Machine learning-based service running invocation behavior real-time compliance detection method, system, electronic device and computer readable storage medium

Abstract

The application relates to the field of service operation safety detection, in particular to a service operation calling behavior real-time compliance detection method and system based on machine learning, an electronic device and a computer readable storage medium, in the scene of dynamic change of a distributed service calling graph, service calling sequence information and service dependence topology information are jointly modeled, and feature extraction emphasis is dynamically adjusted according to different business scenes; when the detection result exists conflicts, stable adaptive resolution is carried out, and after a new type of violation mode is identified, the closed loop update of model parameters and a compliance rule library is realized, so that the real-time performance, complex behavior representation capability, result reliability, stability and adaptive processing capability of service operation calling behavior compliance detection are improved.

Description

Technical Field

[0001] This invention relates to the field of service operation security detection, and in particular to a method, system, electronic device, and computer-readable storage medium for real-time compliance detection of service operation call behavior based on machine learning. Background Technology

[0002] With the development of cloud-native technologies, microservice architectures, and distributed computing technologies, the way services are invoked in software systems has gradually evolved from internal process calls in traditional monolithic applications to networked calls across services, nodes, and clusters. In the above architecture, a single business process usually involves continuous calls between multiple service instances, and service instances may also dynamically scale up or down according to load conditions, resulting in service call relationships that are dynamically changing, have long chains, and complex dependencies.

[0003] In scenarios such as finance, power, industrial internet, and government platforms, how to conduct online detection of call behavior during service operation and promptly identify unauthorized calls, abnormal access, or high-risk calls has become a key technical issue in service security governance and operational compliance control. Existing technology CN112199259A (a method and system for fault determination and implementation based on a rule engine) discloses a method that pre-configures business rules, invokes a rule engine, and outputs the determination results. While simple to implement and highly interpretable, it has weak adaptability to dynamic changes in the service call graph and often relies on manual rule additions for new violation patterns. Existing technology CN117972319A (a method and device for call chain anomaly detection based on dynamic graph self-supervised learning) discloses parsing microservice call chain data, constructing a dynamic graph, and performing anomaly judgment. It can detect some complex anomaly patterns, but due to its reliance on centralized processing of call analysis results, it struggles to provide stable online detection and handling results during service call execution. The existing technology CN115185736A (Method and Apparatus for Microservice Call Chain Anomaly Detection Based on Graph Convolutional Neural Network) discloses a scheme that combines BiLSTM and graph convolutional networks to uniformly model the call chain response time and execution path. However, it lacks joint representation, dynamic adaptation, and stable and interpretable conflict resolution paths for bidirectional interaction. Therefore, there is an urgent need for a technical solution that can detect service call behavior in real time and in compliance with regulations. Summary of the Invention

[0004] Existing service calls involve continuous calls between multiple service instances, resulting in dynamic changes in service call relationships, long chains, and complex dependencies. Traditional service call behavior detection methods are unable to identify unauthorized calls, abnormal access, and high-risk calls in a timely manner, and cannot ensure service security governance and operational compliance control.

[0005] To address the above problems, this invention provides a method for real-time compliance detection of service call behavior based on machine learning, the method comprising the following steps:

[0006] S100: Real-time collection and preprocessing of service operation call behavior data to construct service call sequences and service call relationship graphs; determining scene perception weights based on the attributes of the current service operation calls to adjust the intensity of attention allocation during the multi-dimensional behavioral feature extraction process; wherein, the scene perception weights are generated by service type factors, time period factors, and regulatory level factors;

[0007] S200: Input the extracted multidimensional behavioral features into the hierarchical temporal-spatial feature interaction network. Based on the service call sequence and the service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features respectively within the same sliding time window, which are used as temporal correlation features and spatial correlation features. Based on the temporal correlation features and spatial correlation features, perform space-to-temporal injection and temporal-to-space injection to obtain a multidimensional behavioral feature vector.

[0008] S300: Input the multi-dimensional behavioral feature vector into the three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and context risk results to determine the degree of conflict and the degree of uncertainty of the result; select a conflict resolution strategy based on the degree of conflict and the degree of uncertainty of the result to obtain the final detection result;

[0009] S400: Perform a tiered response operation based on the final detection result; when a new violation pattern is detected, perform incremental learning to update the machine learning model and compliance rule base.

[0010] Preferably, in S100, service call behavior data is collected and preprocessed in real time to construct a service call sequence and a service call relationship graph; the scene perception weight is determined based on the attributes of the current service call, thereby adjusting the attention allocation intensity in the multi-dimensional behavioral feature extraction process, specifically as follows:

[0011] Service operation and call behavior data are collected in real time through several acquisition channels; wherein, the several acquisition channels include a service mesh bypass acquisition interface, an API gateway, and monitoring tools; the service operation and call behavior data includes caller identifier, callee identifier, call timestamp, call chain data, return result, and call context environment data;

[0012] The service call behavior data is preprocessed with unified timestamps and call identifier alignment to generate standardized behavior records of service call events; based on the standardized behavior records, a service call sequence and a service call relationship graph are constructed.

[0013] The scene perception weight is determined based on the service type, time interval, and regulatory level of the current service operation. The scene perception weight is multiplied by the basic attention score to adjust the attention allocation intensity in the multidimensional behavioral feature extraction process. The multidimensional behavioral features include basic features, temporal features, contextual features, and abnormal features.

[0014] Preferably, in S200, the extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence and the service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features within the same sliding time window, which are then used as temporal correlation features and spatial correlation features. Based on the temporal correlation features and spatial correlation features, space-to-temporal injection and temporal-to-space injection are performed to obtain a multidimensional behavioral feature vector, specifically:

[0015] The extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence, call order relationship, call frequency change, and call interval change are extracted as temporal association features. Based on the service call relationship graph, service dependency relationship, call path relationship, and node adjacency relationship are extracted as spatial association features.

[0016] The spatial correlation features are injected into the temporal state update process to obtain the first fusion feature; the temporal correlation features are injected into the spatial feature extraction process to obtain the second fusion feature; the first fusion feature and the second fusion feature are fused by bidirectional attention to obtain a multidimensional behavioral feature vector.

[0017] Preferably, in step S300, the multi-dimensional behavioral feature vector is input into a three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and contextual risk results to determine the degree of conflict and the degree of uncertainty of the result; a conflict resolution strategy is selected based on the degree of conflict and the degree of uncertainty of the result to obtain the final detection result, specifically as follows:

[0018] The multidimensional behavioral feature vector is input into the rule fast matching module of the three-level fusion detection model, and the rule detection result is output based on the compliance rule library.

[0019] The multidimensional behavioral feature vector is input into the machine learning deep analysis module of the three-level fusion detection model to output the model detection result.

[0020] The rule detection results, the model detection results, and the invocation context data are input into the risk comprehensive assessment module of the three-level fusion detection model to output the context risk results.

[0021] Based on the rule detection results, the model detection results, and the context risk results, determine the conflict score and the outcome uncertainty score;

[0022] Based on the conflict score and the result uncertainty score, a comprehensive credibility score is determined; based on the interval in which the comprehensive credibility score falls, any one of the confidence weighting strategy, negotiation resolution strategy, or secondary verification strategy is selected to obtain the final detection result.

[0023] Preferably, in S400, a tiered response operation is performed based on the final detection result; when a new violation pattern is detected, incremental learning is performed to update the machine learning model and the compliance rule base, specifically as follows:

[0024] A tiered response operation is executed based on the final detection result; wherein the tiered response operation includes at least one of allowing the call to continue execution, triggering an alarm and recording the violation, or blocking the violation call;

[0025] When a new violation pattern is detected, incremental learning is performed based on the samples of the new violation pattern to update the model parameters of the machine learning deep analysis module; candidate rules are generated from the detection results corresponding to the samples of the new violation pattern, and the candidate rules are pruned and filtered. After meeting the preset conditions, they are written into the dynamically generated rule layer of the compliance rule base.

[0026] On the other hand, the present invention provides a real-time compliance detection system for service operation call behavior based on machine learning, the system comprising the following modules:

[0027] The data acquisition and preprocessing module is used to collect and preprocess service operation and call behavior data in real time, and to build service call sequences and service call relationship graphs.

[0028] The feature extraction and adjustment module is used to determine the scene perception weight based on the attributes of the current service operation call, thereby adjusting the attention allocation intensity in the multi-dimensional behavioral feature extraction process; wherein, the scene perception weight is generated by the service type factor, time period factor and regulatory level factor;

[0029] The associated feature extraction module is used to input the extracted multidimensional behavioral features into the hierarchical temporal-spatial feature interaction network. Based on the service call sequence and the service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features in the same sliding time window, which are used as temporal associated features and spatial associated features.

[0030] The fusion module is used to perform space-to-temporal injection and temporal-to-space injection based on the temporal correlation features and the spatial correlation features to obtain a multi-dimensional behavioral feature vector;

[0031] The compliance detection module is used to input the multi-dimensional behavioral feature vector into the three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and context risk results to determine the degree of conflict and the degree of uncertainty of the results.

[0032] The detection result generation module is used to select a conflict resolution strategy based on the degree of conflict and the degree of uncertainty of the result, so as to obtain the final detection result.

[0033] A graded response module is used to perform graded response operations based on the final detection result;

[0034] The update module is used to perform incremental learning to update the machine learning model and compliance rule base when a new violation pattern is detected.

[0035] Preferably, the data acquisition and preprocessing module is used to acquire and preprocess service operation and call behavior data in real time, and to construct service call sequences and service call relationship graphs, specifically:

[0036] Service operation and call behavior data are collected in real time through several acquisition channels; wherein, the several acquisition channels include a service mesh bypass acquisition interface, an API gateway, and monitoring tools; the service operation and call behavior data includes caller identifier, callee identifier, call timestamp, call chain data, return result, and call context environment data;

[0037] The service call behavior data is preprocessed with unified timestamps and call identifier alignment to generate standardized behavior records of service call events; based on the standardized behavior records, a service call sequence and a service call relationship graph are constructed.

[0038] The feature extraction and adjustment module is used to determine scene-aware weights based on the attributes of the current service call, thereby adjusting the attention allocation intensity during the multi-dimensional behavioral feature extraction process. Specifically:

[0039] The scene perception weight is determined based on the service type, time interval, and regulatory level of the current service operation. The scene perception weight is multiplied by the basic attention score to adjust the attention allocation intensity in the multidimensional behavioral feature extraction process. The multidimensional behavioral features include basic features, temporal features, contextual features, and abnormal features.

[0040] Preferably, the association feature extraction module is used to input the extracted multidimensional behavioral features into a hierarchical temporal-spatial feature interaction network, and generate initial temporal features and initial spatial features respectively within the same sliding time window through the hierarchical temporal-spatial feature interaction network according to the service call sequence and the service call relationship graph, which are then used as temporal association features and spatial association features, specifically:

[0041] The extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence, call order relationship, call frequency change, and call interval change are extracted as temporal association features. Based on the service call relationship graph, service dependency relationship, call path relationship, and node adjacency relationship are extracted as spatial association features.

[0042] The fusion module is used to perform space-to-temporal injection and temporal-to-space injection based on the temporal correlation features and the spatial correlation features to obtain a multi-dimensional behavioral feature vector, specifically:

[0043] The spatial correlation features are injected into the temporal state update process to obtain the first fusion feature; the temporal correlation features are injected into the spatial feature extraction process to obtain the second fusion feature; the first fusion feature and the second fusion feature are fused by bidirectional attention to obtain a multidimensional behavioral feature vector.

[0044] Preferably, the compliance detection module is used to input the multi-dimensional behavioral feature vector into a three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and contextual risk results, thus determining the degree of conflict and the degree of uncertainty of the results, specifically:

[0045] The multidimensional behavioral feature vector is input into the rule fast matching module of the three-level fusion detection model, and the rule detection result is output based on the compliance rule library.

[0046] The multidimensional behavioral feature vector is input into the machine learning deep analysis module of the three-level fusion detection model to output the model detection result.

[0047] The rule detection results, the model detection results, and the invocation context data are input into the risk comprehensive assessment module of the three-level fusion detection model to output the context risk results.

[0048] Based on the rule detection results, the model detection results, and the context risk results, determine the conflict score and the outcome uncertainty score;

[0049] The detection result generation module is used to select a conflict resolution strategy based on the degree of conflict and the uncertainty of the result, thereby obtaining the final detection result. Specifically:

[0050] Based on the conflict score and the result uncertainty score, a comprehensive credibility score is determined; based on the interval in which the comprehensive credibility score falls, any one of the confidence weighting strategy, negotiation resolution strategy, or secondary verification strategy is selected to obtain the final detection result.

[0051] Preferably, the graded response module is used to perform a graded response operation based on the final detection result, specifically:

[0052] A tiered response operation is executed based on the final detection result; wherein the tiered response operation includes at least one of allowing the call to continue execution, triggering an alarm and recording the violation, or blocking the violation call;

[0053] The update module is used to perform incremental learning to update the machine learning model and compliance rule base when a new violation pattern is detected. Specifically:

[0054] When a new violation pattern is detected, incremental learning is performed based on the samples of the new violation pattern to update the model parameters of the machine learning deep analysis module; candidate rules are generated from the detection results corresponding to the samples of the new violation pattern, and the candidate rules are pruned and filtered. After meeting the preset conditions, they are written into the dynamically generated rule layer of the compliance rule base.

[0055] The present invention also provides an electronic device comprising at least a memory and a processor, characterized in that a computer program is stored in the memory, the computer program implementing the method described above when executed by the processor.

[0056] The present invention also provides a computer-readable storage medium on which a computer program is stored, the computer program implementing the method described above when executed by a processor.

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] The machine learning-based real-time compliance detection method and system for service call behavior of this invention, in scenarios where the distributed service call graph is dynamically changing, jointly models service call sequence information and service dependency topology information, and dynamically adjusts the focus of feature extraction according to different business scenarios; it also performs stable adaptive resolution when there are conflicts in the detection results, and realizes closed-loop update of model parameters and compliance rule base after identifying new violation patterns, thereby improving the real-time performance, complex behavior representation ability, result credibility, stability and adaptive processing ability of service call behavior compliance detection.

[0059] The real-time compliance detection method and system for service call behavior based on machine learning of the present invention have the following advantages:

[0060] First, the present invention outputs detection results online during the service call execution process, and makes stable decisions through conflict detection and adaptive resolution mechanisms when multiple source detection results conflict, rather than performing centralized analysis only after the call ends.

[0061] Second, this invention does not employ simple splicing or unidirectional injection, but generates initial temporal features and initial spatial features separately within the same sliding time window, then performs bidirectional injection from space to temporal and from temporal to space, and outputs a multidimensional behavioral feature vector through bidirectional attention fusion.

[0062] Third, this invention directly introduces the scene-aware weights generated by service type factors, time period factors and regulatory level factors into the attention calculation process, instead of just using scene information as ordinary input labels. This allows the feature extraction process to pay more attention to core services, highly sensitive time periods and high regulatory level events, thereby improving the targeting of feature extraction and detection stability in complex scenarios.

[0063] Fourth, this invention does not simply use a single threshold to adjudicate the output results of multiple modules. Instead, it calculates a comprehensive credibility score by combining conflict score and uncertainty score, and then selects a confidence weighting, negotiation-based conflict resolution, or secondary verification strategy based on the interval of the comprehensive credibility score. This can improve the stability and interpretability of the judgment in conflict scenarios of multi-source detection results.

[0064] Fifth, after identifying a new type of violation pattern sample, this invention not only updates the model parameters, but also summarizes and generates candidate rules, as well as pruning and filtering, and writes them into the dynamically generated rule layer when the conditions are met, thereby forming a closed-loop update path of "detection-identification-learning-rule-writeback", thereby shortening the adaptation cycle of new violation patterns, reducing manual maintenance costs, and improving the system's ability to continuously detect evolving violations.

[0065] Sixth, this invention improves adaptability to different calling scenarios by incorporating service type, time interval, and regulatory level into the attention allocation during feature extraction; enhances the representation of complex calling behaviors by jointly modeling service call sequences and service call relationship graphs and employing a temporal-spatial bidirectional interaction mechanism for feature fusion; improves the credibility of the final detection results by performing conflict detection and adaptive resolution on rule detection results, model detection results, and contextual risk results; shortens the processing cycle of new violation patterns and reduces manual maintenance costs by performing incremental learning and automatically updating the compliance rule base when new violation patterns are detected; and achieves real-time compliance detection and handling of service operation and calling behaviors through online detection and hierarchical response mechanisms. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0067] Figure 1 This is a flowchart of the real-time compliance detection method for service operation and call behavior based on machine learning provided by the present invention.

[0068] Figure 2 It is the process of collecting and preprocessing service call behavior data.

[0069] Figure 3 This is a schematic diagram of a scene-aware dynamic attention mechanism.

[0070] Figure 4 This is a schematic diagram of a hierarchical temporal-spatial feature interaction network.

[0071] Figure 5 This is a schematic diagram of a three-level fusion detection model.

[0072] Figure 6 It is a closed-loop mechanism for real-time incremental learning and rule generation.

[0073] Figure 7 This is a structural diagram of the real-time compliance detection system for service operation and call behavior based on machine learning provided by the present invention. Detailed Implementation

[0074] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for explaining the present invention and not for limiting the present invention. Furthermore, it should be noted that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, not all structures. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present invention.

[0075] The terms "comprising" and "having," and any variations thereof, used in this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0076] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0077] Please see Figure 1 As shown, this invention provides a method for real-time compliance detection of service call behavior based on machine learning. The method includes the following steps:

[0078] S100: Real-time collection and preprocessing of service operation call behavior data to construct service call sequence and service call relationship graph; determining scene perception weights based on the attributes of the current service operation calls, thereby adjusting the intensity of attention allocation during the multi-dimensional behavioral feature extraction process; wherein, the scene perception weights are generated by service type factors, time period factors and regulatory level factors.

[0079] Furthermore, in S100, service call behavior data is collected and preprocessed in real time to construct service call sequences and service call relationship graphs. Scene awareness weights are determined based on the attributes of the current service call, thereby adjusting the attention allocation intensity during the multi-dimensional behavioral feature extraction process. Specifically:

[0080] Service operation and call behavior data are collected in real time through several acquisition channels, including the service mesh bypass acquisition interface, API gateway, and monitoring tools. The service operation and call behavior data includes caller identifier, callee identifier, call timestamp, call chain data, return results, and call context environment data.

[0081] The service call behavior data is preprocessed with unified timestamps and call identifier alignment to generate standardized behavior records of service call events; based on the standardized behavior records, a service call sequence and a service call relationship graph are constructed.

[0082] The scene perception weight is determined based on the service type, time interval, and regulatory level of the current service operation. The scene perception weight is multiplied by the basic attention score to adjust the intensity of attention allocation in the process of extracting multidimensional behavioral features. Among them, multidimensional behavioral features include basic features, temporal features, contextual features, and abnormal features.

[0083] Please see Figure 2 During real-time data acquisition, service call behavior data is collected through channels such as the service mesh bypass acquisition interface, API gateway, and application performance monitoring tools. Preferably, service call chain data can be obtained through the service mesh bypass acquisition interface; request parameters and return result data can be obtained through the API gateway; and response latency, error codes, and resource usage data can be obtained through application performance monitoring tools. Service call behavior data obtained through these different channels is then aligned according to a unified timestamp and call identifier to generate standardized behavior records corresponding to the same service call event. Based on these standardized behavior records, a service call sequence and a service call relationship graph are constructed to fully represent service call events at both temporal and spatial levels.

[0084] It is understood that multidimensional behavioral features may include, but are not limited to, basic features, temporal features, contextual features, anomaly features, and temporal-spatial fusion features. Basic features may include, but are not limited to, at least one of call frequency features, response time features, error rate features, parameter features, call depth features, and permission level features; contextual features may include, but are not limited to, at least one of access time period features, source identifier features, and business scenario features; anomaly features may include, but are not limited to, anomaly scores output by anomaly detection algorithms; and temporal-spatial fusion features may include, but are not limited to, fusion feature representations output by hierarchical temporal-spatial feature interaction networks.

[0085] Please see Figure 3 To enable the multi-dimensional behavioral feature extraction process to dynamically adjust its focus based on different service call scenarios, a Context-Aware Dynamic Attention (SCAM) mechanism is introduced. This mechanism generates a comprehensive context weight based on service type, time period, and regulatory level factors, and incorporates this comprehensive context weight into the attention calculation process.

[0086] The above service type factor f service The determination method is as follows: When a service belongs to the core transaction category, core control category, or security audit category, it is recorded as a core service, corresponding to f. service =1.5; When a service belongs to the business support, monitoring, or data aggregation category, it is classified as an important service, corresponding to f. service =1.2; When the service belongs to the category of ordinary query, log, or auxiliary services, it is recorded as an ordinary service, corresponding to f. service =1.0.

[0087] The above time period factor f time The determination method is as follows: Each natural day is divided into peak hours, inspection hours, and normal hours according to the preset business operation plan; among them, the peak hours can be determined based on the period in the past preset number of days where the number of requests per unit time exceeds the historical average plus a preset multiple of the standard deviation, corresponding to f time =1.3; The inspection period can be determined based on the manually set compliance inspection period or sensitive business processing period, corresponding to f time =1.1; f corresponds to the normal time period time =0.9.

[0088] The above regulatory rating factor f reg The determination method is as follows: Based on the business objects, data sensitivity level, or operational risk level in the target business scenario, service call events are divided into three levels: strong supervision, medium supervision, and light supervision; strong supervision events correspond to f reg =1.4, corresponding to the regulatory event f reg =1.2, the corresponding f for lightly regulated eventsreg =1.0; The above regulatory level can be determined by a pre-configured mapping table, which includes at least the correspondence between service identifier, business type, data level and regulatory level.

[0089] The operation process of the above scene-aware dynamic attention mechanism is as follows:

[0090]

[0091] In the above formula, This represents the basic attention score between node i corresponding to the current service call event and its neighbor node j, used to measure the influence of node j on node i. LeakyReLU() represents the LeakyReLU activation function, W h Let represent the feature linear transformation matrix, 'a' represent the attention parameter vector, and 'h' represent the feature linear transformation matrix. i h represents the original node representation vector of node i or the feature vector of the node in the previous layer. j W represents the original node representation vector or the feature vector of the previous layer node of node j; where W h Both 'a' and 'a' are initialized using Xavier initialization at the start of model training and are updated during supervised training as the detection loss function is backpropagated.

[0092] Scene perception weight w scene The calculation is as follows: w scene =f service ×f time ×f reg .

[0093] as well as

[0094]

[0095]

[0096] In the above formula, This represents the basic attention score between node i corresponding to the current service call event and its neighbor node j, used to measure the degree of influence of node j on node i. Indicates intermediate parameters. Represents node v i The set of neighboring nodes, σ() represents the updated node representation vector or the feature vector of the previous layer node i; σ() represents the nonlinear activation function; and the comprehensive scenario weight can be fine-tuned according to the joint indicators of the false positive rate and false negative rate of the validation set at a preset time period to adapt to changes in business load and regulatory focus.

[0097] Finally, based on the above service type factor f service The above time period factor f time The above-mentioned regulatory rating factor f reg And generate scene-aware weights w according to the following formula. scene =f service ×f time ×f reg For the node corresponding to the current service call time and its neighboring nodes, the nodes are transformed using a feature linear transformation matrix, and a nonlinear mapping is performed based on the splicing result of the transformed node representation to obtain the basic attention score. Then, the above scene perception weights are combined with the above basic attention score, and the scores of each neighboring node in the current neighboring node set are normalized to obtain the final attention weight, i.e., the attention allocation intensity.

[0098] S200: The extracted multidimensional behavioral features are input into the hierarchical temporal-spatial feature interaction network. Based on the service call sequence and service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features in the same sliding time window, which are used as temporal association features and spatial association features. Based on the temporal association features and spatial association features, spatial-to-temporal injection and temporal-to-spatial injection are performed to obtain multidimensional behavioral feature vectors.

[0099] Furthermore, in S200, the extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence and service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features within the same sliding time window, which are then used as temporal correlation features and spatial correlation features. Based on the temporal correlation features and spatial correlation features, space-to-temporal injection and temporal-to-space injection are performed to obtain a multidimensional behavioral feature vector, specifically:

[0100] The extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence, the network extracts the call order relationship, call frequency change, and call interval change, which serve as temporal association features. Based on the service call relationship graph, the network extracts the service dependency relationship, call path relationship, and node adjacency relationship, which serve as spatial association features.

[0101] Spatial correlation features are injected into the temporal state update process to obtain the first fusion feature; temporal correlation features are injected into the spatial feature extraction process to obtain the second fusion feature; bidirectional attention fusion is performed on the first fusion feature and the second fusion feature to obtain a multidimensional behavioral feature vector.

[0102] To simultaneously model the temporal correlations and service dependency topologies of service call behavior, this invention employs a Hierarchical Temporal-Spatial Feature Interaction Network (HTSFN) to extract joint features from service call sequences and service call relationship graphs. The HTSFN comprises a local interaction layer, a path aggregation layer, and a global semantic layer. Specifically, the local interaction layer extracts local dependencies between adjacent call events and adjacent service nodes; the path aggregation layer aggregates multi-hop temporal-spatial joint features along the service call path; and the global semantic layer extracts a global semantic representation of the overall service call pattern and service dependency structure. Furthermore, the local interaction layer extracts short-range dependencies between adjacent call events and one-hop adjacent nodes; the path aggregation layer aggregates joint features of two-hop and higher service nodes along the call path, using a path accumulation weighting method with a depth not exceeding three hops; and the global semantic layer performs global pooling of the fused features of all call paths within the current time window and obtains a global semantic representation through a fully connected layer.

[0103] For hierarchical temporal-spatial feature interaction networks

[0104]

[0105] In the above formula, LSTM() represents a Long Short-Term Memory network. This represents the initial temporal hidden state at time t, used to characterize the temporal dependency information of the current service call event and its previous call events. This represents the feature vector of the service call event at time t. This represents the temporal hidden state at time t-1;

[0106]

[0107] In the above formula, GRU represents the hidden unit, and AGG() represents the neighbor aggregation function. This represents the initial spatial hidden state of node v, used to characterize the spatial topological features of node v in the service call relationship graph. The graph structure node feature vector representing node v. The graph structure node feature vector representing node u. This represents the set of neighboring nodes of node v.

[0108]

[0109] In the above formula, LSTM() represents a Long Short-Term Memory network. This represents the temporal fusion hidden state after the injection of spatial features. Let the feature vector of the service call event at time t be denoted as . This represents the temporal hidden state of the previous time step. The spatial-to-temporal mapping matrix is ​​learned through joint training with the main detection model. This indicates the service node v corresponding to the service call event at time t. t The space is hidden;

[0110]

[0111] In the above formula, This represents the spatial fusion hidden state after the injection of temporal features, where GRU stands for hidden unit. This represents the initial hidden state of node v. This represents the space-to-temporal mapping matrix. This represents the aggregated representation of the set of temporal hidden states associated with node v after pooling.

[0112]

[0113] In the above formula, softmax() represents the normalized exponential function. This represents the attention weight matrix from spatial features to temporal features. This represents the query matrix generated from spatial features. Represents the time-series key matrix K t transpose, This indicates the dimension of the key vector in the attention calculation, used to scale the dot product result and avoid excessively large values. This represents the attention weight matrix from temporal features to spatial features. This represents the query matrix generated from time-series features. Represents the spatial bond matrix K s Transpose of;

[0114]

[0115] In the above formula, Represents the basic feature vector. Represents the context feature vector. Represents anomaly feature sub-vectors. This represents the temporal-spatial hybrid features output by HTSFN.

[0116] Please see Figure 4To avoid the circular computation problem caused by the interdependence of temporal and spatial features, the hierarchical temporal-spatial feature interaction network of this invention adopts a staged computation method within the same sliding time window. Specifically, within the current sliding time window, a service call sequence and a service call relationship graph are constructed based on standardized behavior records; initial temporal features (i.e., temporal association features) are calculated based on the service call sequence; initial spatial features (i.e., spatial association features) are calculated based on the service call relationship graph; the initial spatial features are injected into the temporal state update process to obtain the first fused feature; the initial temporal features are injected into the spatial feature extraction process to obtain the second fused feature; bidirectional attention fusion is performed on the first and second fused features to output the temporal-spatial fused feature corresponding to the current time window, which serves as the multi-dimensional behavior feature vector.

[0117] S300: Input multi-dimensional behavioral feature vectors into the three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and contextual risk results to determine the degree of conflict and the degree of uncertainty of the results; select conflict resolution strategies based on the degree of conflict and the degree of uncertainty of the results to obtain the final detection results.

[0118] Furthermore, in S300, multi-dimensional behavioral feature vectors are input into a three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and contextual risk results to determine the degree of conflict and the degree of uncertainty of the results. Based on the degree of conflict and the degree of uncertainty of the results, a conflict resolution strategy is selected to obtain the final detection result, specifically:

[0119] The multidimensional behavioral feature vector is input into the rule fast matching module of the three-level fusion detection model, and the rule detection results are output based on the compliance rule library.

[0120] The multidimensional behavioral feature vector is input into the machine learning deep analysis module of the three-level fusion detection model to output the model detection results.

[0121] The rule detection results, model detection results, and invocation context data are input into the risk comprehensive assessment module of the three-level fusion detection model to output context risk results.

[0122] Based on the rule detection results, model detection results, and contextual risk results, determine the conflict score and the outcome uncertainty score;

[0123] Based on the conflict score and the outcome uncertainty score, a comprehensive credibility score is determined; based on the interval in which the comprehensive credibility score falls, one of the following strategies is selected: confidence weighting strategy, negotiation-based resolution strategy, or secondary verification strategy, to obtain the final detection result.

[0124] Understandably, the three-level fusion detection model includes a rule-based rapid matching module, a machine learning deep analysis module, and a risk comprehensive assessment module. The rule-based rapid matching module outputs rule detection results based on the compliance rule library; the machine learning deep analysis module outputs model detection results based on multi-dimensional behavioral feature vectors; and the risk comprehensive assessment module combines rule detection results, model detection results, and call context environment data to output contextual risk results. The aforementioned compliance rule library includes a basic general rule layer, an industry-specific rule layer, and a dynamically generated rule layer. The basic general rule layer stores general detection rules for service call frequency, access permissions, parameter integrity, and abnormal return results; the industry-specific rule layer stores industry compliance rules corresponding to the target business scenario; and the dynamically generated rule layer stores violation pattern rules automatically generated based on incremental learning results. The dynamically generated rule layer refers to the rule layer in the compliance rule library used to store new rules generated from novel violation pattern samples through incremental learning and rule induction. Each rule in the dynamically generated rule layer includes at least one of the following: rule identifier, condition set, judgment result, generation time, source model version, applicable scenario tag, and priority. The aforementioned new violation pattern samples refer to the sample set that meets the preset clustering sample quantity condition and whose similarity to historical violation patterns is lower than the preset similarity threshold.

[0125] Preferably, the machine learning deep analysis module employs a hybrid neural network combining a one-dimensional convolutional neural network and a long short-term memory network. The convolutional part includes two one-dimensional convolutional layers with 64 and 128 convolutional channels respectively, each with a kernel size of 3 and a pooling kernel size of 2. The LSTM part includes one bidirectional LSTM layer with 128 hidden units. Dropout is applied between the convolutional and LSTM layers with a dropout ratio of 0.2. The AdamW optimizer is used during training, with an initial learning rate of 1×10⁻⁶. -4 The weight decays to 1×10 -5 The batch size is 32, and the maximum number of training rounds is 100. Training stops when the validation set AUC does not improve for 8 consecutive rounds.

[0126] To adapt to the computational resource limitations of edge computing nodes, the machine learning deep analysis module deployed on these nodes undergoes lightweighting. This lightweighting includes: 8-bit quantization of convolutional and fully connected layer weights, pruning the bidirectional LSTM layers from two to one, reducing the number of convolutional channels from 128 to 64, and reducing the number of hidden units from 128 to 64. After lightweighting, the edge-side model is used for real-time online inference; incremental learning training, candidate rule induction generation, and full model update are performed on the central node. In another implementation, the edge node retains only the rule fast matching module, conflict resolution module, and lightweight model inference module, without performing the full training process.

[0127] Please see Figure 5 In practice, the rule detection score R is based on the rule detection results, model detection results, and contextual risk results mentioned above. rule Model detection score R ml Contextual risk score R ctx The degree of difference between them is calculated to obtain a conflict score C. s ,Right now The uncertainty score U is calculated based on the larger of the final compliance probability and the final non-compliance probability. s Based on the conflict score C above... s And the uncertainty score U of the above results s Calculate the overall credibility score T s ,Right now α c and β c For the preset coefficient, preferably α c =0.6, β c =0.3. The first and second thresholds corresponding to the overall credibility score are determined based on the judgment accuracy, false positive rate control requirements, or validation set AUC index on historical samples.

[0128] When the overall confidence score is greater than or equal to the first threshold, the final detection result is output using a confidence weighting strategy. Under the aforementioned confidence weighting strategy, the confidence weights of the three modules are determined based on the historical judgment accuracy of the rule module, model module, and context module within the most recent preset time window, and the corresponding output results are weighted and summed to obtain the final detection result.

[0129] When the overall credibility score is less than the first threshold but greater than or equal to the second threshold, a negotiated resolution strategy is adopted to output the final detection result. This negotiated resolution strategy determines the decision contribution of each module based on its historical accuracy, current output confidence, and stability index. Under this strategy, the decision contribution of each module (rule matching, model, and context) is calculated based on its historical accuracy, current output confidence, and stability index within the most recent preset time window. The detection results of the three modules are then weighted according to the normalized decision contribution. If the difference between the weighted final score and the previous result is less than a preset convergence threshold, the final detection result is output; otherwise, the next round of contribution adjustment is performed. When the number of iterations reaches a preset upper limit, the current round result is output as the final detection result.

[0130] Among them, the stability index S i The function used to measure the output fluctuation of the i-th detection module in the most recent N detections is defined as follows:

[0131]

[0132] In the above formula, This represents the output probability of the i-th detection module in the k-th detection. The stability index S represents the average probability of the most recent N outputs. i The larger the value, the more stable the output of the i-th detection module.

[0133] The decision contribution G of the i-th detection module i as follows:

[0134]

[0135] In the above formula, A i C represents the historical accuracy rate. i S represents the current output confidence level. i The stability index is represented by η1, η2, and η3, which represent weighting coefficients, and η1 + η2 + η3 = 1. After normalizing the decision contribution of each detection module, it is used for weighted decision-making in the negotiation-based resolution strategy process.

[0136] When the overall confidence score is less than the second threshold, extended features are extracted and a secondary verification strategy is executed to output the final detection result. Extended features refer to additional features introduced during the secondary verification process that have a wider scope or higher order than the features used in the initial detection. These features include at least one of the following: temporal fluctuation features across adjacent time windows, two-hop and higher call path features, historical anomaly density features, and homogeneous call clustering features. The aforementioned negotiation-based conflict resolution strategy refers to an iterative calculation of the decision contribution of each module—the rule-based fast matching module, the machine learning deep analysis module, and the risk comprehensive assessment module—based on their historical accuracy, current output confidence, and stability indicators, to output the final detection result.

[0137] The determination of the first and second thresholds mentioned above refers to the determination based on at least one of the following: historical sample statistical distribution, validation set performance index, false alarm rate control requirements, and cluster stability index.

[0138] S400: Perform tiered response operations based on the final detection results; when a new violation pattern is detected, perform incremental learning to update the machine learning model and compliance rule base.

[0139] Furthermore, in S400, a tiered response is executed based on the final detection results; when a new violation pattern is detected, incremental learning is performed to update the machine learning model and the compliance rule base, specifically:

[0140] A tiered response operation will be executed based on the final detection results; the tiered response operation includes at least one of the following: allowing the call to continue execution, triggering an alarm and recording the violation, or blocking the violation call;

[0141] When a new violation pattern is detected, incremental learning is performed based on the samples of the new violation pattern to update the model parameters of the machine learning deep analysis module; candidate rules are generated from the detection results corresponding to the samples of the new violation pattern, and the candidate rules are pruned and filtered. After meeting the preset conditions, they are written into the dynamically generated rule layer of the compliance rule base.

[0142] In practice, the comprehensive risk score R is calculated according to the following formula: , where R rule For rule detection scores, R ml For model detection scores, R ctx For contextual risk scoring, α r ,β r γ r The preset weighting coefficients are α. r +β r +γ r=1. When the comprehensive risk score R is less than or equal to the first response threshold, the call is allowed to continue; when the comprehensive risk score R is greater than the first response threshold and less than or equal to the second response threshold, an alarm is triggered and the violation is recorded; when the comprehensive risk score R is greater than the second response threshold, the violation call is blocked, that is, the corresponding service call is blocked and an emergency alarm is triggered.

[0143] Furthermore, online clustering is performed on the set of suspected violation samples generated during real-time detection. The selection logic for suspected violation samples is as follows: samples whose current comprehensive risk score is in the medium-high risk range and whose conflict score is higher than a preset conflict threshold or uncertainty score is higher than a preset uncertainty threshold are added to the set of suspected violation samples.

[0144] Let the m-th cluster be denoted as C. m Its cluster center vector is denoted as z. m The set of historical violation patterns is denoted as {z1} hist z2 hist , ..., z j hist Cluster C will be grouped under the following conditions. m The corresponding sample was identified as a new type of violation pattern.

[0145]

[0146] In the above formula, N th =50, θ sim =0.3.

[0147] Incremental learning is performed on the newly identified violation pattern samples, with the total loss function L total Defined as:

[0148]

[0149] In the above formula, L ce L represents the cross-entropy loss; focal Indicates focal loss; L con Indicates comparative loss; L inc λ1 represents the incremental learning regularization term, used to constrain the deviation between the updated parameters and the key parameters of the old model, in order to reduce catastrophic forgetting; λ1, λ2, and λ3 represent the weight coefficients, λ1=0.5, λ2=0.1, and λ3=0.01, respectively.

[0150]

[0151] In the above formula, θ i old Represents the parameters of the old model, θ i Ω represents the updated model parameters. iΩ represents the importance weight of the parameter. i Determined based on the gradient sensitivity of the old model on the benchmark sample set: .

[0152] The AdamW optimizer was used during the training phase, with an initial learning rate of 1×10⁻⁶. -4 The batch size is 32, and the maximum number of training rounds is 50. Training stops when the validation set AUC does not improve for 5 consecutive rounds.

[0153] When a new violation pattern is detected, incremental learning is performed based on samples of the new violation pattern to update the model parameters of the machine learning deep analysis module. Candidate rules are generated from the detection results corresponding to the samples of the new violation pattern, and these candidate rules are pruned and filtered to update the compliance rule base. Specifically, online clustering is performed on the set of suspected violation samples generated during real-time detection. The filtering logic for suspected violation samples is as follows: samples whose current comprehensive risk score is in the medium-to-high risk range and whose conflict score or uncertainty score is higher than a preset conflict threshold or uncertainty threshold are added to the suspected violation sample set. After incremental learning is completed, candidate rules are generated from the samples of the new violation pattern. Candidate rules are represented by a structure of "condition set + risk judgment result," where the condition set includes at least two of the following: calling object, calling frequency range, time period, parameter feature range, and contextual constraints. Pruning and filtering of candidate rules includes: deleting candidate rules with fewer supporting samples than a preset support threshold; deleting candidate rules with an error rate higher than a preset error rate threshold on the validation set; and retaining the candidate rule with the lower error rate when the condition sets of two candidate rules have an inclusion relationship and the judgment results are the same.

[0154] The aforementioned support threshold can be based on the average number of supporting samples for historically effective rules. The following is determined:

[0155]

[0156] In the above formula, n j Let M represent the number of supporting samples corresponding to the j-th historically valid rule, and ρ represent the number of historically valid rules. ρ is a scaling factor, preferably 0.5. When the number of supporting samples for a candidate rule is lower than the support threshold... If so, delete the candidate rule.

[0157] The real-time compliance detection method for service call behavior based on machine learning of the present invention is compared with the standard embodiment by ablation analysis, and the results are as follows:

[0158] First, when the scene-aware dynamic attention mechanism is removed and only basic attention calculation is retained, the service violation call identification rate drops by 4% to 6% in high-sensitivity services and peak-hour scenarios, and the ability to distinguish between high-risk calls and ordinary calls is weakened.

[0159] Second, when the hierarchical temporal-spatial feature interaction network is replaced with a direct concatenation of temporal and spatial features, the ability to represent multi-hop call chains and complex service dependency structures decreases, and the accuracy of complex violation pattern recognition decreases by about 5%.

[0160] Third, when the conflict detection and adaptive resolution mechanism is replaced with a single threshold decision method, the mishandling rate increases by 2% to 4% for samples where the rule detection results and model detection results are inconsistent.

[0161] Fourth, when the real-time incremental learning and rule generation closed loop is closed, and only the static rule base and fixed model are retained, the adaptation period for new violation patterns is extended from hours to days, and the time required for the system to restore stable detection capabilities is significantly increased.

[0162] Please see Figure 6 The corresponding real-time incremental learning and rule generation closed-loop mechanism will not be described again here.

[0163] The above comparison shows that the scene-aware dynamic attention mechanism, hierarchical temporal-spatial feature interaction network, conflict detection and adaptive resolution mechanism, and real-time incremental learning and rule generation closed-loop mechanism of the present invention have a synergistic effect, jointly improving the real-time performance, stability, and adaptability of service operation call behavior compliance detection.

[0164] Compared to service call detection schemes based on static rule bases, this invention shortens the adaptation cycle from the identification of new violation patterns to the formation of effective detection rules from days to hours through a real-time incremental learning and rule generation closed-loop mechanism. In typical test scenarios, it can be shortened from about 5 to 7 days to 4 to 8 hours. The above improvements mainly come from the online clustering identification, incremental learning update, and dynamic rule generation layer write-back mechanism in this invention.

[0165] Compared to simple splicing or one-way fusion schemes of temporal features and graph structure features, this invention performs phased calculations of initial temporal features and initial spatial features within the same sliding time window, and further performs bidirectional injection and bidirectional attention fusion, which improves the accuracy of complex violation pattern recognition by 4% to 6% and the stability of multi-hop call chain anomaly recognition by 3% to 5%. The above improvements are mainly reflected in the ability to jointly represent cross-service, multi-path, and cross-time window abnormal behaviors.

[0166] Compared to multi-module fusion schemes that only use rule-based voting or single threshold judgment, this invention selects different conflict resolution paths by using conflict scores, uncertainty scores, and comprehensive credibility scores, reducing the mishandling rate on the conflict sample set by 2% to 4%. The above improvements mainly come from the introduction of negotiated conflict resolution and secondary verification strategies.

[0167] Furthermore, in the field of service call anomaly detection, existing technologies typically fuse temporal and topological features using simple concatenation, sequential concatenation, or unidirectional injection. This is primarily because bidirectional fusion easily introduces problems such as unclear computational order, increased real-time processing latency, and feature dependency loops. This invention does not follow these conventional approaches. Instead, it employs a phased processing path within the same sliding time window: first generating initial temporal and spatial features, then performing bidirectional injection, and finally performing bidirectional attention fusion. This avoids the looping problem of temporal and topological dependencies waiting for each other in real-time processing and enhances the joint representation capability of complex call behaviors. Existing technologies typically treat business scenario information merely as ordinary input features or labels. This invention, however, directly incorporates scenario-aware weights generated by service type, time interval, and regulatory level into the attention calculation process. This allows the feature weighting process to dynamically adjust the detection focus according to the scenario, thus distinguishing it from processing methods that rely solely on static features.

[0168] Example 1: The standard embodiment of the present invention in the scenario of a bank's core system is as follows:

[0169] This embodiment uses real-time compliance detection of service call behavior in a core banking system as an example to illustrate the standard implementation of the present invention. The target system adopts a multi-active data center deployment structure, and the business services include at least account services, transaction services, clearing services, risk control services, and audit services. Real-time collection of transaction call chains is performed through service mesh bypass collection interfaces, API gateways, and application performance monitoring tools; a service call sequence and service call relationship graph are constructed; SCAM is used to enhance the focus on core transaction services, peak transaction periods, and heavily regulated businesses; HTSFN is used to jointly represent the temporal relationships and dependency topology of the transaction chain; a three-level fusion detection model and CDAR mechanism are used to output the final detection results; after identifying new abnormal transaction patterns, incremental learning and rule writing are completed through RILE.

[0170] Example 2: An example of edge collaboration of the present invention in the context of the State Grid digital platform is as follows:

[0171] This embodiment 2, based on embodiment 1, describes the edge collaborative deployment method of the present invention in a power grid digital platform. The target system includes dispatch control services, equipment monitoring services, alarm services, load forecasting services, and operation and maintenance management services. The data acquisition module, rule fast matching module, and conflict resolution module are preferentially deployed near the edge nodes, while model training and global rule base updates are deployed at the central node. Data from PLCs, RTUs, sensors, and dispatch terminals are collected through IoT protocol adaptation components; HTSFN is used to represent the timing of dispatch commands and the topology relationship of equipment; CDAR is used to handle conflicts in multi-source results; and the central node completes incremental learning training and issues updated results.

[0172] Example 3: The high-concurrency implementation of the present invention in a microservice architecture scenario of an e-commerce platform is as follows:

[0173] This embodiment 3, based on embodiment 1, describes the application scenario of the present invention in a high-concurrency, rapid-iteration microservice architecture of an e-commerce platform. The target system includes order service, inventory service, payment service, promotion service, membership service, and risk control service. Each service is deployed in a containerized manner, and service governance and traffic management are performed through a service mesh. Traffic across the entire mesh is collected in a bypass manner through the Service Mesh; the scenario weights corresponding to the order service, inventory service, and payment service are dynamically increased during promotional activities; the service call relationship graph is updated every second; and new promotional arbitrage paths or inventory scalping patterns are learned and standardized through RILE.

[0174] Example 4: A lightweight embodiment of the present invention in an edge industrial IoT scenario is as follows:

[0175] This embodiment 4, based on embodiment 1, describes a lightweight implementation method for edge industrial IoT scenarios with limited resources, unstable networks, and high real-time requirements. The target system includes PLC control services, sensor data reporting services, robot execution services, edge control gateway services, and local alarm services. SCAM adopts a lightweight configuration, retaining only service type factors and time interval factors; HTSFN adopts a single-layer temporal-spatial interaction layer; the machine learning deep analysis module adopts a quantized and pruned lightweight CNN+LSTM structure; conflict resolution prioritizes a confidence-weighted strategy; edge nodes perform real-time inference and local alarms, while central nodes perform incremental learning training and rule updates.

[0176] Please see Figure 7 As shown, this invention provides a real-time compliance detection system for service operation call behavior based on machine learning. The system includes the following modules:

[0177] The data acquisition and preprocessing module is used to collect and preprocess service operation and call behavior data in real time, and to build service call sequences and service call relationship graphs.

[0178] The feature extraction and adjustment module is used to determine the scene perception weight based on the attributes of the current service operation calls, thereby adjusting the attention allocation intensity in the multi-dimensional behavioral feature extraction process; wherein, the scene perception weight is generated by the service type factor, time period factor and regulatory level factor;

[0179] The associated feature extraction module is used to input the extracted multidimensional behavioral features into the hierarchical temporal-spatial feature interaction network. Based on the service call sequence and service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features in the same sliding time window, which are then used as temporal associated features and spatial associated features.

[0180] The fusion module is used to perform space-to-temporal injection and temporal-to-space injection based on temporal correlation features and spatial correlation features to obtain multi-dimensional behavioral feature vectors.

[0181] The compliance detection module is used to input multi-dimensional behavioral feature vectors into a three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and contextual risk results to determine the degree of conflict and the degree of uncertainty of the results.

[0182] The detection result generation module is used to select a conflict resolution strategy based on the degree of conflict and the degree of uncertainty of the result, so as to obtain the final detection result.

[0183] The graded response module is used to perform graded response operations based on the final detection results;

[0184] The update module is used to perform incremental learning to update the machine learning model and compliance rule base when a new violation pattern is detected.

[0185] Furthermore, the data acquisition and preprocessing module is used to collect and preprocess service operation and call behavior data in real time, and to construct service call sequences and service call relationship graphs, specifically:

[0186] Service operation and call behavior data are collected in real time through several acquisition channels, including the service mesh bypass acquisition interface, API gateway, and monitoring tools. The service operation and call behavior data includes caller identifier, callee identifier, call timestamp, call chain data, return results, and call context environment data.

[0187] The service call behavior data is preprocessed with unified timestamps and call identifier alignment to generate standardized behavior records of service call events; based on the standardized behavior records, a service call sequence and a service call relationship graph are constructed.

[0188] The feature extraction and adjustment module is used to determine scene-aware weights based on the attributes of the current service call, thereby adjusting the attention allocation intensity during the multi-dimensional behavioral feature extraction process. Specifically:

[0189] The scene perception weight is determined based on the service type, time interval, and regulatory level of the current service operation. The scene perception weight is multiplied by the basic attention score to adjust the intensity of attention allocation in the process of extracting multidimensional behavioral features. Among them, multidimensional behavioral features include basic features, temporal features, contextual features, and abnormal features.

[0190] Furthermore, the association feature extraction module is used to input the extracted multidimensional behavioral features into the hierarchical temporal-spatial feature interaction network. Based on the service call sequence and service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features respectively within the same sliding time window, which are then used as temporal association features and spatial association features, specifically:

[0191] The extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence, the network extracts the call order relationship, call frequency change, and call interval change, which serve as temporal association features. Based on the service call relationship graph, the network extracts the service dependency relationship, call path relationship, and node adjacency relationship, which serve as spatial association features.

[0192] The fusion module is used to perform space-to-temporal injection and temporal-to-space injection based on temporal correlation features and spatial correlation features, to obtain multi-dimensional behavioral feature vectors, specifically:

[0193] Spatial correlation features are injected into the temporal state update process to obtain the first fusion feature; temporal correlation features are injected into the spatial feature extraction process to obtain the second fusion feature; bidirectional attention fusion is performed on the first fusion feature and the second fusion feature to obtain a multidimensional behavioral feature vector.

[0194] Furthermore, the compliance detection module is used to input multi-dimensional behavioral feature vectors into the three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and contextual risk results, thus determining the degree of conflict and the degree of uncertainty in the results, specifically:

[0195] The multidimensional behavioral feature vector is input into the rule fast matching module of the three-level fusion detection model, and the rule detection results are output based on the compliance rule library.

[0196] The multidimensional behavioral feature vector is input into the machine learning deep analysis module of the three-level fusion detection model to output the model detection results.

[0197] The rule detection results, model detection results, and invocation context data are input into the risk comprehensive assessment module of the three-level fusion detection model to output context risk results.

[0198] Based on the rule detection results, model detection results, and contextual risk results, determine the conflict score and the outcome uncertainty score;

[0199] The detection result generation module is used to select a conflict resolution strategy based on the degree of conflict and the uncertainty of the result, thereby obtaining the final detection result, specifically:

[0200] Based on the conflict score and the outcome uncertainty score, a comprehensive credibility score is determined; based on the interval in which the comprehensive credibility score falls, one of the following strategies is selected: confidence weighting strategy, negotiation-based resolution strategy, or secondary verification strategy, to obtain the final detection result.

[0201] Furthermore, the graded response module is used to perform graded response operations based on the final detection results, specifically:

[0202] A tiered response operation will be executed based on the final detection results; the tiered response operation includes at least one of the following: allowing the call to continue execution, triggering an alarm and recording the violation, or blocking the violation call;

[0203] The update module is used to perform incremental learning to update the machine learning model and compliance rule base when new violation patterns are detected. Specifically:

[0204] When a new violation pattern is detected, incremental learning is performed based on the samples of the new violation pattern to update the model parameters of the machine learning deep analysis module; candidate rules are generated from the detection results corresponding to the samples of the new violation pattern, and the candidate rules are pruned and filtered. After meeting the preset conditions, they are written into the dynamically generated rule layer of the compliance rule base.

[0205] The machine learning-based real-time compliance detection system for service operation and invocation behavior of the present invention has the same operation and effect as the aforementioned machine learning-based real-time compliance detection method for service operation and invocation behavior, and will not be described again here.

[0206] In one embodiment of the present invention, the present invention also provides an electronic device, the electronic device including at least a memory and a processor, wherein a computer program is stored in the memory, and the computer program, when executed by the processor, implements the method as described above.

[0207] In one embodiment of the present invention, a computer-readable storage medium is also provided, on which a computer program is stored, the computer program implementing the method described above when executed by a processor.

[0208] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of a necessary general-purpose hardware platform, or by a combination of hardware and software. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a computer product. The present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0209] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Other embodiments may also be used. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for real-time compliance detection of service call behavior based on machine learning, characterized in that, The method includes the following steps: S100: Real-time collection and preprocessing of service operation call behavior data to construct service call sequences and service call relationship graphs; determining scene perception weights based on the attributes of the current service operation calls to adjust the intensity of attention allocation during the multi-dimensional behavioral feature extraction process; wherein, the scene perception weights are generated by service type factors, time period factors, and regulatory level factors; S200: Input the extracted multidimensional behavioral features into the hierarchical temporal-spatial feature interaction network. Based on the service call sequence and the service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features respectively within the same sliding time window, which are used as temporal association features and spatial association features. Based on the temporal association features and spatial association features, perform space-to-temporal injection and temporal-to-space injection to obtain a multidimensional behavioral feature vector. S300: Input the multi-dimensional behavioral feature vector into the three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and context risk results to determine the degree of conflict and the degree of uncertainty of the result; select a conflict resolution strategy based on the degree of conflict and the degree of uncertainty of the result to obtain the final detection result; S400: Perform a tiered response operation based on the final detection result; when a new violation pattern is detected, perform incremental learning to update the machine learning model and compliance rule base.

2. The method according to claim 1, characterized in that, In S100, service call behavior data is collected and preprocessed in real time to construct service call sequences and service call relationship graphs. Scene awareness weights are determined based on the attributes of the current service call, thereby adjusting the attention allocation intensity during the multi-dimensional behavioral feature extraction process. Specifically: Service operation and call behavior data are collected in real time through several acquisition channels; wherein, the several acquisition channels include a service mesh bypass acquisition interface, an API gateway, and monitoring tools; the service operation and call behavior data includes caller identifier, callee identifier, call timestamp, call chain data, return result, and call context environment data; The service call behavior data is preprocessed with unified timestamps and call identifier alignment to generate standardized behavior records of service call events; based on the standardized behavior records, a service call sequence and a service call relationship graph are constructed. The scene perception weight is determined based on the service type, time interval, and regulatory level of the current service operation. The scene perception weight is multiplied by the basic attention score to adjust the attention allocation intensity in the multidimensional behavioral feature extraction process. The multidimensional behavioral features include basic features, temporal features, contextual features, and abnormal features.

3. The method according to claim 2, characterized in that, In S200, the extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence and the service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features within the same sliding time window, which are then used as temporal correlation features and spatial correlation features. Based on the temporal correlation features and spatial correlation features, space-to-temporal injection and temporal-to-space injection are performed to obtain a multidimensional behavioral feature vector, specifically: The extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence, the call sequence relationship, call frequency change, and call interval change are extracted as temporal association features. Based on the service call relationship graph, service dependencies, call path relationships, and node adjacency relationships are extracted as spatial association features; The spatial correlation features are injected into the temporal state update process to obtain the first fusion feature; The temporal correlation features are injected into the spatial feature extraction process to obtain the second fused feature; The first fusion feature and the second fusion feature are fused by bidirectional attention to obtain a multidimensional behavioral feature vector.

4. The method according to claim 3, characterized in that, In S300, the multi-dimensional behavioral feature vector is input into the three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and context risk results, thus determining the degree of conflict and the degree of uncertainty of the results; A conflict resolution strategy is selected based on the degree of conflict and the uncertainty of the result to obtain the final detection result, specifically as follows: The multidimensional behavioral feature vector is input into the rule fast matching module of the three-level fusion detection model, and the rule detection result is output based on the compliance rule library. The multidimensional behavioral feature vector is input into the machine learning deep analysis module of the three-level fusion detection model to output the model detection result. The rule detection results, the model detection results, and the invocation context data are input into the risk comprehensive assessment module of the three-level fusion detection model to output the context risk results. Based on the rule detection results, the model detection results, and the context risk results, determine the conflict score and the outcome uncertainty score; Based on the conflict score and the outcome uncertainty score, a comprehensive credibility score is determined; Based on the range of the comprehensive confidence score, select any one of the confidence weighting strategy, negotiation resolution strategy, or secondary verification strategy to obtain the final detection result.

5. The method according to claim 4, characterized in that, In S400, a tiered response operation is performed based on the final detection result; when a new violation pattern is detected, incremental learning is performed to update the machine learning model and compliance rule base, specifically as follows: A tiered response operation is executed based on the final detection result; wherein the tiered response operation includes at least one of allowing the call to continue execution, triggering an alarm and recording the violation, or blocking the violation call; When a new violation pattern is detected, incremental learning is performed based on the samples of the new violation pattern to update the model parameters of the machine learning deep analysis module; candidate rules are generated from the detection results corresponding to the samples of the new violation pattern, and the candidate rules are pruned and filtered. After meeting the preset conditions, they are written into the dynamically generated rule layer of the compliance rule base.

6. A real-time compliance detection system for service operation and invocation behavior based on machine learning, characterized in that, The system includes the following modules: The data acquisition and preprocessing module is used to collect and preprocess service operation and call behavior data in real time, and to build service call sequences and service call relationship graphs. The feature extraction and adjustment module is used to determine the scene perception weight based on the attributes of the current service operation call, thereby adjusting the attention allocation intensity in the multi-dimensional behavioral feature extraction process; wherein, the scene perception weight is generated by the service type factor, time period factor and regulatory level factor; The associated feature extraction module is used to input the extracted multidimensional behavioral features into the hierarchical temporal-spatial feature interaction network. Based on the service call sequence and the service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features in the same sliding time window, which are used as temporal associated features and spatial associated features. The fusion module is used to perform space-to-temporal injection and temporal-to-space injection based on the temporal correlation features and the spatial correlation features to obtain a multi-dimensional behavioral feature vector; The compliance detection module is used to input the multi-dimensional behavioral feature vector into the three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and context risk results to determine the degree of conflict and the degree of uncertainty of the results. The detection result generation module is used to select a conflict resolution strategy based on the degree of conflict and the degree of uncertainty of the result, so as to obtain the final detection result. A graded response module is used to perform graded response operations based on the final detection result; The update module is used to perform incremental learning to update the machine learning model and compliance rule base when a new violation pattern is detected.

7. The system according to claim 6, characterized in that, The data acquisition and preprocessing module is used to acquire and preprocess service operation and call behavior data in real time, and to construct service call sequences and service call relationship graphs, specifically: Service operation and call behavior data are collected in real time through several acquisition channels; wherein, the several acquisition channels include a service mesh bypass acquisition interface, an API gateway, and monitoring tools; the service operation and call behavior data includes caller identifier, callee identifier, call timestamp, call chain data, return result, and call context environment data; The service call behavior data is preprocessed with unified timestamps and call identifier alignment to generate standardized behavior records of service call events; based on the standardized behavior records, a service call sequence and a service call relationship graph are constructed. The feature extraction and adjustment module is used to determine scene-aware weights based on the attributes of the current service call, thereby adjusting the attention allocation intensity during the multi-dimensional behavioral feature extraction process. Specifically: The scene perception weight is determined based on the service type, time interval, and regulatory level of the current service operation. The scene perception weight is multiplied by the basic attention score to adjust the attention allocation intensity in the multidimensional behavioral feature extraction process. The multidimensional behavioral features include basic features, temporal features, contextual features, and abnormal features.

8. The system according to claim 7, characterized in that, The associated feature extraction module is used to input the extracted multidimensional behavioral features into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence and the service call relationship graph, the hierarchical temporal-spatial feature interaction network generates initial temporal features and initial spatial features within the same sliding time window, which are then used as temporal and spatial associated features. Specifically: The extracted multidimensional behavioral features are input into a hierarchical temporal-spatial feature interaction network. Based on the service call sequence, the call sequence relationship, call frequency change, and call interval change are extracted as temporal association features. Based on the service call relationship graph, service dependencies, call path relationships, and node adjacency relationships are extracted as spatial association features; The fusion module is used to perform space-to-temporal injection and temporal-to-space injection based on the temporal correlation features and the spatial correlation features to obtain a multi-dimensional behavioral feature vector, specifically: The spatial correlation features are injected into the temporal state update process to obtain the first fusion feature; The temporal correlation features are injected into the spatial feature extraction process to obtain the second fused feature; The first fusion feature and the second fusion feature are fused by bidirectional attention to obtain a multidimensional behavioral feature vector.

9. The system according to claim 8, characterized in that, The compliance detection module is used to input the multi-dimensional behavioral feature vector into the three-level fusion detection model for real-time compliance detection, thereby outputting rule detection results, model detection results, and contextual risk results, thus determining the degree of conflict and the degree of uncertainty of the results. Specifically: The multidimensional behavioral feature vector is input into the rule fast matching module of the three-level fusion detection model, and the rule detection result is output based on the compliance rule library. The multidimensional behavioral feature vector is input into the machine learning deep analysis module of the three-level fusion detection model to output the model detection result. The rule detection results, the model detection results, and the invocation context data are input into the risk comprehensive assessment module of the three-level fusion detection model to output the context risk results. Based on the rule detection results, the model detection results, and the context risk results, determine the conflict score and the outcome uncertainty score; The detection result generation module is used to select a conflict resolution strategy based on the degree of conflict and the uncertainty of the result, thereby obtaining the final detection result. Specifically: Based on the conflict score and the result uncertainty score, a comprehensive credibility score is determined; based on the interval in which the comprehensive credibility score falls, any one of the confidence weighting strategy, negotiation resolution strategy, or secondary verification strategy is selected to obtain the final detection result.

10. The system according to claim 9, characterized in that, The graded response module is used to perform graded response operations based on the final detection result, specifically: A tiered response operation is executed based on the final detection result; wherein the tiered response operation includes at least one of allowing the call to continue execution, triggering an alarm and recording the violation, or blocking the violation call; The update module is used to perform incremental learning to update the machine learning model and compliance rule base when a new violation pattern is detected. Specifically: When a new violation pattern is detected, incremental learning is performed based on the samples of the new violation pattern to update the model parameters of the machine learning deep analysis module; candidate rules are generated from the detection results corresponding to the samples of the new violation pattern, and the candidate rules are pruned and filtered. After meeting the preset conditions, they are written into the dynamically generated rule layer of the compliance rule base.

Images