A method for generating a user behavior dataset and related apparatus

Abstract

The application provides a user behavior dataset generation method and related device, and belongs to the technical field of dataset generation. The first data and the second data are fused to obtain full-link behavior data; feature extraction is performed on the full-link behavior data to obtain a plurality of behavior features, and the plurality of behavior features are numerically encoded to obtain a structured behavior feature vector; the structured behavior feature vector is labeled to obtain a labeled dataset, and the labeled dataset is synthesized and data enhanced to obtain a user behavior dataset. The application solves the problem of poor generation effect of the user behavior dataset.

Description

Technical Field

[0001] This invention belongs to the field of dataset generation technology, specifically relating to a method and related apparatus for generating user behavior datasets. Background Technology

[0002] The safe and stable operation of power plant monitoring systems is directly related to power production safety and grid stability. Currently, industrial control network security threats are becoming increasingly complex. Personnel are a key element in the power production process, and user behavior is a critical link affecting the safe and stable operation of power plants. Internal personnel misoperation, unauthorized operation, and malicious violations have become major sources of security risks for power monitoring systems. Therefore, accurate user behavior detection and security auditing technologies have become core means for the safe operation and maintenance of power plants.

[0003] The development of high-precision behavior detection models and auditing systems relies heavily on high-quality, multi-dimensional, balanced, and well-labeled user behavior datasets.

[0004] Current dataset construction techniques have many shortcomings: 1. User roles were not clearly defined based on job responsibilities, the boundaries between normal and abnormal behaviors were blurred, the data collection scenarios and data dimensions lacked specificity, and the datasets had poor business adaptability.

[0005] 2. Secondly, conventional data collection methods only passively collect existing system logs, which cannot fully replicate human-computer interaction behavior. Abnormal behavior samples mostly rely on real-world environment collection, and high-risk abnormal behavior samples are scarce, failing to cover typical attack scenarios such as brute-force attacks, unauthorized operations, and malicious command issuance.

[0006] 3. Existing data has not achieved multi-source data association and integration, and cannot form a complete behavioral chain of "user-time-operation-object-result", resulting in severe fragmentation of behavioral data.

[0007] 4. The feature extraction dimension is limited, lacking temporal, contextual, and specific anomaly features, resulting in low model training recognition accuracy.

[0008] 5. Traditional manual annotation is inefficient and prone to errors, while pure machine annotation lacks accuracy.

[0009] 6. The datasets generally suffer from a severe imbalance between positive and negative samples. Conventional screening and noise reduction methods cannot effectively expand the sample size of abnormal behavior, resulting in poor generalization ability of the training model and high false negative and false positive rates.

[0010] In summary, existing technologies suffer from technical pain points such as missing role classification, incomplete behavior samples, broken behavior links, single feature dimensions, poor annotation quality, and imbalanced samples. These technologies cannot meet the R&D needs of high-precision anomaly detection and security auditing in power monitoring systems. There is an urgent need for a standardized, end-to-end, high-fidelity, and balanced enhancement method for generating user behavior datasets. Summary of the Invention

[0011] The purpose of this invention is to provide a method and related apparatus for generating user behavior datasets, in order to solve the problem of poor generation effect of user behavior datasets in the prior art.

[0012] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a method for generating a user behavior dataset, comprising the following steps: Obtain user identity information, operation behavior, device status data, network traffic data, and alarm information, and record them as the first data; The user roles are divided into several types, and the data collection dimensions and data collection scenarios are determined based on these user roles. Within the data collection dimensions and data collection scenarios, normal behavior data and abnormal behavior data are acquired and referred to as the second data. By fusing the first and second data, we obtain end-to-end behavioral data. Feature extraction is performed on the end-to-end behavioral data to obtain several behavioral features, and these behavioral features are numerically encoded to obtain a structured behavioral feature vector. The structured behavioral feature vectors are labeled to obtain a labeled dataset. The labeled dataset is then synthesized and augmented to obtain a user behavior dataset.

[0013] A further improvement of this invention is that the user roles are divided into several types, specifically as follows: Based on the job responsibilities and authority specifications for operation and maintenance positions in thermal power plants, user roles are divided into several types.

[0014] A further improvement of the present invention is that the user roles include operation operators, operation and maintenance engineers, managers and third-party operation and maintenance personnel.

[0015] A further improvement of the present invention is that the plurality of behavioral features include basic features, temporal features, operational features, abnormal features, and contextual features.

[0016] A further improvement of this invention is that the annotation of the structured behavioral feature vectors to obtain the annotated dataset is specifically as follows: The structured behavioral feature vectors are labeled with behavioral labels, operational labels, and risk level labels to obtain the labeled dataset.

[0017] A further improvement of this invention is that the synthesis of the labeled dataset specifically involves: The SMOTE and ADASYN algorithms are used to synthesize anomalous behavior samples from the labeled dataset.

[0018] A further improvement of this invention is that the data augmentation of the labeled dataset specifically involves: Data augmentation is performed on anomalous behavior samples in the labeled dataset through temporal perturbation, feature perturbation, and operation sequence recombination.

[0019] Secondly, the present invention provides a system for generating user behavior datasets, comprising: The first data acquisition module is used to acquire user identity information, operation behavior, device status data, network traffic data and alarm information, which are referred to as the first data; The segmentation module is used to segment user roles, resulting in several types of user roles, and to determine the data collection dimensions and data collection scenarios based on these user roles. The second data acquisition module is used to acquire normal behavior data and abnormal behavior data within the data acquisition dimensions and data acquisition scenarios, referred to as the second data; The fusion module is used to fuse the first data and the second data to obtain full-link behavior data; The feature vector determination module is used to extract features from the full-link behavior data, obtain several types of behavior features, and numerically encode these behavior features to obtain structured behavior feature vectors. The user behavior dataset generation module is used to label structured behavior feature vectors to obtain labeled datasets, and then synthesize and augment the labeled datasets to obtain user behavior datasets.

[0020] Thirdly, the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the user behavior dataset generation method described above.

[0021] Fourthly, the present invention provides a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method for generating the user behavior dataset described above.

[0022] Compared with the prior art, the present invention has the following beneficial effects: The user behavior dataset generation method proposed in this invention divides user roles into several types, and determines the data collection dimensions and scenarios based on these user roles. This operation ensures that the data collection scope aligns with actual business needs, avoids data collection from deviating from the application scenario, and makes the generated dataset more relevant to user requirements. On the other hand, it merges the first and second data to obtain full-link behavior data. This operation not only improves the integrity and authenticity of the data but also strengthens the correlation between various data features, thereby improving the generation effect of the user behavior dataset in the later stages. Attached Figure Description

[0023] Figure 1 This is a flowchart of the method for generating user behavior datasets according to the present invention; Figure 2 This is a schematic diagram of the user behavior dataset generation system of the present invention; Figure 3 This is a flowchart of the method for generating user behavior datasets in Embodiment 4 of the present invention; Figure 4 This is an architecture diagram of the collection of normal behavior data and abnormal behavior data in Embodiment 4 of the present invention; Figure 5 This is a flowchart of the multi-dimensional behavioral feature extraction in Embodiment 4 of the present invention; Figure 6 This is a flowchart of data annotation, data synthesis, and data augmentation in Embodiment 4 of the present invention; Figure 7 This is a schematic diagram of the structure of the electronic device of the present invention. Detailed Implementation

[0024] To further understand the content of this invention, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments are merely illustrative and not limiting of the invention.

[0025] Example 1: The flowchart of the method for generating the user behavior dataset of this invention is as follows: Figure 1 As shown, the method for generating user behavior datasets according to the present invention includes the following steps: S1. Obtain user identity information, operation behavior, device status data, network traffic data, and alarm information, and record them as the first data; S2. Divide users into several user roles, and determine the data collection dimensions and data collection scenarios based on these user roles; S3. Within the data collection dimensions and data collection scenarios, acquire normal behavior data and abnormal behavior data, which are referred to as the second data; S4. Merge the first and second data to obtain full-link behavior data; S5. Extract features from the entire link behavior data to obtain several types of behavior features, and numerically encode these behavior features to obtain a structured behavior feature vector. S6. Label the structured behavioral feature vectors to obtain a labeled dataset, and then synthesize and augment the labeled dataset to obtain a user behavior dataset.

[0026] Example 2: A schematic diagram of the user behavior dataset generation system of this invention is shown below. Figure 2 As shown, the user behavior dataset generation system of this invention includes: The first data acquisition module is used to acquire user identity information, operation behavior, device status data, network traffic data and alarm information, which are referred to as the first data; The segmentation module is used to segment user roles, resulting in several types of user roles, and to determine the data collection dimensions and data collection scenarios based on these user roles. The second data acquisition module is used to acquire normal behavior data and abnormal behavior data within the data acquisition dimensions and data acquisition scenarios, referred to as the second data; The fusion module is used to fuse the first data and the second data to obtain full-link behavior data; The feature vector determination module is used to extract features from the full-link behavior data, obtain several types of behavior features, and numerically encode these behavior features to obtain structured behavior feature vectors. The user behavior dataset generation module is used to label structured behavior feature vectors to obtain labeled datasets, and then synthesize and augment the labeled datasets to obtain user behavior datasets.

[0027] Example 3: The flowchart of the method for generating the user behavior dataset of this invention is as follows: Figure 3 As shown, the method for generating user behavior datasets according to the present invention includes the following steps: S1. Obtain user identity information, operation behavior, device status data, network traffic data, and alarm information, and record them as the first data.

[0028] S2. Divide users into several user roles, and determine the data collection dimensions and data collection scenarios based on these user roles.

[0029] This step involves classifying user roles, resulting in several types of user roles, specifically: Based on the job responsibilities and authority specifications for operation and maintenance positions in thermal power plants, user roles are divided into several types.

[0030] User roles in this step include operation operators, operations engineers, administrators, and third-party operations personnel.

[0031] S3. Within the data collection dimensions and data collection scenarios, acquire normal behavior data and abnormal behavior data, which are referred to as the second data.

[0032] S4. Merge the first and second data to obtain full-link behavior data.

[0033] S5. Extract features from the entire link behavior data to obtain several types of behavior features, and numerically encode these behavior features to obtain a structured behavior feature vector.

[0034] Several behavioral characteristics in this step include basic characteristics, temporal characteristics, operational characteristics, abnormal characteristics, and contextual characteristics.

[0035] S6. Label the structured behavioral feature vectors to obtain a labeled dataset, and then synthesize and augment the labeled dataset to obtain a user behavior dataset.

[0036] This step involves labeling the structured behavioral feature vectors to obtain the labeled dataset, specifically: The structured behavioral feature vectors are labeled with behavioral labels, operational labels, and risk level labels to obtain the labeled dataset.

[0037] This step involves synthesizing the labeled dataset, specifically: The SMOTE and ADASYN algorithms are used to synthesize anomalous behavior samples from the labeled dataset.

[0038] This step involves data augmentation of the labeled dataset, specifically: Data augmentation is performed on anomalous behavior samples in the labeled dataset through temporal perturbation, feature perturbation, and operation sequence recombination.

[0039] Example 4: The following describes the method of the present invention in detail using the generation of user behavior datasets for a power plant power monitoring system as an example. The flowchart of the method for generating user behavior datasets for a power plant power monitoring system of the present invention is as follows: Figure 3 As shown in the diagram, the architecture for collecting normal behavior data (hereinafter referred to as normal behavior) and abnormal behavior data (hereinafter referred to as abnormal behavior) is as follows. Figure 4 As shown, the flowchart for multi-dimensional behavioral feature extraction is as follows: Figure 5 As shown, the flowcharts for data annotation, data synthesis, and data augmentation are as follows: Figure 6 As shown, the method for generating user behavior datasets for a power plant power monitoring system according to the present invention includes the following steps: Step 1: User role segmentation and determination of data collection dimensions and scenarios Step 1 specifically includes: According to the job responsibilities and authority specifications for thermal power plant operation and maintenance positions, four core user roles are defined: operation operators, operation and maintenance engineers, managers, and third-party operation and maintenance personnel.

[0040] For each role type, normal and abnormal behaviors are defined as follows: Normal operator behavior includes viewing unit parameters, fine-tuning routine loads, and monitoring equipment status. Abnormal behavior includes unauthorized modification of configurations and unauthorized start-up and shutdown of equipment.

[0041] Engineers' normal behavior is to calibrate parameters and debug equipment during maintenance periods, while abnormal behavior is to tamper with control logic and issue unauthorized instructions outside of maintenance periods.

[0042] Normal administrator behavior includes account management and log auditing; abnormal behavior includes unauthorized permission allocation and deletion of operation and maintenance logs.

[0043] Normal behavior of third-party maintenance personnel is to temporarily check and debug equipment; abnormal behavior includes unauthorized login and malicious parameter tampering.

[0044] Based on the normal and abnormal behaviors defined for each role type, the data collection dimensions and scenarios are determined. Specifically, the data collection dimensions and scenarios are as follows: The data collection dimensions include six dimensions: user identity, operation behavior, equipment status, network traffic, power plant power monitoring system alarms, and time series. The data collection scenarios include four core power generation business scenarios: daily unit operation, regular equipment maintenance, unit start-up and shutdown, and emergency fault handling.

[0045] Step 2: Collection of Normal and Abnormal Behavior Data Step 2 specifically includes: Normal behavior data collection: Based on automated script tools, simulate the daily manual operations of each role, and record human-computer interaction behaviors such as button clicks, drop-down menu selections, keyboard parameter inputs, and window switching throughout the process; at the same time, through the standard API (Application Programming Interface) of the power monitoring system, collect identity authentication login logs, role permission change and audit logs, and field equipment communication interaction logs, and retain complete compliant operation sample data.

[0046] Abnormal behavior data collection: For typical risk scenarios in power industrial control, various high-risk abnormal behaviors are manually simulated and reproduced, including brute-force login of accounts, unauthorized access to advanced functions by low-privilege accounts, cross-role parameter tampering, unauthorized issuance of malicious commands to start and stop equipment, and unauthorized access to the network to read core data, thus supplementing the high-risk abnormal behavior samples that are scarce in real scenarios.

[0047] Step 3: Data Preprocessing and Construction of End-to-End Behavioral Data Step 3 specifically includes: The collected normal behavior data and abnormal behavior data are preprocessed as follows: Automatically batch delete duplicate and redundant logs, use interpolation to repair missing log fields, and remove invalid, noisy, and abnormal dirty data; unify the timestamp format, field names, data units, and encoding format of all data (normal behavior data and abnormal behavior data) to complete data preprocessing.

[0048] The preprocessed normal and abnormal behavior data are integrated with user identity information, operation behavior, device status data, network traffic data, and alarm information to sort out the sequential logic of operations and construct a closed-loop complete user behavior link of "user-time-operation-object-result" (to obtain full-link behavior data), so that each operation behavior can be traced, correlated, and verified.

[0049] Step 4: Multi-dimensional behavioral feature extraction and behavioral feature vector construction Step 4 specifically includes: Feature extraction was performed on the end-to-end behavioral data to obtain five behavioral features, which specifically include: Basic characteristics: user account, login IP (Internet Protocol), operating terminal, operation time period, device number, and account permission level; Temporal characteristics: time interval between adjacent operations, frequency of operations per unit time, combination pattern of operation sequences, and temporal fluctuation characteristics; Operational characteristics: operation type, parameter adjustment range, instruction code, device control type, and file operation behavior; Anomaly characteristics: number of brute-force attacks, unauthorized operation indicators, malicious command characteristics, abnormal traffic fluctuations, and unauthorized access characteristics; Contextual features: equipment operating status before and after operation, alarm level of power plant power monitoring system, network load status, and environmental operating conditions.

[0050] Five behavioral features are numerically encoded, normalized for dimensionality reduction, and aligned for dimension, and then integrated to construct a structured behavioral feature vector with a unified dimension (in Figure 5The standardized feature vector representation is constructed using fusion, providing standardized feature support for subsequent model training and data labeling.

[0051] Step 5: Large-scale model-assisted semi-automatic hybrid data annotation Step 5 specifically includes: A semi-automatic annotation mode is adopted, which combines large-model intelligent assisted annotation with manual review and calibration. Specifically: First, the structured behavioral feature vector (in...) Figure 6 The system inputs the original feature dataset into a large model and, relying on the power control safety knowledge base, automatically completes the initial labeling of behavior tags (normal and abnormal), operation tags (monitoring, debugging, configuration, and attack, etc.), and risk tags (low, medium, high, and high risk). Then, power operation and maintenance safety professionals review the labeling results batch by batch, correct model labeling deviations and erroneous labels, remove invalid labels, and complete the labeling of the high-precision dataset (the labeled dataset, also known as the precise labeling initial dataset), ensuring the business rationality and accuracy of the labels.

[0052] Step 6: Data Combination and Data Augmentation Step 6 specifically includes: To address the imbalance issue of a massive number of normal behavior samples and a scarce number of abnormal behavior samples in the labeled dataset, the SMOTE algorithm is used to uniformly synthesize the regular abnormal behavior samples in the labeled dataset, and the ADASYN algorithm is used to adaptively weight and synthesize the difficult-to-classify and high-risk attack abnormal behavior samples in the labeled dataset, thereby expanding the sample base of abnormal behavior.

[0053] Simultaneously, multi-dimensional data augmentation techniques are employed to augment the abnormal behavior samples in the labeled dataset, specifically: Temporal perturbation is achieved by fine-tuning the operation time interval and adding a small hourly time offset; feature perturbation is achieved by adding a small amount of noise to non-core numerical features; and effective operation subsequences are reorganized while maintaining compliance with business logic.

[0054] Through data synthesis and data augmentation, the distribution of positive and negative samples (normal behavior samples and abnormal behavior samples) in the labeled dataset is balanced, enriching the diversity of behavior samples. Ultimately, a high-fidelity, multi-dimensional, high-precision, and well-balanced user behavior dataset for power plant monitoring systems is generated. Figure 6 The dataset (represented by a high-quality dataset with balanced sample) can be directly used for training industrial control security detection models, testing security audit systems, and developing risk warning algorithms.

[0055] Compared with the prior art, the present invention has the following advantages: 1. This invention defines refined roles and behavioral paradigms based on the job responsibilities of power generation positions, clarifies the data collection dimensions and business scenarios, and solves the problems of ambiguous roles, unclear behavioral boundaries, and poor scenario adaptability in traditional datasets, thereby significantly improving the relevance of the dataset to power business.

[0056] 2. This invention adopts a differentiated collection method that uses automated scripts to collect normal human-computer interaction behaviors and manually simulated high-risk abnormal behaviors. It also covers three types of core system logs, making up for the shortcomings of traditional data abnormal behavior samples being scarce, behavior collection being incomplete, and high-risk scenarios being missing, resulting in more comprehensive sample coverage.

[0057] 3. This invention integrates the first data and the second data to construct a complete closed-loop link of user behavior, which solves the problems of traditional data fragmentation, lack of correlation, and inability to restore the complete operation process, and greatly improves data integrity and logic.

[0058] 4. This invention extracts five behavioral features, covering multiple dimensions of features including basic, temporal, operational, abnormal, and contextual features, resulting in rich feature vector dimensions.

[0059] 5. This invention adopts a semi-automatic hybrid annotation mode that combines large model assistance and manual review, which balances annotation efficiency and annotation accuracy. It solves the problems of low efficiency in traditional manual annotation and large errors in machine annotation, resulting in high-quality and highly reliable dataset annotation.

[0060] 6. This invention integrates the SMOTE and ADASYN dual algorithms to synthesize abnormal behavior samples, and combines time series, feature, and sequence multi-dimensional data enhancement to completely solve the industry pain point of imbalanced positive and negative samples in power monitoring datasets. It significantly improves the generalization ability and model adaptability of the dataset and can be widely applied to power plant industrial control security audit, abnormal behavior detection, risk warning and compliance operation and maintenance scenarios.

[0061] Example 5: Please see Figure 7 As shown, the present invention also provides an electronic device 100 for generating a user behavior dataset; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0062] The memory 101 can be used to store the computer program 103. The processor 102 implements the steps of the user behavior dataset generation method described in Embodiment 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device 100 (such as audio data), etc. In addition, the memory 101 may include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other non-volatile solid-state storage device.

[0063] The at least one processor 102 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor. The processor 102 is the control center of the electronic device 100, connecting various parts of the electronic device 100 via various interfaces and lines.

[0064] The memory 101 in the electronic device 100 stores multiple instructions to implement a method for generating a user behavior dataset, and the processor 102 can execute the multiple instructions to achieve the following: Obtain user identity information, operation behavior, device status data, network traffic data, and alarm information, and record them as the first data; The user roles are divided into several types, and the data collection dimensions and data collection scenarios are determined based on these user roles. Within the data collection dimensions and data collection scenarios, normal behavior data and abnormal behavior data are acquired and referred to as the second data. By fusing the first and second data, we obtain end-to-end behavioral data. Feature extraction is performed on the end-to-end behavioral data to obtain several behavioral features, and these behavioral features are numerically encoded to obtain a structured behavioral feature vector. The structured behavioral feature vectors are labeled to obtain a labeled dataset. The labeled dataset is then synthesized and augmented to obtain a user behavior dataset.

[0065] Example 6: If the modules / units integrated in the electronic device 100 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0066] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0068] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0069] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for generating a user behavior dataset, characterized in that, Includes the following steps: Obtain user identity information, operation behavior, device status data, network traffic data, and alarm information, and record them as the first data; The user roles are divided into several types, and the data collection dimensions and data collection scenarios are determined based on these user roles. Within the data collection dimensions and data collection scenarios, normal behavior data and abnormal behavior data are acquired and referred to as the second data. By fusing the first and second data, we obtain end-to-end behavioral data. Feature extraction is performed on the end-to-end behavioral data to obtain several behavioral features, and these behavioral features are numerically encoded to obtain a structured behavioral feature vector. The structured behavioral feature vectors are labeled to obtain a labeled dataset. The labeled dataset is then synthesized and augmented to obtain a user behavior dataset.

2. The method for generating user behavior datasets according to claim 1, characterized in that, The user roles are divided into several types, specifically: Based on the job responsibilities and authority specifications for operation and maintenance positions in thermal power plants, user roles are divided into several types.

3. The method for generating user behavior datasets according to claim 1, characterized in that, The user roles include operation operators, operation and maintenance engineers, managers, and third-party operation and maintenance personnel.

4. The method for generating user behavior datasets according to claim 1, characterized in that, The aforementioned behavioral characteristics include basic characteristics, temporal characteristics, operational characteristics, abnormal characteristics, and contextual characteristics.

5. The method for generating user behavior datasets according to claim 1, characterized in that, The process of labeling the structured behavioral feature vectors to obtain the labeled dataset is as follows: The structured behavioral feature vectors are labeled with behavioral labels, operational labels, and risk level labels to obtain the labeled dataset.

6. The method for generating user behavior datasets according to claim 1, characterized in that, The synthesis of the labeled dataset specifically involves: The SMOTE and ADASYN algorithms are used to synthesize anomalous behavior samples from the labeled dataset.

7. The method for generating user behavior datasets according to claim 1, characterized in that, The data augmentation of the labeled dataset specifically includes: Data augmentation is performed on anomalous behavior samples in the labeled dataset through temporal perturbation, feature perturbation, and operation sequence recombination.

8. A system for generating user behavior datasets, characterized in that, include: The first data acquisition module is used to acquire user identity information, operation behavior, device status data, network traffic data and alarm information, which are referred to as the first data; The segmentation module is used to segment user roles, resulting in several types of user roles, and to determine the data collection dimensions and data collection scenarios based on these user roles. The second data acquisition module is used to acquire normal behavior data and abnormal behavior data within the data acquisition dimensions and data acquisition scenarios, referred to as the second data; The fusion module is used to fuse the first data and the second data to obtain full-link behavior data; The feature vector determination module is used to extract features from the full-link behavior data, obtain several types of behavior features, and numerically encode these behavior features to obtain structured behavior feature vectors. The user behavior dataset generation module is used to label structured behavior feature vectors to obtain labeled datasets, and then synthesize and augment the labeled datasets to obtain user behavior datasets.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method for generating the user behavior dataset according to any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method for generating the user behavior dataset according to any one of claims 1 to 7.

Images