Intelligent network operation and maintenance management method based on user behavior analysis

Abstract

The application discloses an intelligent network operation and maintenance management method based on user behavior analysis and belongs to the technical field of network operation and maintenance management. The method obtains original behavior log data of a user terminal, performs double alignment of a behavior baseline and an abnormal deviation degree to obtain a user behavior time sequence feature sequence; a user behavior analysis model including an input gating layer, a behavior memory evolution layer and an output mapping layer is constructed, the input gating layer splits the feature sequence into a steady-state behavior component and a transient behavior component; the behavior memory evolution layer differentiates and stores and fuses the two components through a competition mechanism to generate a behavior evolution state field; the output mapping layer performs nonlinear decoupling on the behavior evolution state field to output a user behavior abnormal risk measure and a behavior prediction path; and a potential risk node and an expected behavior trajectory are determined according to the user behavior abnormal risk measure and the behavior prediction path, and a dynamic access control strategy is generated. The method can improve the abnormal behavior recognition accuracy and the timeliness of dynamic adjustment of access control.

Description

Technical Field

[0001] This invention relates to the field of network operation and maintenance management technology, specifically to an intelligent network operation and maintenance management method based on user behavior analysis. Background Technology

[0002] Network operation and maintenance management requires security risk identification and access control based on user behavior analysis. Existing solutions typically extract features directly from the original behavioral sequences after acquiring user terminal log data, and then use statistical or machine learning models to determine behavioral anomalies and predict future access paths. This approach implicitly treats user behavior as a single, uniform pattern, failing to distinguish between stable and sudden components of behavior. This leads to a mixture of normal periodic fluctuations and truly threatening behaviors, resulting in both false positives and false negatives in anomaly detection results. Furthermore, conventional models use a uniform update mechanism for storing behavioral states, which cannot simultaneously preserve long-term stable behavioral habits and rapidly respond to recent sudden changes. When faced with user behavior exhibiting both regular operations and occasional temporary accesses, long-term memory is easily overwritten by short-term noise, or short-term important signals are drowned out by long-term averaging effects, thereby reducing the accuracy of behavioral path prediction and the real-time nature of risk measurement. To accurately identify anomalies and generate effective access control strategies in complex user behavior environments, it is necessary to address the effective separation of steady-state operations and transient fluctuations at the behavioral feature expression level, and the differentiated storage and dynamic fusion of these two behavioral components at the memory evolution level. Summary of the Invention

[0003] This paper presents an intelligent network operation and maintenance management method based on user behavior analysis. It can effectively separate steady-state behavior from transient behavior in the expression of user behavior characteristics, and use a competition mechanism to perform differentiated memory storage and dynamic fusion of the two, outputting accurate abnormal risk measurement and behavior prediction path, and then generating dynamically adjusted access control policies.

[0004] The objective of this invention can be achieved through the following technical solutions: This invention provides an intelligent network operation and maintenance management method based on user behavior analysis. This method deeply integrates behavior baseline calibration and abnormal deviation measurement. By performing double alignment processing on the original behavior log data of user terminals, a user behavior time sequence feature sequence that is strictly consistent on the time axis is obtained. This eliminates the time sequence deviation caused by collection delay or transmission jitter, and enables subsequent analysis to be carried out on a unified spatiotemporal benchmark, thereby significantly improving the accuracy of abnormal behavior judgment.

[0005] After obtaining the temporal feature sequence of user behavior, a user behavior analysis model is constructed, consisting of an input gating layer, a behavior memory evolution layer, and an output mapping layer connected sequentially. The input gating layer decomposes the temporal feature sequence of user behavior into steady-state behavior components and transient behavior components. Preferably, the first gating unit extracts behavior features with long recurrence periods and classifies them into the steady-state behavior candidate set, while the second gating unit extracts behavior features with large changes in adjacent time intervals and classifies them into the transient behavior candidate set. The two candidate sets are mutually exclusive, which avoids ambiguity in the classification of behavior features between different components and ensures that the steady-state component represents the user's long-term habitual operation pattern, while the transient component accurately reflects sudden or exploratory operations, thus giving differentiated attention to the two types of behavior.

[0006] The behavioral memory evolution layer allocates long-term memory units to steady-state behavioral components and updates the stored content using an exponential decay method, only writing the portion whose similarity to the already stored state vector is below a threshold, thus effectively compressing redundant information and preserving the evolutionary context of behavioral patterns. For transient behavioral components, short-term memory units are allocated and stored in a circular queue to fully preserve the short-term burst characteristics of the behavior. At the end of each time step, a competitive arbitrator is activated to compare the energy values ​​of the latest steady-state behavioral component written to the long-term memory unit with the transient behavioral component currently at the head of the queue in the short-term memory unit. The energy value is calculated based on the information entropy and occurrence frequency of the behavioral component, with the larger energy value designated as the dominant component and the smaller as the auxiliary component. After gated weighted summation, a behavioral evolution state field is generated. This competitive mechanism dynamically determines whether the current behavioral state is dominated by steady-state habits or transient incentives, enabling the generated behavioral evolution state field to simultaneously and comprehensively depict both the long-term trends and short-term fluctuations of user behavior, enhancing sensitivity to changes in mixed behavioral patterns.

[0007] The output mapping layer nonlinearly decouples the behavioral evolution state field, feeding it into the first mapping network. Through multi-layer convolutional operations, it extracts abnormal fluctuation features along the time dimension and accumulates abnormal energy values, which are then normalized to form a user behavior anomaly risk metric. The behavioral evolution state field is then fed into the second mapping network, which uses an autoregressive recurrent structure to predict the behavioral state at each time step. All predicted behavioral states are concatenated in time sequence to form a behavioral prediction path. The synchronization buffer aligns the risk metric with the prediction path using timestamps, ensuring their correspondence in the time dimension and providing collaborative information for downstream strategy decisions. This process simultaneously outputs quantitative indicators reflecting the degree of risk and future behavioral trajectories, avoiding the limitation of a single anomaly metric in predicting behavioral trends and achieving a leap from detection to foresight.

[0008] Based on the aforementioned user behavior anomaly risk measurement and behavior prediction path, all user terminal nodes in the network operation and maintenance management area are traversed. Nodes with risk measurements above the risk threshold are marked as high-risk nodes, and nodes below the risk threshold but above the low-risk threshold are marked as medium-risk nodes, and these are also considered potential risk nodes. The resource identifier sequence that each user terminal node will access within a future time window is extracted from the behavior prediction path as the expected behavior trajectory. For each potential risk node, the expected behavior trajectory is matched against a preset security access policy library. If the match fails, an access denial policy is generated; if the match succeeds, a temporary access credential is generated based on the risk measurement level. The validity period of the credential is inversely proportional to the risk measurement level, achieving fine-grained dynamic access control. The dynamic access control policy also performs dynamic degradation or escalation operations based on real-time changes in user behavior anomaly risk measurements, automatically relaxing permissions when the risk decreases and immediately restricting permissions when the risk increases, ensuring network operation and maintenance security while maintaining the continuity of user operations.

[0009] As a technical solution of this invention, the user behavior analysis model employs a contrastive learning strategy to maximize mutual information constraints on steady-state and transient behavior components. This forces the model to strengthen the correlation learning between the two types of behavior components during training, further enhancing the ability of the behavior evolution state field to represent complex behavior patterns and distinguish subtle anomalies. Through the above-mentioned intelligent processing across the entire process, this invention can accurately identify potential risk nodes and proactively predict user behavior trajectories, generating adaptive dynamic access control policies, effectively improving the ability to perceive, predict, and contain intranet threats in network operation and maintenance management.

[0010] The beneficial effects of this invention are: After acquiring the raw behavior log data, the user behavior time-series feature sequence is generated by calculating the behavior baseline and the anomaly deviation and dynamically aligning them over time. The behavior baseline reflects the user's long-term stable operation probability distribution, while the anomaly deviation measures the degree of difference between the current behavior and the baseline using relative entropy. Aligning the two eliminates feature misalignment caused by timestamp bias, ensuring that the features received by the subsequent model retain both regular patterns and highlight the offset components, decoupling steady-state tendencies from transient changes at the data source. This processing allows the feature sequence to naturally carry a distinguishable information structure, avoiding the problem of mutual interference between steady-state and transient signals in traditional direct feature extraction, making anomaly detection more sensitive and less likely to misjudge periodic regular behaviors as risks. After the input gating layer splits the feature sequence into steady-state and transient behavior components, the behavior memory evolution layer allocates long-term memory units with exponential decay updates to the steady-state components and short-term memory units with circular queue storage to the transient components, and initiates a competitive arbitrator at each time step. A competitive arbitrator compares the energy values ​​of the most recently written steady-state component in the long-term memory unit with the transient component currently at the head of the queue in the short-term memory unit. The energy value is calculated based on a weighted sum of information entropy and occurrence frequency. The component with the larger energy value is marked as the dominant component, and the other component is designated as an auxiliary component. After gating and weighted summation, a behavioral evolution state field is generated. This competitive mechanism enables a dynamic struggle for dominance between long-term and short-term memory. When user behavior is stable, long-term memory dominates, maintaining evolutionary continuity; when sudden transient behavior has sufficient energy, short-term memory temporarily takes over, allowing the model to respond quickly to abnormal changes. The differentiated storage of the two types of memory avoids forgetting or dulling caused by the overlap of long-term and short-term information. The final output behavioral evolution state field can simultaneously retain long-term behavioral inertia and short-term abnormal details. The abnormal risk measurement obtained by this decoupling is more sensitive to real threats, and the behavioral prediction path achieves a balance between regularity and adaptability to changes. The generated dynamic access control policy can be downgraded or upgraded according to real-time changes in risk, and the validity period of temporary access credentials is inversely proportional to the risk level, achieving fine-grained control. Attached Figure Description

[0011] The invention will now be further described with reference to the accompanying drawings.

[0012] Figure 1 This is a flowchart of an intelligent network operation and maintenance management method based on user behavior analysis; Figure 2 It is a flowchart for separating user behavior features based on behavioral baseline and relative entropy; Figure 3 It is a flowchart for generating access control policies based on behavior prediction; Figure 4 This is a flowchart of dynamic access credential adjustment based on user behavior risk measurement. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] See Figure 1 This invention provides an intelligent network operation and maintenance management method based on user behavior analysis. This method acquires raw behavior log data from each user terminal in the network operation and maintenance management area, performs dual alignment of the raw behavior log data with behavioral baseline and abnormal deviation, and obtains a user behavior time-series feature sequence. A user behavior analysis model is constructed, comprising an input gating layer, a behavior memory evolution layer, and an output mapping layer. The input gating layer decomposes the user behavior time-series feature sequence into steady-state behavior components and transient behavior components. The behavior memory evolution layer differentially stores and fuses the steady-state and transient behavior components through a competition mechanism to generate a behavior evolution state field. The output mapping layer nonlinearly decouples the behavior evolution state field and outputs a user behavior anomaly risk measurement and behavior prediction path. Based on the user behavior anomaly risk measurement and behavior prediction path, potential risk nodes and expected behavior trajectories in the network operation and maintenance management area are determined, and dynamic access control policies are generated based on the potential risk nodes and expected behavior trajectories.

[0015] In specific implementation, please refer to Figure 2 When collecting login time, access resource identifier, operation command type, and data traffic direction of each user terminal in the network operation and maintenance management area, a unified timestamp mechanism is used to align data records from different user terminals according to a standardized time format. Login time records the moment the user terminal initiates an access request; the access resource identifier is the unique number of the network resource requested by the user terminal; the operation command type is the operation code executed by the user terminal; and the data traffic direction indicates the uplink or downlink attribute of the data packet. The multi-dimensional information collected above is aggregated according to user terminal identifier and timestamp, combined into raw behavior log data.

[0016] In calculating the behavioral baseline, historical behavioral patterns for each user are extracted from the original behavioral log data. For each user, the historical time period is divided into equal-length time windows. The joint frequency of operation command type and access resource identifier within each time window is counted, and the behavioral probability distribution within each time window is calculated. The behavioral probability distribution is obtained using the maximum likelihood estimation method. The behavioral probability distributions for all historical time windows are statistically analyzed, and their arithmetic mean is calculated. The averaged probability distribution is used as the behavioral baseline. The behavioral baseline is denoted as […]. ,in Indicates the first The average probability of occurrence of a certain behavioral trait over a historical period. Index for behavioral characteristics.

[0017] When calculating the abnormal deviation, user behavior within a time window at the current moment is obtained, and the probability distribution of the current behavior is statistically obtained. , Indicates the number of times within the current time window The probability of occurrence of a certain behavioral characteristic. Calculate the probability distribution of the current behavior. With behavioral baseline The relative entropy is calculated using the following formula:

[0018] in, Represents the relative entropy value. For behavioral feature indexing, The first in the current time window The probability of occurrence of a certain behavioral characteristic. For the behavioral baseline, the first The average probability of occurrence of each behavioral feature is summed and iterated over all possible behavioral features. When it is zero, the contribution of this term to the relative entropy is recorded as zero; when... For zero When the relative entropy is greater than zero, the relative entropy value is taken as a preset upper bound. The calculated relative entropy value is used as the abnormal deviation at the current moment.

[0019] When dynamically aligning the abnormal deviation with the behavioral baseline on the time axis, the original behavior log data is resampled based on the time window length and sliding step size of the behavioral baseline. If the time resolution of the original behavior log data is lower than that of the behavioral baseline, linear interpolation is performed on the original behavior log data so that the interpolated data points correspond to the time axis scale of the behavioral baseline. If the time resolution of the original behavior log data is higher than that of the behavioral baseline, truncation is performed, and data is truncated according to the time window, with the statistical values ​​within the window used as the aligned feature values. After alignment, a user behavior time-series feature sequence is generated, and the feature vector corresponding to each time step in the user behavior time-series feature sequence contains the time-aligned behavior feature values.

[0020] When the user behavior time-series feature sequence is input into the first gating unit in the gating layer, the first gating unit is configured with a sliding window. The length of the sliding window is set according to the business cycle of the network operation and maintenance management area. The first gating unit moves step-by-step across the user behavior time-series feature sequence through the sliding window, and counts the recurrence period of each behavior feature in the user behavior time-series feature sequence within the sliding window. The recurrence period is obtained by calculating the average time interval between two occurrences of the same behavior feature within the sliding window. Behavior features with a recurrence period greater than a period threshold are included in the candidate steady-state feature set. The period threshold is determined based on historical prior data of user behavior patterns in the network operation and maintenance management area. In one embodiment, the period threshold is set as the median of the average login interval of historical user behavior.

[0021] When the user behavior time-series feature sequence is input into the second gating unit in the input gating layer, the second gating unit extracts the change amplitude of behavioral features between adjacent time steps in the user behavior time-series feature sequence through difference operations. For each feature dimension in the user behavior time-series feature sequence, the difference operation calculates the absolute difference between the feature value at the current time step and the feature value at the previous adjacent time step. Behavioral features whose calculated absolute difference is greater than an amplitude threshold are included in the candidate transient feature set. The amplitude threshold is determined based on the standard deviation of the difference values ​​of all feature dimensions in the user behavior time-series feature sequence. In one embodiment, the amplitude threshold is set to a preset multiple of the standard deviation of the difference values.

[0022] When performing mutually exclusive filtering on the candidate steady-state feature set and the candidate transient feature set, the behavioral feature identifiers in the two sets are compared. If the same behavioral feature identifier appears in both the candidate steady-state feature set and the candidate transient feature set, it is determined as a transient behavioral component in chronological order, because this behavioral feature has repetition over a longer time scale but exhibits high variability at the current moment, and is therefore preferentially classified as a transient behavioral component. After mutually exclusive filtering, the behavioral features that are not removed from the candidate steady-state feature set constitute the steady-state behavioral components, and the behavioral features that are not removed from the candidate transient feature set constitute the transient behavioral components. The steady-state behavioral components and transient behavioral components are output from the input gating layer as feature vectors, respectively.

[0023] In practical implementation, when the user behavior analysis model employs a contrastive learning strategy to maximize mutual information between steady-state and transient behavior components, positive and negative sample pairs are constructed during the model training phase. Positive sample pairs consist of steady-state and transient behavior components generated from the same original behavior log data, while negative sample pairs consist of steady-state behavior components from one original behavior log data and transient behavior components from another different original behavior log data. The contrastive learning loss function uses a mutual information maximization objective, which is achieved by minimizing the cross-entropy loss between positive sample pairs. This loss function encourages steady-state and transient behavior components to retain shared information in the feature representation space.

[0024] During model training, the time-series feature sequence of user behavior is input into the input gating layer. After passing through the first and second gating units and mutual exclusion filtering, steady-state and transient behavior components are obtained. The steady-state and transient behavior components obtained from the same time-series sample are fed into a multilayer perceptron projector head, which maps the two behavior components to projection vectors of the same dimension. L2 regularization is applied to the projection vectors, and the cosine similarity between the regularized projection vectors is calculated as an approximate lower bound of the mutual information. The sharpness of the contrastive loss function is adjusted using a temperature parameter. During training, gradient descent is used to optimize the joint loss function of the contrastive learning loss and the behavior prediction loss. After training, the projector head is discarded during the inference phase, retaining only the input gating layer and the behavior memory evolution layer trained with mutual information maximization constraints.

[0025] The behavioral memory evolution layer allocates long-term memory units to steady-state behavioral components, and these units update their stored content using an exponential decay method. Each long-term memory unit maintains a long-term state vector. At each time step, the cosine similarity between the currently input steady-state behavioral component and the long-term state vector is calculated. The cosine similarity formula uses the inner product of the steady-state behavioral component vector and the long-term state vector as the numerator, and the denominator as the product of the L2 norm of the steady-state behavioral component vector and the L2 norm of the long-term state vector. The calculated cosine similarity is compared to a pre-set similarity threshold, which is set as the lower limit of the average cosine similarity within a class of steady-state behavioral components statistically analyzed from historical data. Only steady-state behavioral components with cosine similarities below the similarity threshold are written into the long-term memory unit. The writing method involves accumulating the current steady-state behavioral component onto the long-term state vector at an exponential decay rate, with the decay rate ranging from 0.9 to 0.99. The updated long-term state vector is the weighted result of the previous long-term state vector and the current steady-state behavioral component, adjusted for decay coefficients.

[0026] The Short-Term Memory (STM) unit uses a circular queue to store transient behavior components. The length of the circular queue is set to the number of time steps corresponding to the average duration of user sessions in the network operation and maintenance management area. At each time step, all currently input transient behavior components are pushed to the tail of the circular queue, while the oldest data at the head of the queue is popped. When the circular queue is not full, only the push operation is performed without popping data. The current head data output by the STM unit is the transient behavior component that entered the queue first and has not yet been removed at the current moment. This data represents the abrupt change edge of user behavior within a short time scale.

[0027] At the end of each time step, a contention arbitrator is activated. The contention arbitrator compares the energy value of the most recently written steady-state behavioral component in long-term memory with the energy value of the transient behavioral component currently at the head of the queue in short-term memory. The energy value is calculated based on a weighted sum of the information entropy and occurrence frequency of the behavioral component. For a steady-state behavioral component, its energy value... The calculation formula is:

[0028] in, The energy value representing the steady-state behavior component. The information entropy represents the steady-state behavior components. It is calculated by statistically analyzing the distribution of values ​​in each dimension of the steady-state behavior component vector. This represents the frequency of occurrence of steady-state behavior components. The frequency of occurrence is calculated by statistically analyzing the frequency of steady-state behavior components being written into long-term memory units within a few recent time steps. These are weighting coefficients. The value ranges from 0.4 to 0.6. In one implementation, The value of 0.5 is chosen because information entropy and frequency of occurrence contribute equally to the user's risk identification ability in historical backtesting tests.

[0029] For transient behavior components, the energy value is calculated using the same formula, but the calculation objects are replaced by the information entropy and occurrence frequency of the transient behavior component, while the weighting coefficients remain unchanged. The competitive arbitrator compares the calculated energy values ​​of the steady-state and transient behavior components, marking the component with the larger energy value as the dominant component and the component with the smaller energy value as the auxiliary component. When the two energy values ​​are equal, the transient behavior component is preferentially marked as the dominant component.

[0030] The dominant and auxiliary components are gated and weighted, and the output is the behavioral evolution state field. The gated and weighted summation uses a learnable gating parameter vector, which is multiplied element-wise by the dominant component. Simultaneously, another gating supplementary vector is multiplied element-wise by the auxiliary component, and the sum of corresponding elements of the two gating vectors is always 1. The two multiplication results are then summed element-wise to obtain the behavioral evolution state field. At each time step, the behavioral evolution state field represents the comprehensive representation of user behavior after fusing long-term stationary characteristics and short-term abrupt changes.

[0031] In practice, the output mapping layer receives the behavior evolution state field as input. The behavior evolution state field is a three-dimensional tensor with dimensions of batch size, time step, and feature dimension. The output mapping layer contains a first mapping network and a second mapping network running in parallel. These two mapping networks share the behavior evolution state field as input, but their network structures and parameters are independent of each other.

[0032] The first mapping network is used to output a measure of user behavior anomalies. The network architecture consists of two convolutional layers, one accumulator layer, and one normalization layer stacked sequentially. The first convolutional layer uses a one-dimensional convolutional kernel with a size of 3. This kernel slides along the time dimension with a stride of 1, and the padding is uniform to maintain the time dimension length. The weights of the kernel are trained using stochastic gradient descent, initialized with a Xavier uniform distribution. The first convolutional layer convolves local regions at each time step in the behavior evolution state field, extracting the local fluctuation amplitude at each time step and outputting the first-layer anomaly feature map. The time dimension of the first-layer anomaly feature map is consistent with the time dimension of the behavior evolution state field, and the number of feature channels is set to 32.

[0033] The first mapping network performs a second convolution operation on the first-layer anomaly feature map. This second convolution operation uses a dilated convolution kernel with a size of 3 and a dilation rate of 2. The kernel slides along the time dimension with a stride of 1, and the padding is adjusted according to the dilation rate to ensure the output time dimension matches the input. The receptive field of the dilated kernel covers the region spanning multiple time steps in the first-layer anomaly feature map, extracting the fluctuation correlation patterns between time steps in the first-layer anomaly feature map and outputting the second-layer anomaly feature map. The number of feature channels in the second-layer anomaly feature map is set to 64. The weight parameters of the dilated convolution kernel in the second-layer convolution operation are trained using stochastic gradient descent, and the initial values ​​are initialized using a Xavier uniform distribution.

[0034] The first mapping network performs a cumulative summation operation on the second-layer anomaly feature map along the time dimension. The summation operation adds the feature values ​​of the second-layer anomaly feature map at all time steps in the time dimension to obtain a scalar value, which is used as the original anomaly energy value. The acquisition of the original anomaly energy value does not depend on the number of time steps, and the contribution of each channel is preserved during the summation process.

[0035] The first mapping network performs minimum-maximum normalization on the original anomaly energy values. The input to this normalization operation includes the original anomaly energy values ​​and pre-defined normalization parameters. These parameters are determined by statistically analyzing the distribution of the original anomaly energy values ​​across all samples in the training data, recording the minimum and maximum values ​​during the training phase. During the inference phase, the original anomaly energy values ​​are linearly mapped to the 0-1 interval based on the minimum and maximum values ​​recorded during training. The normalization calculation formula is as follows:

[0036] in, This indicates that the normalized output is a numerical value that measures the risk of abnormal user behavior. This represents the original anomalous energy value. This represents the minimum value of the original anomaly energy during the training phase. This represents the maximum value of the original anomaly energy during the training phase. To be a minimal constant to prevent the denominator from being zero, Value . It is obtained by iterating through all the original anomaly energy values ​​of the training dataset and taking the minimum value among them. It is obtained by iterating through all the original anomaly energy values ​​of the training dataset and taking the maximum value among them.

[0037] The second mapping network is used to output the behavior prediction path. This network employs an autoregressive recurrent structure, which consists of a recurrent neural network layer and a fully connected output layer. The recurrent neural network layer uses gated recurrent units (RNUs), with the hidden state dimension set to 128. The input to the RNU is a slice of the behavior evolution state field at the current time step. The RNU calculates the hidden state at the current time step based on the hidden state of the previous time step and the current input. The fully connected output layer maps the hidden state output by the gated recurrent unit to the behavior feature space, outputting the behavior state prediction vector for the next time step. The dimension of the behavior state prediction vector is the same as the feature dimension of the user behavior temporal feature sequence.

[0038] In the prediction phase, the second mapping network starts from the first time step of the behavior evolution state field, inputting a slice of the behavior evolution state field from the first time step into the gated recurrent unit to obtain the first predicted behavior state; the first predicted behavior state is then fed into the gated recurrent unit as the input for the second time step to obtain the second predicted behavior state; and so on, until a predetermined number of behavior states are generated. All the predicted behavior states are concatenated in chronological order to form a behavior prediction path. Each node in the behavior prediction path contains a prediction time step index and a predicted behavior state vector.

[0039] The output mapping layer is internally configured with a synchronization buffer, which has two input ports and one output port. The first input port connects to the output of the first mapping network and receives user behavior anomaly risk metrics; the second input port connects to the output of the second mapping network and receives behavior prediction paths. The synchronization buffer internally includes a first-in-first-out (FIFO) queue and timing alignment logic. The FIFO queue allocates a buffer to each of the two input ports. The timing alignment logic checks whether both buffers contain data during each synchronization cycle, with the synchronization cycle set to match the time step interval of the behavior evolution state field. When both buffers contain data, the timing alignment logic packages the user behavior anomaly risk metrics and behavior prediction paths with the same timestamp into a single data frame and sends it from the output port to the downstream module. The downstream module includes a risk node marking unit and an access control policy generation unit. The downstream module connects to the synchronization buffer output port via an internal data bus, receives the data frame, and parses the user behavior anomaly risk metrics and behavior prediction paths.

[0040] In specific implementation, please refer to Figure 3 The network operations and maintenance management server receives user behavior anomaly risk metrics and behavior prediction paths from the output mapping layer, and obtains a list of all user terminal nodes in the network operations and maintenance management area. The user behavior anomaly risk metric is a value normalized to the range of 0 to 1; a higher value indicates a higher degree of behavior anomaly. The behavior prediction path is a time series, where each element contains a prediction time step and a prediction behavior state vector. The prediction behavior state vector stores the resource identifiers that the user terminal node will access in a future time step.

[0041] The process iterates through all user terminal nodes in the network operation and maintenance management area. For each user terminal node, the corresponding user behavior anomaly risk metric is extracted. The network operation and maintenance management server is pre-configured with a risk threshold and a low-risk threshold. The risk threshold is set to 0.8, and the low-risk threshold is set to 0.2. The risk threshold of 0.8 is based on the fact that, in the historical security event backtracking analysis of the network operation and maintenance management area, the lowest user behavior anomaly risk metric for attacked user terminal nodes during data leakage or unauthorized access events was 0.82, rounded down to the nearest integer to cover all known security events. The low-risk threshold of 0.2 is based on the fact that the maximum user behavior anomaly risk metric caused by fluctuations in normal user behavior within a certain period in the network operation and maintenance management area is 0.18, and a slightly larger value of 0.2 is used as the boundary between low and medium risk.

[0042] User terminal nodes whose user behavior anomaly risk metric exceeds the risk threshold are marked as high-risk nodes. User terminal nodes whose user behavior anomaly risk metric is below the risk threshold but above the low-risk threshold are marked as medium-risk nodes. User terminal nodes whose user behavior anomaly risk metric is below or equal to the low-risk threshold are marked as low-risk nodes. The marked high-risk and medium-risk nodes are combined into a potential risk node set, where each element carries a user terminal node identifier and a user behavior anomaly risk metric value. Low-risk nodes are not included in the potential risk node set, and their existing access control policies remain unchanged.

[0043] The system extracts a sequence of resource identifiers that each user terminal node will access within a future time window from the behavior prediction path. The future time window is set to 600 seconds. The extraction process is as follows: For a behavior prediction path corresponding to a user terminal node, starting from the current time step, iterates through several prediction time steps in the path until the timestamp of a prediction time step exceeds the current time plus the future time window length. For each prediction time step, the resource identifier field in the predicted behavior state vector is parsed, and the parsed resource identifiers are appended to a sequence in chronological order to form a resource identifier sequence. This resource identifier sequence is used as the expected behavior trajectory of the user terminal node. If a user terminal node's behavior prediction path has no prediction result within the future time window, the expected behavior trajectory is an empty sequence.

[0044] A security access policy library is pre-built into the network operations and maintenance management server. This library is stored in a relational database table format, with each record containing a resource identifier field, a allowed operation command type field, a allowed data traffic direction field, and an associated user role field. The security access policy library is manually configured by security administrators according to business operation policies and is updated periodically.

[0045] For each potential risk node in the set of potential risk nodes, the expected behavior trajectory of that potential risk node is matched against a pre-defined security access policy database. The matching operation is as follows: each resource identifier is sequentially extracted from the expected behavior trajectory, and a precise search is performed in the security access policy database using that resource identifier as the query key. If at least one record in the security access policy database has a resource identifier field that matches the query key, then that resource identifier is considered to have matched successfully; if all resource identifiers are matched successfully, then the overall matching is successful; if any resource identifier in the expected behavior trajectory cannot be found in the security access policy database, then the matching fails.

[0046] When a match fails, an access denial policy is generated. The access denial policy includes the user terminal node identifier, a list of resource identifiers whose access is denied, and a policy effective timestamp. The access denial policy is then distributed to the access control enforcement point in the network operations and maintenance management area, blocking access requests from the potentially risky node to all resource identifiers whose matches failed.

[0047] When a match is successful, a temporary access credential is generated based on the risk metric level of the potential risk node. The risk metric level is directly represented by the user behavior anomaly risk metric value. The temporary access credential includes the user terminal node identifier, the range of allowed accessed resources, the credential generation timestamp, and the validity period. The validity period of the temporary access credential is inversely proportional to the risk metric level, and the formula for calculating the validity period is:

[0048] in, Indicates the validity period of the temporary access credential, in seconds. Based on the duration coefficient, The value is 7200, set based on the number of seconds corresponding to a 2-hour temporary authorization observation period for medium-risk nodes in the operation and maintenance management strategy. For measuring the risk of abnormal user behavior, Obtained directly from user behavior anomaly risk metrics. To prevent zero offset, The value is set to 0.05, based on the premise that when the user behavior anomaly risk metric is close to 0, the effective duration will not exceed 144,000 seconds and will not cause calculation errors due to division by zero. The calculated value is... The time limit is further restricted to a preset upper limit and a preset lower limit. The preset upper limit is 86,400 seconds, and the preset lower limit is 60 seconds. If the calculated value exceeds the upper limit, the upper limit is used; if the calculated value is lower than the lower limit, the lower limit is used. The final effective duration is written to the temporary access credential, which is then distributed by the network operations and maintenance management server to the access control enforcement point for execution.

[0049] In specific implementation, please refer to Figure 4 During the period when the dynamic access control policy is in effect, a persistent bidirectional communication connection is established between the access control enforcement point in the network operation and maintenance management area and the network operation and maintenance management server. The access control enforcement point sends temporary access credential status query requests to the network operation and maintenance management server in a polling manner. The query request contains the identifier of the currently effective temporary access credential. The network operation and maintenance management server continuously receives user behavior anomaly risk metrics sent by the output mapping layer through the synchronization buffer. The user behavior anomaly risk metrics are continuously updated in the form of time-series data streams.

[0050] In practice, the network operations and maintenance management server maintains a risk status record for each user terminal node that has been issued a temporary access credential. This record includes the user terminal node identifier, the current risk measurement level, the baseline value for the credential's validity period, and the credential's permission scope. The network operations and maintenance management server reads pre-configured risk thresholds and low-risk thresholds; the risk threshold is set to 0.8, and the low-risk threshold is set to 0.2. When abnormal user behavior risk measurements are obtained from the output mapping layer, the network operations and maintenance management server compares the latest received abnormal user behavior risk measurement with the previously stored abnormal user behavior risk measurement in the risk status record to determine the direction of the risk measurement change.

[0051] In practice, when the risk metric for abnormal user behavior rises from below the low-risk threshold to the medium-risk threshold range (i.e., the risk metric was less than or equal to the low-risk threshold at the previous moment and greater than the low-risk threshold but less than or equal to the risk threshold at the current moment), the network operations and maintenance management server performs a downgrade operation on the temporary access credentials granted to that user's terminal node. The downgrade operation involves two methods: permission reduction and validity period reduction. Permission reduction is achieved by trimming the range of allowed resource identifiers in the temporary access credentials. Specifically, the list of allowed resource identifiers in the temporary access credentials is compared with a pre-defined set of sensitive resource identifiers. Resource identifiers that overlap with those in the sensitive resource identifier set are removed from the list of allowed resource identifiers. The sensitive resource identifier set is defined by the security administrator based on the confidentiality level of resources in the network operations and maintenance management area. The reduction in validity period is achieved by recalculating the remaining validity period of temporary access credentials. The calculation involves multiplying the current remaining validity period by a degradation factor of 0.5. This factor is set based on the principle that when a user's abnormal behavior risk measurement enters the medium-risk range, the access window is shortened to half its original size to reduce potential risk exposure. The downgraded temporary access credentials are pushed to the access control enforcement point via the network operations and maintenance management server. The access control enforcement point then updates the credential cache in memory, and the reduction takes effect immediately.

[0052] In practice, when the risk metric for abnormal user behavior rises above the risk threshold (i.e., the current risk metric exceeds the threshold), the network operations and maintenance management server revoks the temporary access credential. The revocation operation marks the temporary access credential as revoked and generates a revocation command, which is sent to the access control enforcement point. This command includes the identifier of the revoked temporary access credential and a timestamp indicating the revocation took effect. Simultaneously, the network operations and maintenance management server triggers an access denial policy. This policy covers all access requests from the user's terminal node for a period of time, with a duration set at 3600 seconds. This duration is based on the default blocking observation period of one hour in the high-risk event handling process. During this period, even if the risk metric for abnormal user behavior decreases, the access denial status must be maintained until a reassessment occurs after the blocking period ends.

[0053] In practice, when the user behavior anomaly risk metric drops from the medium-risk or high-risk range to below the low-risk threshold (i.e., the user behavior anomaly risk metric was greater than the low-risk threshold at the previous moment and is less than or equal to the low-risk threshold at the current moment), the network operation and maintenance management server performs an upgrade operation on the temporary access credential according to a pre-set recovery strategy. The recovery strategy adopts a gradual recovery approach, not immediately restoring the temporary access credential to its initial state, but rather upgrading the credential permissions in stages. The recovery strategy defines three recovery stages, with each stage spaced 600 seconds apart. In the first recovery stage, the network operation and maintenance management server restores the list of allowed access resource identifiers for the temporary access credential to 50% of its pre-downgrade range, and the validity period to 50% of its pre-downgrade validity period. In the second recovery stage, the list of allowed access resource identifiers is restored to 80% of its pre-downgrade range, and the validity period is restored to 80% of its pre-downgrade validity period. In the third recovery stage, both the list of allowed access resource identifiers and the validity period are restored to their complete pre-downgrade state. When each recovery phase is completed, the network operations and maintenance management server records the timestamp of the current phase and starts a timer. In the timer callback, it checks whether the current user behavior abnormality risk metric is still below the low-risk threshold. If it is, it proceeds to the next recovery phase. If the user behavior abnormality risk metric rises again above the low-risk threshold, the recovery process is interrupted and the downgrade operation is re-executed.

[0054] In practice, the recovery strategy uses a three-stage recovery phase. This is based on adaptive analysis of historical behavior recovery processes in the network operations and maintenance management area. Dividing the recovery process into three stages allows the system to continuously monitor user behavior stability during recovery, preventing sudden fluctuations from causing permission jumps. The 600-second interval between recovery phases is based on the fact that the baseline stability time for user behavior changes in the network operations and maintenance management area is approximately 10 minutes. Setting the interval for each recovery phase to 600 seconds covers the time window required for the behavior baseline to reconverge.

[0055] In practice, the calculation of the effective duration involved in downgrade and upgrade operations shall be uniformly calculated using the following formula:

[0056] in, This indicates the remaining valid duration after adjustment, in seconds. This indicates the remaining validity period of the current temporary access credential, in seconds. To adjust the coefficients. During the downgrade operation, A value of 0.5 indicates half of the remaining valid time. The rationale for using 0.5 is that when the behavioral anomaly risk measure enters the medium-risk range, halving the access window can effectively limit the impact of potential abnormal behavior. In the first recovery phase of the upgrade operation, The value is 0.5; in the second recovery phase of the upgrade operation, The value is 0.8; in the third recovery phase of the upgrade operation, The value is 1.0. Each stage The increment of the value is set according to the trust recovery gradient in the risk reduction process, with an increase of 0.3 or 0.2 recovery ratio in each stage to avoid secondary risks caused by restoring all permissions at once.

[0057] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A smart network operation and maintenance management method based on user behavior analysis, characterized in that, include: Obtain the raw behavior log data of each user terminal in the network operation and maintenance management area, and perform dual alignment of the raw behavior log data with behavior baseline and abnormal deviation to obtain the user behavior time sequence feature sequence; A user behavior analysis model is constructed, which includes an input gating layer, a behavior memory evolution layer, and an output mapping layer. The input gating layer decomposes the user behavior temporal feature sequence into steady-state behavior components and transient behavior components. The behavioral memory evolution layer uses a competition mechanism to differentially store and fuse the steady-state behavioral components and the transient behavioral components to generate a behavioral evolution state field. The output mapping layer performs nonlinear decoupling on the behavior evolution state field and outputs a user behavior anomaly risk metric and behavior prediction path. Based on the user behavior anomaly risk measurement and the behavior prediction path, potential risk nodes and expected behavior trajectories in the network operation and maintenance management area are determined, and dynamic access control policies are generated based on the potential risk nodes and the expected behavior trajectories.

2. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 1, characterized in that, The specific steps for obtaining the user behavior time-series feature sequence include: Login time, access resource identifier, operation command type and data traffic direction of each user terminal are collected according to a unified timestamp and combined into raw behavior log data; Extract the historical behavior patterns of each user from the original behavior log data, and calculate the behavior probability distribution of each user in each time window as the behavior baseline; Calculate the relative entropy between the user's current behavior and the behavior baseline as the anomaly deviation. The abnormal deviation is dynamically aligned with the behavior baseline on the time axis, and the original behavior log data is interpolated or truncated based on the behavior baseline to generate an aligned user behavior time-series feature sequence.

3. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 2, characterized in that, The specific steps by which the input gating layer splits the user behavior temporal feature sequence into steady-state behavior components and transient behavior components include: The user behavior time-series feature sequence is input into the first gating unit in the input gating layer. The first gating unit counts the recurrence period of each behavior feature in the user behavior time-series feature sequence through a sliding window, and classifies the behavior features with a recurrence period greater than the period threshold into the candidate steady-state feature set. The user behavior time series feature sequence is input into the second gating unit in the input gating layer. The second gating unit extracts the change amplitude of the behavior features at adjacent time points in the user behavior time series feature sequence through differential operation, and classifies the behavior features with a change amplitude greater than the amplitude threshold into the candidate transient feature set. The candidate steady-state feature set and the candidate transient feature set are mutually exclusive filtered. Behavioral features that appear in both sets simultaneously are determined as transient behavioral components in chronological order. Behavioral features in the remaining candidate steady-state feature set constitute the steady-state behavioral components, and behavioral features in the remaining candidate transient feature set constitute the transient behavioral components.

4. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 1, characterized in that, The user behavior analysis model employs a contrastive learning strategy to constrain the mutual information maximization of steady-state and transient behavior components.

5. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 1, characterized in that, The specific steps for generating the behavioral evolution state field include: Long-term memory units are allocated to the steady-state behavior components. The long-term memory units are updated with an exponential decay method. At each time step, only the part of the steady-state behavior component whose cosine similarity with the stored state vector is lower than the similarity threshold is written into the long-term memory unit. Short-term memory units are allocated to the transient behavior components. The short-term memory units store the most recent time step sequences of the transient behavior components in a circular queue. At each time step, all the transient behavior components are pushed into the circular queue and the oldest data at the head of the queue is popped. At the end of each time step, a competition arbitrator is activated. The competition arbitrator compares the energy value of the latest written steady-state behavior component in the long-term memory unit with the energy value of the transient behavior component at the current head of the queue in the short-term memory unit. The component with the larger energy value is marked as the dominant component, and the component with the smaller energy value is marked as the auxiliary component. The dominant component and the auxiliary component are summed by gating and output as the behavior evolution state field.

6. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 5, characterized in that, In the competition mechanism, the energy value is calculated based on the weighted sum of the information entropy of the behavioral components and their occurrence frequency.

7. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 1, characterized in that, The specific steps of the output mapping layer to nonlinearly decouple the behavior evolution state field and output user behavior anomaly risk measurement and behavior prediction path include: The behavior evolution state field is input into the first mapping network of the output mapping layer. The first mapping network extracts the abnormal fluctuation features in the behavior evolution state field through multi-layer convolution operations. The abnormal fluctuation features are accumulated over time to obtain an abnormal energy value. The abnormal energy value is normalized and used as the user behavior abnormal risk measure. The behavior evolution state field is input into the second mapping network of the output mapping layer. The second mapping network predicts the behavior state of the next time step step by step through an autoregressive loop structure. All the predicted behavior states are concatenated in time order to form the behavior prediction path. The user behavior anomaly risk measurement and the behavior prediction path are synchronously output to the synchronization cache of the output mapping layer. The synchronization cache timestamps the two and then sends them to the downstream module.

8. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 1, characterized in that, The specific steps for generating dynamic access control policies based on the potential risk nodes and the expected behavioral trajectories include: Traverse all user terminal nodes in the network operation and maintenance management area, mark user terminal nodes whose user behavior abnormal risk measurement is higher than the risk threshold as high-risk nodes, mark user terminal nodes whose user behavior abnormal risk measurement is lower than the risk threshold but higher than the low-risk threshold as medium-risk nodes, mark the remaining user terminal nodes as low-risk nodes, and regard the high-risk nodes and the medium-risk nodes as the potential risk nodes. Extract the resource identifier sequence that each user terminal node will access within a future time window from the behavior prediction path, and use the resource identifier sequence as the expected behavior trajectory of the user terminal node. For each potential risk node, the expected behavior trajectory of the potential risk node is matched with a pre-set security access policy library. If the match fails, an access denial policy is generated. If the match succeeds, a temporary access credential is generated based on the risk metric level of the potential risk node. The validity period of the temporary access credential is inversely proportional to the risk metric level.

9. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 1, characterized in that, The dynamic access control policy performs dynamic downgrade or upgrade operations based on real-time changes in the risk metric for abnormal user behavior.

10. The intelligent network operation and maintenance management method based on user behavior analysis according to claim 7, characterized in that, The specific steps for using the normalized abnormal energy value as a measure of user behavior anomaly risk include: The first mapping network performs a first layer convolution operation on the behavior evolution state field. The first layer convolution operation uses a one-dimensional convolution kernel that slides along the time dimension to extract the local fluctuation amplitude of each time step in the behavior evolution state field as the first layer anomaly feature map. The first mapping network performs a second convolution operation on the first layer of anomaly feature map. The second convolution operation uses an expanded convolution kernel to enlarge the receptive field and extracts the fluctuation correlation pattern across time steps in the first layer of anomaly feature map as the second layer of anomaly feature map. The first mapping network sums the second-layer anomaly feature map along the time dimension to obtain the original anomaly energy value. The original anomaly energy value is then normalized to a minimum and maximum value, and the normalized value is limited to between zero and one. The output is the user behavior anomaly risk measure.

Images