time step to obtain the time series feature matrix.

[0098] In some embodiments, the first determining module 40 is further configured to map, align, and fuse the topological feature matrix and the temporal feature matrix to obtain a joint latent space representation matrix; use a gated recurrent unit with a self-attention mechanism to decode the joint latent space representation matrix step by step to obtain the spatiotemporal joint state features at each time step; perform dimensional mapping and classification prediction on the spatiotemporal joint state features at each time step to obtain the probability distribution of the predicted operation attribute information at each time step; and determine the operation anomaly score based on the probability distribution of the predicted operation attribute information at each time step.

[0099] In some embodiments, the first determining module 40 is further configured to perform attention-weighted mapping on the topological feature matrix to obtain a topological attention feature matrix; perform attention-weighted mapping on the temporal feature matrix to obtain a temporal attention feature matrix; concatenate the topological attention feature matrix and the temporal attention feature matrix to obtain a concatenated attention feature matrix; segment the concatenated attention feature matrix along a predetermined feature dimension to obtain a segmented topological feature matrix and a segmented temporal feature matrix; perform element-wise multiplication on the segmented topological feature matrix and the topological feature matrix to obtain a multiplied topological feature matrix; and perform element-wise multiplication on the segmented temporal feature matrix and the temporal feature matrix to obtain a multiplied temporal feature matrix; concatenate the multiplied topological feature matrix and the multiplied temporal feature matrix to obtain a concatenated multiplied feature matrix; and perform dimensionality reduction processing on the concatenated multiplied feature matrix using a predetermined activation function to obtain the joint latent space representation matrix.

[0100] In some embodiments, the operation attribute information includes a second operation type corresponding to at least one operation dimension for each time step; the first determining module 40 is further configured to, for each time step, classify the predicted operation attribute information corresponding to the time step according to the operation dimension to obtain predicted operation attribute information corresponding to at least one operation dimension; for each operation dimension corresponding to the time step, in the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension as the second operation type corresponding to the time step, find the predicted probability corresponding to the second operation type; in the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension, find at least one predicted probability greater than or equal to the predicted probability corresponding to the second operation type; calculate the sum of the at least one predicted probability; sum the predicted probabilities corresponding to all operation dimensions to obtain the sub-operation anomaly score of the time step; sort the sub-operation anomaly scores of all time steps in descending order to obtain a sequence containing multiple sub-operation anomaly scores; select a predetermined number of sub-operation anomaly scores in the sequence in order from front to back, and calculate the average sum of the predetermined number of sub-operation anomaly scores to obtain the operation anomaly score.

[0101] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0102] The apparatus described above is used to implement the corresponding abnormal user operation behavior detection method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0103] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the abnormal user operation behavior detection method as described in any of the above embodiments.

[0104] Figure 4 This embodiment illustrates a more specific hardware structure of an electronic device. The device may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0105] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0106] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0107] The input / output interface 1030 is used to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touch screens, microphones, various sensors, etc., and output devices may include displays, speakers, vibrators, indicator lights, etc.

[0108] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0109] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0110] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0111] The electronic devices described above are used to implement the corresponding abnormal user operation behavior detection methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0112] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to execute the user's abnormal operation behavior detection method as described in any of the above embodiments.

[0113] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0114] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the abnormal operation behavior detection method of the user as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0115] Based on the same concept, corresponding to the methods of any of the above embodiments, this application also provides a computer program product, including computer program instructions, which, when run on a computer, cause the computer to execute the user's abnormal operation behavior detection method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0116] It is understood that before using the technical solutions of the various embodiments in this disclosure, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0117] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations of this disclosed technical solution.

[0118] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0119] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0120] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application is limited to these examples; under the concept of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in detail for the sake of brevity.

[0121] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0122] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0123] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of this application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A method for detecting abnormal user behavior, characterized in that, include: Obtain the operation attribute information generated by the user during the current access to the application, and segment the operation attribute information to obtain multiple short operation attribute information; Operational topology encoding is performed on the multiple short operation attribute information to obtain a topology feature matrix; The multiple short operation attribute information are encoded by temporal interval to obtain a temporal feature matrix; Based on the topological feature matrix and the temporal feature matrix, the user's operation anomaly score is determined; In response to determining that the abnormal operation score is greater than a predetermined abnormal score, it is determined that the user has engaged in abnormal operation behavior during the current access to the application.

2. The method according to claim 1, characterized in that, The step of performing topological encoding on the multiple short operational attribute information to obtain a topological feature matrix includes: The multiple short operation attribute information is position-encoded using a predetermined position encoding matrix to obtain a short operation attribute code corresponding to each short operation attribute information, wherein each short operation attribute code carries its corresponding position information. By using the alternating attention mechanism, feature extraction is performed on the attribute encoding of each short operation to obtain the operation topology features corresponding to each short operation attribute encoding; All operational topological features are concatenated and merged to obtain the topological feature matrix.

3. The method according to claim 2, characterized in that, The method of using alternating attention mechanism to extract features from each short operation attribute code to obtain the operation topology features corresponding to each short operation attribute code includes: For each short operation attribute encoding, the topological dependency features of the short operation attribute encoding are extracted from all short operation attribute encodings using each attention head in the multi-head attention mechanism. The topological dependency features of each attention head are then concatenated to obtain the concatenated topological features of the short operation attribute encoding. By using a single-head attention mechanism, the spliced ​​topological features are mapped and dimensionality reduced to obtain the operational topological features encoded by the short operational attributes.

4. The method according to claim 1, characterized in that, The short operation attribute information includes multiple first operation types and an operation timestamp corresponding to each first operation type; The step of temporally interval encoding the multiple short operation attribute information to obtain a temporal feature matrix includes: The first operation types that are adjacent to each other in the short operation attribute information are taken as operation type combinations; for each operation type combination, the time interval corresponding to the operation type combination is determined based on the operation timestamp corresponding to each first operation type in the operation type combination. Logarithmically compress and normalize the time interval to obtain the compressed time, and replace the larger of the two operation timestamps corresponding to the operation type combination with the compressed time to obtain the updated short operation attribute information. The updated short operation attribute information is used as time series data. A two-layer long short-term memory network is used to extract the sequence feature matrix of each time step corresponding to the time series data. The sequence feature matrix at each time step is dimension-aligned and merged to obtain the time-series feature matrix.

5. The method according to claim 1, characterized in that, The step of determining the user's operation anomaly score based on the topological feature matrix and the temporal feature matrix includes: The topological feature matrix and the temporal feature matrix are mapped, aligned, and fused to obtain a joint latent space representation matrix; By using a gated recurrent unit with a self-attention mechanism, the joint latent space representation matrix is ​​decoded step by step to obtain the spatiotemporal joint state features at each time step. For the spatiotemporal joint state features at each time step, the spatiotemporal joint state features are dimensionally mapped and classified for prediction to obtain the probability distribution of the predicted operation attribute information at each time step. The operation anomaly score is determined based on the probability distribution of the predicted operation attribute information at each time step.

6. The method according to claim 5, characterized in that, The process of mapping, aligning, and fusing the topological feature matrix and the temporal feature matrix to obtain the joint latent space representation matrix includes: The topological feature matrix is ​​subjected to attention-weighted mapping to obtain the topological attention feature matrix; The temporal feature matrix is ​​subjected to attention-weighted mapping to obtain the temporal attention feature matrix; The topological attention feature matrix and the temporal attention feature matrix are concatenated to obtain the concatenated attention feature matrix. The spliced ​​attention feature matrix is ​​segmented along a predetermined feature dimension to obtain a segmented topological feature matrix and a segmented temporal feature matrix; The segmentation topological feature matrix and the topological feature matrix are multiplied element-wise to obtain a multiplied topological feature matrix; and the segmentation temporal feature matrix and the temporal feature matrix are multiplied element-wise to obtain a multiplied temporal feature matrix. The multiplied topological feature matrix and the multiplied temporal feature matrix are concatenated to obtain the concatenated multiplied feature matrix. The concatenated multiplicative feature matrix is ​​reduced in dimensionality using a predetermined activation function to obtain the joint latent space representation matrix.

7. The method according to claim 5, characterized in that, The operation attribute information includes a second operation type for at least one operation dimension corresponding to each time step; The determination of the operation anomaly score based on the probability distribution of predicted operation attribute information at each time step includes: For each time step, the predicted operation attribute information corresponding to the time step is classified according to the operation dimension to obtain the predicted operation attribute information corresponding to at least one operation dimension. For each operation dimension corresponding to the time step, in the probability distribution corresponding to the predicted operation attribute information belonging to the same operation dimension as the second operation type corresponding to the time step, find the predicted probability corresponding to the second operation type. In the probability distributions corresponding to the predicted operation attribute information belonging to the same operation dimension, find at least one predicted probability that is greater than or equal to the predicted probability corresponding to the second operation type. Calculate the sum of the at least one predicted probability; The sum of the predicted probabilities corresponding to all operation dimensions is calculated to obtain the sub-operation anomaly score for the time step. Sort the sub-operation exception scores of all time steps in descending order to obtain a sequence containing multiple sub-operation exception scores; A predetermined number of sub-operational anomaly scores are selected from the sequence in order from front to back, and the average sum of the predetermined number of sub-operational anomaly scores is calculated to obtain the operation anomaly score.

8. A device for detecting abnormal user behavior, characterized in that, include: The acquisition module is configured to acquire the operation attribute information generated by the user during the current access to the application, and to segment the operation attribute information to obtain multiple short operation attribute information. The first encoding module is configured to perform topological encoding on the multiple short operational attribute information to obtain a topological feature matrix; The second encoding module is configured to perform temporal interval encoding on the multiple short operation attribute information to obtain a temporal feature matrix; The first determining module is configured to determine the user's operation anomaly score based on the topological feature matrix and the temporal feature matrix; The second determination module is configured to determine that the user has engaged in abnormal operation behavior during the current access to the application in response to determining that the operation abnormality score is greater than a predetermined abnormality score.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method described in any one of claims 1 to 7.

Images