A method and apparatus for detecting abnormality of user behavior

Abstract

The application provides an abnormality detection method and device for user behavior, which can be applied to the technical field of network security and behavior analysis. The method comprises the following steps: constructing a target user behavior graph based on authorized information of a target user; performing global unified coding processing on the category of a behavior node in the target user behavior graph to obtain a coded target user behavior graph; calling a trained graph attention neural network to perform context-aware embedding processing on the behavior node of the coded target user behavior graph to obtain a node-level embedding set, and performing feature aggregation processing on the node-level embedding set to obtain a graph-level representation vector of the target user behavior graph; performing clustering processing on the graph-level representation vector of a trusted user behavior graph verified by an expert to obtain a trusted behavior contour set, and performing abnormality detection processing on the behavior of the target user based on the norm distance between the graph-level representation vector of the target user behavior graph and the trusted behavior contour set to obtain a detection result.

Description

Technical Field

[0001] This application relates to the fields of network security and user behavior analysis technology, and specifically to a method and apparatus for detecting anomalies in user behavior. Background Technology

[0002] In today's era of widespread digital services, user interactions with various systems are becoming increasingly complex, making the detection of anomalies in user behavior a crucial means of ensuring system security and business trustworthiness. Whether in scenarios such as identity authentication, online consumption, communication interaction, or access to internal management systems, attackers or unauthorized users may exploit abnormal behavior patterns to commit unauthorized access, fraudulent transactions, or data misuse. Therefore, how to promptly identify and respond to anomalies during user interactions has become an important research direction in the field of information security.

[0003] However, existing technical solutions cannot effectively handle proactive attacks from unauthorized users. While some model-based user behavior analysis and anomaly detection solutions can achieve high detection accuracy, their application in real-world scenarios is severely limited. Furthermore, real attack data samples are extremely scarce and difficult to obtain, leading to imbalanced training samples during the model training process. In addition, the constantly evolving methods of attackers make it difficult for these models to accurately and efficiently identify unprecedented "zero-day" attacks. Summary of the Invention

[0004] In view of the above problems, this application provides a method and apparatus for detecting the anomalies of user behavior, which is used to solve at least one of the above problems.

[0005] The first aspect of this application provides a method for detecting anomalies in user behavior, comprising: constructing a target user behavior graph based on the authorization information of the target user; performing global unified encoding on the categories of behavior nodes in the target user behavior graph to obtain an encoded target user behavior graph; calling a trained graph attention neural network to perform context-aware embedding on the behavior nodes of the encoded target user behavior graph to obtain a node-level embedding set; and performing feature aggregation on the node-level embedding set to obtain a graph-level representation vector of the target user behavior graph, wherein the trained graph attention neural network is trained based on an unsupervised contrastive learning framework; performing clustering on the graph-level representation vector of the credible user behavior graph verified by experts to obtain a credible behavior contour set; and performing anomaly detection processing on the target user's behavior based on the norm distance between the graph-level representation vector of the target user behavior graph and the credible behavior contour set to obtain a detection result.

[0006] According to an embodiment of this application, the above-mentioned method for detecting the anomaly of user behavior further includes: when the detection result indicates that the target user's behavior is abnormal, performing expert verification processing on the target user's behavior; when the expert verification result indicates that the target user's behavior is credible, adding the graph-level representation vector of the target user's behavior graph to the credible behavior contour set.

[0007] According to an embodiment of this application, the above-mentioned construction of a target user behavior graph based on the authorization information of the target user includes: obtaining the target user's historical behavior logs based on the authorization information of the target user, and parsing the behavior records in the historical behavior logs to obtain the behavior nodes and attribute information of the behavior nodes in the target user behavior graph; performing feature extraction processing on the attribute information of each behavior node to obtain the feature set of each behavior node, and obtaining the probability of occurrence of each feature among all features by traversing the feature sets of all behavior nodes; determining the common features between the feature sets of any two behavior nodes, and summing the probability of occurrence of the common features to obtain the similarity between the behavior nodes; and establishing an edge of the target user behavior graph between the two behavior nodes corresponding to the similarity when the similarity is greater than the similarity threshold, wherein the weight of the edge is the similarity.

[0008] According to an embodiment of this application, the above-mentioned invocation of the trained graph attention neural network to perform context-aware embedding processing on the behavior nodes of the encoded target user behavior graph to obtain a node-level embedding set includes: extracting the feature set of the behavior nodes of the encoded target user behavior graph, and performing feature transformation processing on the feature set of the behavior nodes based on learnable weights to obtain a feature transformation set of the behavior nodes; calculating the attention weight between the behavior node and its neighboring behavior nodes, and using the attention weight to perform feature weighting processing on the feature transformation set of the neighboring behavior nodes to obtain a node-level embedding set of the behavior nodes.

[0009] According to an embodiment of this application, the trained graph attention neural network is trained using an unsupervised contrastive learning framework, including: uniformly encoding the category features of the behavior nodes in the original behavior graph samples to obtain target behavior graph samples; calling the graph attention neural network to perform context-aware embedding processing on the target behavior graph samples to obtain a node-level embedding sample set; calling a preset readout function to aggregate the node-level embedding sample set to obtain graph-level representation vector samples of the behavior graph samples; calling a bilinear scoring discriminator to perform consistency scoring processing on the node-level embedding sample set and the graph-level representation vector samples to obtain a consistency scoring result; calling a contrastive loss function based on the expectation distribution to process the consistency scoring result to maximize the mutual information between the node-level embedding sample set and the graph-level representation vector samples to obtain a contrastive loss value; and using the contrastive loss value to update the parameters of the graph attention neural network to obtain the trained graph attention neural network.

[0010] According to an embodiment of this application, the above-mentioned processing of unified encoding of the category features of behavior nodes in the original behavior graph sample to obtain the target behavior graph sample includes: constructing a globally shared dictionary for the category features of behavior nodes by traversing the user behavior training dataset corresponding to the original behavior graph sample, and reserving a dedicated dimension in the globally shared dictionary, wherein the dedicated dimension is used to represent the value of unknown category features outside the user behavior training dataset; mapping the category features corresponding to the behavior nodes to index values ​​using the globally shared dictionary, and performing one-hot encoding on the index values ​​to obtain the numerical vector of the category features; concatenating the numerical vectors of all category features of the behavior nodes to obtain the target behavior graph sample with globally unified encoding of nodes.

[0011] According to an embodiment of this application, the above-mentioned clustering of the graph-level representation vector of the trusted user behavior graph verified by experts to obtain a trusted behavior profile set includes: using a leader clustering algorithm to calculate the norm distance set between all leaders in the current leader set and the graph-level representation vector of the trusted user behavior graph; when each distance in the norm distance set is less than a distance threshold, the graph-level representation vector of the trusted user behavior graph is added to the current leader set as a new cluster center to obtain the trusted behavior profile set.

[0012] According to an embodiment of this application, the above-mentioned abnormality detection processing of the target user's behavior based on the norm distance between the graph-level representation vector of the target user behavior graph and the set of trusted behavior contours, and the detection results include: calculating the L2 norm distance between the graph-level representation vector of the target user behavior graph and all graph-level representation vectors in the set of trusted behavior contours, and obtaining the L2 norm distance set; if there is an L2 norm distance in the L2 norm distance set that is greater than the distance threshold, it is determined that the target user's behavior has an abnormality.

[0013] According to an embodiment of this application, the above-mentioned method for detecting anomalies in user behavior further includes: associating utility scores with each graph-level representation vector in the trusted behavior contour set, and periodically decaying the associated utility scores of each graph-level representation in the trusted behavior contour set; increasing the utility score of the current graph-level representation vector when the graph-level representation vector of the target user behavior graph successfully matches the current graph-level representation vector in the trusted behavior contour set; and deleting the current graph-level representation vector from the trusted behavior contour set when the utility score of the current graph-level representation vector in the trusted behavior contour set is lower than the contour set pruning threshold.

[0014] A second aspect of this application provides an anomaly detection device for user behavior, comprising: a behavior graph construction module for constructing a target user behavior graph based on the authorization information of the target user; a graph-level representation vector acquisition module for globally encoding the categories of behavior nodes in the target user behavior graph to obtain an encoded target user behavior graph, calling a trained graph attention neural network to perform context-aware embedding processing on the behavior nodes of the encoded target user behavior graph to obtain a node-level embedding set, and performing feature aggregation processing on the node-level embedding set to obtain a graph-level representation vector of the target user behavior graph, wherein the trained graph attention neural network is trained based on an unsupervised contrastive learning framework; and an anomaly detection module for clustering the graph-level representation vectors of credible user behavior graphs verified by experts to obtain a credible behavior contour set, and performing anomaly detection processing on the target user's behavior based on the norm distance between the graph-level representation vectors of the target user behavior graph and the credible behavior contour set to obtain a detection result.

[0015] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0016] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0017] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0018] The user behavior anomaly detection method provided in this application constructs the target user's historical behavior logs into a context-aware graph structure data, and uses a graph attention neural network trained based on an unsupervised contrastive learning framework to obtain the graph-level representation vector of the graph structure data. This solves the problem of traditional supervised learning's dependence on scarce and difficult-to-obtain attack label data, and also overcomes the limitation of traditional methods requiring the manual setting of complex rules. Furthermore, the user behavior anomaly detection method provided in this application can adaptively and dynamically update the set of credible behavior contours. By supplementing with new, legally verified normal behavior patterns and periodically removing long-term inactive outdated contours, it effectively solves the problem of graph attention neural network performance degradation over time caused by "concept drift". Attached Figure Description

[0019] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 The diagram illustrates an application scenario of the user behavior anomaly detection method according to an embodiment of this application.

[0021] Figure 2 A flowchart of a method for detecting anomalies in user behavior according to an embodiment of this application is shown.

[0022] Figure 3 A structural block diagram of a user behavior anomaly detection device according to an embodiment of this application is shown.

[0023] Figure 4 A block diagram of an electronic device suitable for implementing an anomaly detection method for user behavior according to an embodiment of this application is shown. Detailed Implementation

[0024] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0027] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0028] In the field of anomaly detection in user behavior, taking identity authentication security as an example, password- or token-based mechanisms are used to verify the correctness of user credentials when using an account. Once attackers steal legitimate users' credentials through phishing, credential stuffing, or malware, they can easily bypass the authentication system and impersonate legitimate users to perform malicious operations, such as data theft, fund transfer, or system damage. To address these challenges, the industry has explored enhanced authentication and risk-based authentication. Specifically, manually set rules or statistical thresholds, such as limiting IP (Internet Protocol) address ranges or monitoring frequency, are used to determine whether the operation is performed by the user themselves. However, these methods cannot address users' proactive attacks or illegal activities, such as users borrowing accounts or engaging in unauthorized operations on internal data.

[0029] With the development of machine learning technology, model-based user behavior analysis and anomaly detection methods have been explored, such as supervised learning based on existing labeled datasets. While these methods can achieve high detection accuracy, their application in real-world scenarios is severely limited. Real-world attack data samples are extremely scarce and difficult to obtain, leading to imbalanced training samples for the model. Furthermore, attackers' methods are constantly evolving, making it difficult for models to effectively identify unprecedented "zero-day" attacks. Therefore, there is an urgent need for an unsupervised anomaly detection method that can automatically learn deep representations of user behavior graphs, does not rely on labeled data, and can dynamically adapt to changes in user behavior.

[0030] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0031] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0032] Figure 1 An application scenario diagram of the user behavior anomaly detection method according to an embodiment of this application is shown.

[0033] like Figure 1 As shown, application scenario 100 according to this embodiment may include scenarios such as network security and behavior analysis. Network 104 is used as a medium to provide a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0034] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0035] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0036] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0037] It should be noted that the user behavior anomaly detection method provided in this application embodiment can generally be executed by server 105. Correspondingly, the user behavior anomaly detection device provided in this application embodiment can generally be located in server 105. The user behavior anomaly detection method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the user behavior anomaly detection device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0038] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0039] The following will be based on Figure 1 The scenario described herein, along with other accompanying drawings, will be described in detail with reference to the user behavior anomaly detection method of the disclosed embodiments.

[0040] Figure 2 A flowchart of a method for detecting anomalies in user behavior according to an embodiment of this application is shown.

[0041] like Figure 2 As shown, the anomaly detection of user behavior in this embodiment includes operations S210 to S230.

[0042] In operation S210, a target user behavior graph is constructed based on the target user's authorization information.

[0043] The target user behavior graph includes behavior nodes and edges connecting them: each log entry in the target user's historical behavior log is abstracted as a behavior node in the target user behavior graph; various behaviors in the log entries are recorded as attributes of the corresponding behavior nodes; pairwise similarity comparisons are performed on all behavior nodes; if the similarity is greater than the edge establishment threshold, an edge is directly established between the two behavior nodes; once the similarity comparison between any two behavior nodes is completed, the target user behavior graph is constructed.

[0044] In embodiments of this application, user consent or authorization can be obtained before acquiring user information. For example, a request to acquire user information can be sent to the user before operation S210. If the user consents or authorizes the acquisition of user information, operation S210 is performed.

[0045] In the embodiments of this application, a corresponding operation entry point can be provided to the user, allowing the user to choose to agree to or reject the automated decision result. That is, before processing / making a decision on the user information, the user can provide an instruction to agree to or reject the processing / decision through the corresponding operation entry point. If the user agrees to the processing / decision, the user information is processed / decided, i.e., operations S210~S230 are executed. If the user rejects the processing / decision, the expert decision-making process is initiated.

[0046] In operation S220, the categories of behavior nodes in the target user behavior graph are globally uniformly encoded to obtain the encoded target user behavior graph. The trained graph attention neural network is then called to perform context-aware embedding processing on the behavior nodes of the encoded target user behavior graph to obtain a set of node-level embeddings. The set of node-level embeddings is then subjected to feature aggregation processing to obtain the graph-level representation vector of the target user behavior graph. The trained graph attention neural network is trained based on an unsupervised contrastive learning framework.

[0047] The target user behavior map is input into a trained graph attention neural network (GNN). The trained GNN acts as an encoder to process the target user behavior map. A pre-defined readout function aggregates the processing results of the neural network to obtain a graph-level representation vector of the target behavior map. The unsupervised contrastive learning framework includes the GNN to be trained, a readout function, and a discriminator. During the unsupervised contrastive learning process, a trusted user behavior map is used to train the GNN. The graph-level representation vector and node-level embeddings of the trusted user behavior map are used as positive and negative samples for unsupervised contrastive learning. The training loss is calculated by maximizing the mutual information between the graph-level representation vector and the node-level embeddings.

[0048] In operation S230, the graph-level representation vectors of the trusted user behavior graph verified by experts are clustered to obtain a set of trusted behavior contours. Anomaly detection is then performed on the target user's behavior based on the norm distance between the graph-level representation vectors of the target user behavior graph and the set of trusted behavior contours to obtain the detection results.

[0049] The leader clustering algorithm is used to cluster the graph-level representation vectors of trusted users to obtain a set of trusted behavior profiles (or normal behavior profiles, the same below); by calculating the distance between the graph-level representation vector of the target user and the established trusted behavior profiles, the abnormal behavior score of the target user is obtained, and the user's behavior is judged as abnormal based on the score.

[0050] According to an embodiment of this application, the above-mentioned method for detecting the anomaly of user behavior further includes: when the detection result indicates that the target user's behavior is abnormal, performing expert verification processing on the target user's behavior; when the expert verification result indicates that the target user's behavior is credible, adding the graph-level representation vector of the target user's behavior graph to the credible behavior contour set.

[0051] To address concept drift, the normal behavior profile set is continuously updated. When a user marked as anomalous passes verification (e.g., expert verification), the user's graph-level representation vector is supplemented into a new normal behavior profile. A utility score is assigned to each profile and periodically decayed. Outdated profiles with utility scores below the threshold are removed.

[0052] The user behavior anomaly detection method provided in this application constructs the target user's historical behavior logs into a context-aware graph structure data, and uses a graph attention neural network trained based on an unsupervised contrastive learning framework to obtain the graph-level representation vector of the graph structure data. This solves the problem of traditional supervised learning's dependence on scarce and difficult-to-obtain attack label data, and also overcomes the limitation of traditional methods requiring the manual setting of complex rules. Furthermore, the user behavior anomaly detection method provided in this application can adaptively and dynamically update the set of credible behavior contours. By supplementing with new, legally verified normal behavior patterns and periodically removing long-term inactive outdated contours, it effectively solves the problem of graph attention neural network performance degradation over time caused by "concept drift".

[0053] According to an embodiment of this application, the above-mentioned construction of a target user behavior graph based on the authorization information of the target user includes: obtaining the target user's historical behavior logs based on the authorization information of the target user, and parsing the behavior records in the historical behavior logs to obtain the behavior nodes and attribute information of the behavior nodes in the target user behavior graph; performing feature extraction processing on the attribute information of each behavior node to obtain the feature set of each behavior node, and obtaining the probability of occurrence of each feature among all features by traversing the feature sets of all behavior nodes; determining the common features between the feature sets of any two behavior nodes, and summing the probability of occurrence of the common features to obtain the similarity between the behavior nodes; and establishing an edge of the target user behavior graph between the two behavior nodes corresponding to the similarity when the similarity is greater than the similarity threshold, wherein the weight of the edge is the similarity.

[0054] The embodiments described above in this application, through deep analysis of user historical behavior logs, can automatically identify and extract key behavioral features, forming a comprehensive and refined user behavior node model. This multi-level feature extraction mechanism ensures the accurate capture of user behavior patterns. The edge connection mechanism based on dynamic thresholds allows the system to adjust the behavioral relationship tightness standard according to business needs, enabling the construction of both refined, highly cohesive behavioral groups and broadly related, loosely connected communities, adapting to different application scenarios. By probabilistically processing the frequency of feature occurrences, similarity calculation becomes more scientific and objective, improving the accuracy of behavioral association judgment.

[0055] The construction process of the target user behavior graph provided in this application will be further described in detail below through specific embodiments.

[0056] Target user behavior graph construction: Each log entry in the target user's historical behavior log is abstracted as a behavior node in the graph model. Various behaviors in the log entries are recorded as attributes of the corresponding behavior nodes. All behavior nodes are compared pairwise. If the similarity is greater than the edge establishment threshold, then the behavior node is directly edged. After all behavior nodes are compared, the target user behavior graph is constructed.

[0057] target users All of the historical behavior logs Each log entry is abstracted as a behavior node in a graph model. The various behaviors in the log entries are recorded as attributes of the corresponding behavior nodes. Any two behavior nodes and Similarity between It is determined by the sum of the probabilities of occurrence of the features they commonly contain: ,in, and These are nodes and The set of features included It is a feature The probability of occurrence; if the similarity between two behavioral nodes is greater than a threshold. Then, an edge is established between these two behavior nodes, with the weight of the edge equal to the similarity value. (Target user behavior graph) Construction complete.

[0058] Taking the scenario of abnormal user login behavior assessment as an example, the user historical logs and the various behavior records contained therein can be flexibly collected according to the actual deployed business system environment.

[0059] For example, if this application is applied to an enterprise's unified identity authentication or zero-trust gateway system, the log entries can correspond to each user's authentication request. The "behavior type" can be recorded as login, application access, resource request, etc.; the "accessed resource" can be specifically identified as the name or URL (Uniform Resource Locator) of the business application system the user attempted to access; the "source IP address" can be resolved using an IP geolocation database to obtain richer geographical and network attributes such as login city, geographical region, and ISP (Internet Service Provider) operator; for the collection of "device information," the device ID (Identification) or hostname registered in the terminal management system can be directly collected; more generally, information such as operating system, browser type, and version can be extracted by parsing the User-Agent string (an HTTP request header field) in the HTTP (Hypertext Transfer Protocol) request header; or, more advanced device fingerprinting technology can be used to generate a unique identifier for each device by comprehensively analyzing multi-dimensional information such as browser, font, screen resolution, and plugins. This method maintains a high recognition accuracy even when users clear cookies (small text files) or use privacy mode.

[0060] According to an embodiment of this application, the above-mentioned invocation of the trained graph attention neural network to perform context-aware embedding processing on the behavior nodes of the encoded target user behavior graph to obtain a node-level embedding set includes: extracting the feature set of the behavior nodes of the encoded target user behavior graph, and performing feature transformation processing on the feature set of the behavior nodes based on learnable weights to obtain a feature transformation set of the behavior nodes; calculating the attention weight between the behavior node and its neighboring behavior nodes, and using the attention weight to perform feature weighting processing on the feature transformation set of the neighboring behavior nodes to obtain a node-level embedding set of the behavior nodes.

[0061] According to an embodiment of this application, the trained graph attention neural network is trained using an unsupervised contrastive learning framework, including: uniformly encoding the category features of behavior nodes in the original behavior graph samples to obtain target behavior graph samples; calling the graph attention neural network to perform context-aware embedding processing on the target behavior graph samples to obtain a node-level embedding sample set; calling a preset readout function to aggregate the node-level embedding sample set to obtain graph-level representation vector samples of the behavior graph samples; calling a bilinear scoring discriminator to perform consistency scoring processing on the node-level embedding sample set and the graph-level representation vector samples to obtain a consistency scoring result; calling a contrastive loss function based on the expectation distribution to process the consistency scoring result to maximize the mutual information between the node-level embedding sample set and the graph-level representation vector samples to obtain a contrastive loss value; and using the contrastive loss value to update the parameters of the graph attention neural network to obtain the trained graph attention neural network.

[0062] The embodiments described above in this application dynamically evaluate the semantic relevance between each behavioral node and its neighborhood through learnable attention coefficients. For example, the association weight between consecutive clicks on the "shopping cart" and "payment" actions will be significantly higher than the weak association between "browsing ads" and "page refresh". This mechanism enables the model to automatically focus on highly discriminative behavioral patterns, significantly improving the accuracy of capturing user intent, especially robust to sparse or noisy behavioral data. A two-level embedding alignment mechanism achieves semantic consistency learning from local behaviors to global behavioral patterns. Node-level embeddings capture the contextual features of individual behaviors, while graph-level representations aggregate into a global semantic vector of user behaviors. A bilinear discriminator scores the consistency between the two, and a contrastive loss function based on expectation distribution maximizes their mutual information. The model can automatically learn the deep structural patterns in behavioral sequences without any manual annotation, effectively overcoming the practical bottleneck of scarce labels. The introduction of a bilinear scoring mechanism, using a learnable matrix to perform cross-space interactive scoring of node embeddings and graph representations, not only preserves the diversity of node-level features but also enhances the sensitivity of graph-level representations to local structural changes. This design significantly improves the discriminative power and generalization ability of the representation, avoiding the "information collapse" problem. It considers both the topological structure and node attributes of the behavioral graph during the mutual information maximization process. By using edge connectivity as a weighting factor in mutual information calculation, the model can simultaneously learn the dual semantics of "who behaves similarly to whom" and "why they are similar," achieving structure-aware representation learning. This framework is entirely based on unsupervised contrastive learning and can be directly applied to massive amounts of unlabeled behavioral logs without relying on user profiles or manually defined rules.

[0063] According to an embodiment of this application, the above-mentioned processing of unified encoding of the category features of behavior nodes in the original behavior graph sample to obtain the target behavior graph sample includes: constructing a globally shared dictionary for the category features of behavior nodes by traversing the user behavior training dataset corresponding to the original behavior graph sample, and reserving a dedicated dimension in the globally shared dictionary, wherein the dedicated dimension is used to represent the value of unknown category features outside the user behavior training dataset; mapping the category features corresponding to the behavior nodes to index values ​​using the globally shared dictionary, and performing one-hot encoding on the index values ​​to obtain the numerical vector of the category features; concatenating the numerical vectors of all category features of the behavior nodes to obtain the target behavior graph sample with globally unified encoding of nodes.

[0064] The following detailed description of the process provided by the above-described implementation of this application, namely, "inputting the target user behavior graph into an unsupervised contrastive learning framework composed of a graph attention neural network, a readout function, and a discriminator, to learn a graph-level representation vector for the target user behavior graph; the contrastive learning framework is trained using a trusted user behavior graph, and its loss function aims to maximize the mutual information between the graph-level representation and the node-level representation," will be further explained.

[0065] Before inputting the target user behavior graph into the graph representation learning framework, the categorical features in the node attributes are uniformly encoded based on all behaviors of all users in the training dataset to construct a globally shared feature space; a graph attention neural network is used as the encoder to process the user behavior graph. and each of the behavior nodes Generate node-level embeddings As shown in formula (1):

[0066] (1).

[0067] Use a readout function that is insensitive to the node order and whose order remains unchanged. Aggregate all node-level embeddings The vector is represented at the graph level as shown in formula (2):

[0068] (2).

[0069] A discriminant using a bilinear scoring function is shown in formula (3):

[0070] (3).

[0071] For graph-node pairs The consistency is scored, and the probability that the node belongs to the graph is calculated. It is a learnable rating matrix. It is the Sigmoid activation function; during the training phase of the graph attention neural network, the contrastive loss function is used, as shown in formula (4):

[0072] (4).

[0073] This loss function is minimized to maximize the mutual information between the graph and the node representation. Representation diagram The set of all nodes in the set. This represents the expected value function of the corresponding data distribution. It is from a different user behavior graph The nodes sampled in the middle.

[0074] For example, in the global attribute encoding before training a graph attention neural network, categorical features in all node attributes, such as source IP address, device information, and login city, are uniformly vectorized and encoded. All user behavior logs in the training dataset are traversed to construct a globally shared dictionary for all unique values ​​under each feature category (e.g., '202.108.22.5', '123.116.34.8', etc.). Subsequently, these categorical features are converted into numerical vectors using methods such as one-hot encoding. To enhance the robustness of the graph attention neural network in production environments, a dimension can be reserved in the encoded vector to represent new feature values ​​that have not appeared during the training phase, thereby preventing model failure due to the emergence of new devices or IP addresses.

[0075] According to an embodiment of this application, the above-mentioned clustering of the graph-level representation vector of the trusted user behavior graph verified by experts to obtain a trusted behavior profile set includes: using a leader clustering algorithm to calculate the norm distance set between all leaders in the current leader set and the graph-level representation vector of the trusted user behavior graph; when each distance in the norm distance set is less than a distance threshold, the graph-level representation vector of the trusted user behavior graph is added to the current leader set as a new cluster center to obtain the trusted behavior profile set.

[0076] According to an embodiment of this application, the above-mentioned abnormality detection processing of the target user's behavior based on the norm distance between the graph-level representation vector of the target user behavior graph and the set of trusted behavior contours, and the detection results include: calculating the L2 norm distance between the graph-level representation vector of the target user behavior graph and all graph-level representation vectors in the set of trusted behavior contours, and obtaining the L2 norm distance set; if there is an L2 norm distance in the L2 norm distance set that is greater than the distance threshold, it is determined that the target user's behavior has an abnormality.

[0077] The following detailed description of the target user behavior anomaly detection process provided in the above embodiments is provided through specific implementation methods.

[0078] First, establish normal behavior profiles: A leader clustering algorithm is used to process the graph representation vectors (i.e., graph-level representation vectors) of a group of normal users to establish a normal behavior profile set. , A set representing the outlines of normal behavior. Indicates the first The central graph representation vector of the normal user behavior cluster Indicates the first The central graph representation vector of the normal user behavior cluster, for any new graph representation vector Calculate the L2 norm distance between it and all existing leader profiles, as shown in Equation (5):

[0079] (5).

[0080] If the minimum distance is greater than the preset threshold If the vector is selected as the new leader profile, then the vector is established as the new leader profile. Secondly, when the graph representation vector corresponding to a new user is evaluated, the L2 norm distance between it and all existing leader profiles is calculated. If it cannot be classified into the normal behavior profile set, then the user is determined to have abnormal behavior.

[0081] According to an embodiment of this application, the above-mentioned method for detecting anomalies in user behavior further includes: associating utility scores with each graph-level representation vector in the trusted behavior contour set, and periodically decaying the associated utility scores of each graph-level representation in the trusted behavior contour set; increasing the utility score of the current graph-level representation vector when the graph-level representation vector of the target user behavior graph successfully matches the current graph-level representation vector in the trusted behavior contour set; and deleting the current graph-level representation vector from the trusted behavior contour set when the utility score of the current graph-level representation vector in the trusted behavior contour set is lower than the contour set pruning threshold.

[0082] The following detailed description of the updating process of the trusted behavior profile set provided in this application is based on specific implementation methods.

[0083] To address concept drift, the normal behavior profile set (i.e., the credible behavior profile set) is continuously updated. When a user marked as abnormal passes verification, their graph representation vector is added to the new normal behavior profile. A utility score is set for each profile and periodically decayed. Outdated profiles with utility scores below the threshold are removed.

[0084] First, when a user behavior marked as abnormal by the system is subsequently verified as legitimate, its corresponding graph representation vector is added to the normal behavior contour set as the center of a new normal user behavior cluster, enabling the model to learn new normal behavior patterns. Second, during the contour set pruning process, a utility score is associated with each normal user behavior cluster center. When a normal user behavior is successfully matched with a normal user behavior cluster center, the utility score of that cluster center is increased. The utility scores of all normal user behavior cluster centers are periodically decayed. When the utility score of a normal user behavior cluster center falls below a preset pruning threshold due to long-term inactivity, it is removed from the normal behavior contour set, allowing the model to forget outdated behavior patterns.

[0085] The expansion of the trusted behavior profile set is triggered when a user deemed to have abnormal behavior passes an additional verification step. For example, when a user's behavior graph-level representation vector is marked as abnormal because its distance from all existing normal behavior profiles exceeds a threshold, the system can automatically trigger an enhanced authentication process, such as requiring the user to complete a multi-factor authentication challenge. If the user successfully passes this verification, the system considers this "abnormal" behavior to be a new, legitimate behavior pattern.

[0086] This application provides a method for detecting anomalies in user behavior. Based on an unsupervised contrastive graph learning framework, it constructs a user behavior graph that reflects the contextual relationships of behavior from each user's discrete behavior logs over a period of time. Using the contrastive graph learning framework, a comprehensive, graph-level representation vector is automatically learned for each user behavior graph in an unsupervised manner. The core of this framework is to maximize the mutual information between the global representation of the graph and the local representations of its internal nodes, thereby ensuring that the generated vectors can highly summarize the overall structure and key attribute details of the graph. By performing leader clustering on the graph representation vectors of normal users, a dynamic "normal behavior profile" baseline model is established. Any new user's behavior, if its representation vector significantly deviates from all established normal profiles, is judged as abnormal. Finally, through an online adaptive mechanism, new normal behaviors are learned and outdated patterns are forgotten to continuously update the profile set. The method provided in this application does not require pre-labeled samples, can automatically learn a deep representation of user behavior, and accurately and efficiently detect unknown and changing abnormal users and behavioral threats through a dynamic baseline.

[0087] Based on the above-mentioned method for detecting anomalies in user behavior, this application also provides a device for detecting anomalies in user behavior. The following will combine... Figure 3 The device is described in detail.

[0088] Figure 3 A structural block diagram of a user behavior anomaly detection device according to an embodiment of this application is shown.

[0089] like Figure 3 As shown, the user behavior anomaly detection device 300 in this embodiment includes a behavior graph construction module 30, a graph-level representation vector acquisition module 320, and an abnormal behavior detection module 330.

[0090] The behavior graph construction module 310 is used to construct a target user behavior graph based on the target user's authorization information. In one embodiment, the behavior graph construction module 310 can be used to perform the operation S210 described above, which will not be repeated here.

[0091] The graph-level representation vector acquisition module 320 is used to perform global unified encoding processing on the categories of behavior nodes in the target user behavior graph to obtain the encoded target user behavior graph. It then calls the trained graph attention neural network to perform context-aware embedding processing on the behavior nodes of the encoded target user behavior graph to obtain a node-level embedding set. Finally, it performs feature aggregation processing on the node-level embedding set to obtain the graph-level representation vector of the target user behavior graph. The trained graph attention neural network is trained based on an unsupervised contrastive learning framework. In one embodiment, the graph-level representation vector acquisition module 320 can be used to perform the operation S220 described above, which will not be repeated here.

[0092] The abnormal behavior detection module 330 is used to cluster the graph-level representation vectors of the trusted user behavior graph verified by experts to obtain a trusted behavior contour set, and to perform anomaly detection processing on the target user's behavior based on the norm distance between the graph-level representation vectors of the target user behavior graph and the trusted behavior contour set, thereby obtaining the detection result. In one embodiment, the abnormal behavior detection module 330 can be used to perform the operation S230 described above, which will not be repeated here.

[0093] According to embodiments of this application, any plurality of modules in the behavior graph construction module 30, the graph-level representation vector acquisition module 320, and the abnormal behavior detection module 330 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the behavior graph construction module 30, the graph-level representation vector acquisition module 320, and the abnormal behavior detection module 330 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the behavior graph construction module 30, the graph-level representation vector acquisition module 320, and the abnormal behavior detection module 330 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0094] Figure 4 A block diagram of an electronic device suitable for implementing an anomaly detection method for user behavior according to an embodiment of this application is shown.

[0095] like Figure 4 As shown, an electronic device 400 according to an embodiment of this application includes a processor 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage portion 408 into a random access memory (RAM) 403. The processor 401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 401 may also include onboard memory for caching purposes. The processor 401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0096] RAM 403 stores various programs and data required for the operation of electronic device 400. Processor 401, ROM 402, and RAM 403 are interconnected via bus 404. Processor 401 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 402 and / or RAM 403. It should be noted that the programs may also be stored in one or more memories other than ROM 402 and RAM 403. Processor 401 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0097] According to embodiments of this application, the electronic device 400 may further include an input / output (I / O) interface 405, which is also connected to a bus 404. The electronic device 400 may also include one or more of the following components connected to the input / output (I / O) interface 405: an input section 406 including a keyboard, mouse, etc.; an output section 407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output (I / O) interface 405 as needed. A removable medium 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 410 as needed so that computer programs read from it can be installed into the storage section 408 as needed.

[0098] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0099] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 402 and / or RAM 403 and / or one or more memories other than ROM 402 and RAM 403 described above.

[0100] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0101] When the computer program is executed by the processor 401, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0102] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via communication section 409, and / or installed from removable medium 411. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0103] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by processor 401, it performs the functions defined in the system of this application embodiment. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0104] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0105] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0106] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

[0107] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. A method for detecting anomalies in user behavior, characterized in that, The method includes: Construct a target user behavior graph based on the target user's authorization information; The categories of behavior nodes in the target user behavior graph are globally uniformly encoded to obtain an encoded target user behavior graph. A trained graph attention neural network is then called to perform context-aware embedding processing on the behavior nodes of the encoded target user behavior graph to obtain a node-level embedding set. The node-level embedding set is then subjected to feature aggregation processing to obtain a graph-level representation vector of the target user behavior graph. The trained graph attention neural network is trained based on an unsupervised contrastive learning framework. Clustering is performed on the graph-level representation vectors of the trusted user behavior graph verified by experts to obtain a set of trusted behavior contours. Anomaly detection is then performed on the behavior of the target user based on the norm distance between the graph-level representation vectors of the target user behavior graph and the set of trusted behavior contours to obtain the detection results.

2. The method according to claim 1, characterized in that, Also includes: If the detection results indicate that the target user's behavior is abnormal, the target user's behavior will be subject to expert verification. If the expert verification results indicate that the target user's behavior is credible, the graph-level representation vector of the target user's behavior graph is added to the credible behavior profile set.

3. The method according to claim 1, characterized in that, Constructing a target user behavior map based on the target user's authorization information includes: Based on the authorization information of the target user, the historical behavior log of the target user is obtained, and the behavior records in the historical behavior log are parsed and processed to obtain the behavior nodes of the target user behavior graph and the attribute information of the behavior nodes. The attribute information of each behavior node is processed by feature extraction to obtain the feature set of each behavior node, and the probability of each feature appearing in all features is obtained by traversing the feature sets of all behavior nodes. Determine the common features between the feature sets of any two behavioral nodes, and sum the occurrence probabilities of the common features to obtain the similarity between the behavioral nodes; If the similarity is greater than a similarity threshold, an edge is established between the two behavioral nodes corresponding to the similarity, wherein the weight of the edge is the similarity.

4. The method according to claim 1, characterized in that, The trained graph attention neural network is invoked to perform context-aware embedding processing on the behavior nodes of the encoded target user behavior graph, resulting in a node-level embedding set including: Extract the feature set of the behavior nodes of the encoded target user behavior graph, and perform feature transformation processing based on learnable weights on the feature set of the behavior nodes to obtain the feature transformation set of the behavior nodes. Calculate the attention weights between the behavior node and its neighboring behavior nodes, and use the attention weights to perform feature weighting on the feature transformation set of the neighboring behavior nodes to obtain the node-level embedding set of the behavior node.

5. The method according to claim 1, characterized in that, The trained graph attention neural network, based on an unsupervised contrastive learning framework, includes: The original behavior graph samples are processed by uniform encoding of the category features of the behavior nodes to obtain the target behavior graph samples; The target behavior graph samples are subjected to context-aware embedding processing by a graph attention neural network to obtain a node-level embedding sample set. The node-level embedded sample set is aggregated by calling a preset readout function to obtain the graph-level representation vector sample of the behavior graph sample; The bilinear scoring discriminant is invoked to perform consistency scoring on the node-level embedded sample set and the graph-level representation vector sample to obtain the consistency scoring result. The consistency score result is processed by calling the contrastive loss function based on the expected distribution to maximize the mutual information between the node-level embedded sample set and the graph-level representation vector sample, and the contrastive loss value is obtained. The parameters of the graph attention neural network are updated using the contrastive loss value to obtain the trained graph attention neural network.

6. The method according to claim 5, characterized in that, The original behavior graph samples are processed by uniform encoding of the category features of the behavior nodes to obtain the target behavior graph samples, including: A global shared dictionary is constructed by traversing the user behavior training dataset corresponding to the original behavior graph samples to build the category features of the behavior nodes, and a dedicated dimension is reserved in the global shared dictionary, wherein the dedicated dimension is used to represent the value of unknown category features outside the user behavior training dataset; The category features corresponding to the behavior nodes are mapped to index values ​​using the global shared dictionary, and the index values ​​are then one-hot encoded to obtain the numerical vector of the category features. The numerical vectors of all category features of the behavior node are concatenated to obtain a target behavior graph sample with a globally unified encoding of the node.

7. The method according to claim 1, characterized in that, Clustering is performed on the graph-level representation vectors of the trusted user behavior graphs verified by experts to obtain a set of trusted behavior profiles, including: The norm distance set between all leaders in the current leader set and the graph-level representation vector of the trusted user behavior graph is calculated using a leader clustering algorithm; If every distance in the norm distance set is less than a distance threshold, the graph-level representation vector of the trusted user behavior graph is added to the current leader set as a new cluster center to obtain the trusted behavior profile set.

8. The method according to claim 1, characterized in that, Anomaly detection processing of the target user's behavior is performed based on the norm distance between the graph-level representation vector of the target user's behavior graph and the set of credible behavior contours, and the detection results include: Calculate the L2 norm distance between the graph-level representation vector of the target user behavior graph and all graph-level representation vectors in the trusted behavior profile set to obtain the L2 norm distance set; If an L2 norm distance is greater than a distance threshold in the L2 norm distance set, it is determined that the target user's behavior is abnormal.

9. The method according to claim 2, characterized in that, Also includes: Associate utility scores for each graph-level representation vector in the trusted behavior profile set, and perform periodic decay processing on the associated utility scores of each graph-level representation in the trusted behavior profile set; If the graph-level representation vector of the target user behavior graph successfully matches the current graph-level representation vector in the trusted behavior profile set, the utility score of the current graph-level representation vector is increased. If the utility score of the current graph-level representation vector in the trusted behavior contour set is lower than the contour set pruning threshold, the current graph-level representation vector will be removed from the trusted behavior contour set.

10. A device for detecting anomalies in user behavior, characterized in that, The device includes: The behavior graph construction module is used to construct a behavior graph of the target user based on the target user's authorization information; The graph-level representation vector acquisition module is used to perform global unified encoding on the categories of behavior nodes in the target user behavior graph to obtain an encoded target user behavior graph. The module then calls a trained graph attention neural network to perform context-aware embedding on the behavior nodes in the encoded target user behavior graph to obtain a node-level embedding set. Finally, the module performs feature aggregation on the node-level embedding set to obtain the graph-level representation vector of the target user behavior graph. The trained graph attention neural network is trained based on an unsupervised contrastive learning framework. The abnormal behavior detection module is used to cluster the graph-level representation vectors of the trusted user behavior graph verified by experts to obtain a set of trusted behavior contours, and to perform anomaly detection processing on the behavior of the target user based on the norm distance between the graph-level representation vectors of the target user behavior graph and the set of trusted behavior contours to obtain the detection results.

Images