User identity recognition method and device, computer device and computer program product

Abstract

The application discloses a user identity recognition method and device, computer equipment and computer program products. Among them, the method comprises: collecting a network behavior log sequence to be identified; based on the operation behavior, a behavior sequence feature embedding vector is constructed; based on the source IP and the destination IP, a network topology structure feature embedding vector is determined; the behavior sequence feature embedding vector and the network topology structure feature embedding vector are input into a preset target user representation model, a double-branch encoder is used to extract feature coding, and a cross attention mechanism is used for fusion, so as to obtain a query vector; the similarity between the query vector and a plurality of vectors in a preset user vector corresponding relationship is calculated; based on the preset user vector corresponding relationship, a candidate user corresponding to the vector satisfying the preset condition is selected as the target user. The application solves the technical problem that the current identity recognition effect is poor due to the dependence on artificial feature engineering and the lack of effective self-supervised learning framework.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a user identification method, apparatus, computer equipment, and computer program product. Background Technology

[0002] As cyberattack methods continue to evolve, traditional rule-based or signature-based intrusion detection systems are struggling to cope with emerging threats such as zero-day attacks, insider threats, and advanced persistent threats. Behavioral analytics, by monitoring the network activities of users or entities and establishing baselines of normal behavior to identify abnormal or malicious actions, has become an important direction in the field of cybersecurity. Currently, solutions often rely on manual feature engineering, which struggles to capture deep behavioral patterns and lacks robustness to real-world scenarios such as missing logs, IP changes, and operational disturbances. Secondly, some solutions require one-by-one comparisons when calculating similarity, which is slow, and primarily rely on supervised training models for anomaly detection. This fails to adequately utilize the high-dimensional behavioral representations formed by massive behavioral logs, and a continuously updated user feature vector library is not built, making it impossible to achieve rapid identity retrieval and similar user matching based on historical user behavior features. Finally, current solutions focus on anomaly detection, without designing feature vector retrieval mechanisms for user identification scenarios or establishing vector feature libraries for known and risky users. This makes it difficult to achieve user identity verification and association analysis based on behavioral semantic similarity. Consequently, when faced with real-world scenarios such as missing network logs and IP changes, the lack of an effective self-supervised learning framework for building a user identification system leads to insufficient capture of deep behavioral patterns and poor robustness in identity recognition.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a user identification method, apparatus, computer device, and computer program product to at least solve the technical problem that current methods rely on manual feature engineering and lack an effective self-supervised learning framework, resulting in poor identification performance.

[0005] According to one aspect of the present invention, a user identification method is provided, comprising: collecting a network behavior log sequence to be identified; constructing a behavior sequence feature embedding vector based on the operation behavior in the network behavior log sequence to be identified; determining a network topology feature embedding vector based on the source IP and destination IP in the network behavior log sequence to be identified; inputting the behavior sequence feature embedding vector and the network topology feature embedding vector into a preset target user representation model, extracting feature codes based on a dual-branch encoder in the preset target user representation model and fusing them through a cross-attention mechanism to obtain a query vector; calculating the similarity between the query vector and multiple vectors in a preset user vector correspondence relationship, wherein the preset user vector correspondence relationship represents multiple candidate users and the vectors corresponding to each candidate user; and selecting candidate users corresponding to vectors whose similarity satisfies a preset condition as target users based on the preset user vector correspondence relationship.

[0006] Optionally, based on the operational behaviors in the network behavior log sequence to be identified, a behavior sequence feature embedding vector is constructed, including: filtering log records from the network behavior log sequence to be identified to obtain multiple log records, wherein each log record includes a valid operation type, access port, network protocol, timestamp, and message length; mapping the valid operation type, access port, and network protocol in the multiple log records to continuous vectors of discrete features respectively, to obtain multiple discrete vectors corresponding to each of the multiple log records; calculating the time interval between each log record and the previous log record (excluding the first log record) according to the timestamps corresponding to the multiple log records, to determine the time intervals corresponding to the multiple log records, wherein the time interval corresponding to the first log record is a preset value; obtaining the behavior representation vectors corresponding to the multiple log records by combining the message lengths, time intervals, and multiple discrete vectors corresponding to the multiple log records; and arranging the behavior representation vectors corresponding to the multiple log records in chronological order to obtain the behavior sequence feature embedding vector.

[0007] Optionally, based on the source IP and destination IP in the network behavior log sequence to be identified, the network topology feature embedding vector is determined, including: obtaining a global network access graph, wherein the nodes of the global network access graph represent IP addresses, and the edges represent the access relationships between IP addresses; based on the source IP and destination IP in the network behavior log sequence to be identified, and according to the global network access graph, determining the source node embedding vector corresponding to the source IP and the destination node embedding vector corresponding to the destination IP; concatenating the source node embedding vector and the destination node embedding vector to determine the network topology feature embedding vector.

[0008] Optionally, the behavioral sequence feature embedding vector and the network topology feature embedding vector are input into a preset target user representation model. Based on the dual-branch encoder in the preset target user representation model, feature codes are extracted and fused through a cross-attention mechanism to obtain a query vector. This includes: inputting the behavioral sequence feature embedding vector into the behavioral sequence branch encoder of the dual-branch encoder to extract the temporal dependency feature code of the behavioral sequence, obtaining the behavioral feature code; inputting the network topology feature embedding vector into the topology branch encoder of the dual-branch encoder to extract the structural association feature code of network access assets, obtaining the topology feature code; and using the behavioral feature code as the input to the query matrix and the topology feature code as the input to the key matrix and value matrix, performing scaling dot product cross-attention calculation to obtain the query vector.

[0009] Optionally, collect historical behavior log sequences corresponding to multiple historical users; input the historical behavior log sequences corresponding to multiple historical users into a preset target user representation model to extract multiple historical user representation vectors; determine the historical user with multiple corresponding historical user representation vectors as the first historical user and the remaining historical users as the second historical user; perform clustering processing on the multiple historical user representation vectors corresponding to the first historical user to generate a baseline feature vector corresponding to the first historical user; determine the baseline feature vector corresponding to the second historical user based on the historical user representation vector corresponding to the second historical user; determine the preset user vector correspondence based on the baseline feature vector corresponding to the first historical user and the baseline feature vector corresponding to the second historical user.

[0010] Optionally, an initial user representation model is constructed, which includes a dual-branch encoder and a cross-attention module; historical user behavior log sequences are obtained; data augmentation is performed on the behavior log sequences to obtain augmented training samples; based on the augmented training samples, the parameters of the initial user representation model are optimized using a self-supervised contrastive learning loss function to obtain a preset target user representation model, wherein the loss function aims to maximize the similarity of representation vectors of the same user across different augmented views and minimize the similarity of representation vectors between different users.

[0011] According to another aspect of the present invention, a user identification device is also provided, comprising: a collection module for collecting a network behavior log sequence to be identified; a construction module for constructing a behavior sequence feature embedding vector based on the operation behavior in the network behavior log sequence to be identified; a determination module for determining a network topology feature embedding vector based on the source IP and destination IP in the network behavior log sequence to be identified; an input module for inputting the behavior sequence feature embedding vector and the network topology feature embedding vector into a preset target user representation model, extracting feature encoding based on a dual-branch encoder in the preset target user representation model and fusing it through a cross-attention mechanism to obtain a query vector; a calculation module for calculating the similarity between the query vector and multiple vectors in a preset user vector correspondence relationship, wherein the preset user vector correspondence relationship represents multiple candidate users and the vectors corresponding to each candidate user; and a selection module for selecting candidate users corresponding to vectors whose similarity satisfies preset conditions as target users based on the preset user vector correspondence relationship.

[0012] According to another aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein, when the program is running, it controls the device where the non-volatile storage medium is located to execute any of the above-described user identification methods.

[0013] According to another aspect of the present invention, a computer device is also provided, the computer device including a processor, the processor being configured to run a program, wherein the program executes any of the user identification methods described above during runtime.

[0014] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements any of the above-described user identification methods.

[0015] In this embodiment of the invention, a user identification method is adopted. This involves collecting a sequence of network behavior logs to be identified; constructing a behavior sequence feature embedding vector based on the operational behaviors in the logs; determining a network topology feature embedding vector based on the source IP and destination IP in the logs; inputting the behavior sequence feature embedding vector and the network topology feature embedding vector into a preset target user representation model; extracting feature codes based on the dual-branch encoder in the preset target user representation model and fusing them through a cross-attention mechanism to obtain a query vector; calculating the similarity between the query vector and multiple vectors in a preset user vector correspondence, where the preset user vector correspondence represents multiple candidate users and their respective vectors; and selecting candidate users whose similarity satisfies preset conditions as target users based on the preset user vector correspondence. This achieves the goal of deep behavior representation learning without requiring a large amount of labeled data, thereby improving the technical effect of identity recognition and solving the technical problem of poor identity recognition performance caused by reliance on manual feature engineering and the lack of an effective self-supervised learning framework. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0017] Figure 1 A hardware structure block diagram of a computer terminal for implementing a user identification method is shown.

[0018] Figure 2 This is a flowchart illustrating a user identification method provided according to an embodiment of the present invention;

[0019] Figure 3 This is a system architecture diagram corresponding to the user identification method provided in an optional embodiment of the present invention;

[0020] Figure 4 This is a network-based deployment diagram of a system corresponding to the user identification method provided in an optional embodiment of the present invention;

[0021] Figure 5 This is a structural block diagram of a user identification device provided according to an embodiment of the present invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] According to an embodiment of the present invention, a method embodiment for user identification is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0025] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware structure block diagram of a computer terminal for implementing a user identification method is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1The different configurations shown.

[0026] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0027] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the user identification method in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the user identification method of the aforementioned application. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0028] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0029] Figure 2 This is a flowchart illustrating a user identification method provided according to an embodiment of the present invention, as shown below. Figure 2 As shown, the method includes the following steps:

[0030] Step S202: Collect the log sequence of network behavior to be identified.

[0031] In this step, raw behavioral logs are collected from sources such as network egress, terminal devices, and server logs. These logs include network traffic logs with source IP, destination IP, protocol, operation type, and timestamp. Raw log records containing key fields such as source / destination IP, protocol type, operation action, and timestamp can be captured by accessing data sources such as network traffic probes, firewall logs, or terminal auditing. These logs are then aggregated and organized according to chronological order or user dimension to form a structured continuous sequence. This network behavioral log sequence records all network activity trajectories of the user within a specific time window, including the topological relationships of accessed assets, the execution order of operation commands, and the spatiotemporal distribution characteristics of communication traffic.

[0032] Specifically, suppose there is a set of users in the enterprise's internal network environment. For any user The sequence of behavioral logs generated within a continuous time window is denoted as:

[0033]

[0034] in, For network operation types (such as GET, POST, CONNECT); Network protocols (TCP / UDP / ICMP / HTTP); For timestamps; The message length; For source IP and destination IP.

[0035] In addition, the logs also implicitly contain network topology relationships (access edges from source IP to destination IP) and entity relationships (relationship graphs between users, devices, and hosts).

[0036] The data can be preprocessed, filtering and integrating behavioral log data into a unified format dataset. Invalid logs with a field missing rate exceeding 50% are removed. Issues where the source IP is a private address but the location is incorrect are handled, and meaningless heartbeat connection signals or duplicate logs are filtered out. Sampling and compression are performed according to user-defined time slices. If multiple logs exist within the same time slice, the most representative one is selected using behavioral entropy, defined as follows:

[0037]

[0038] in, It is behavior entropy, It is behavior The probability of occurrence. The lower the behavioral entropy, the more representative the behavior is within that time slice.

[0039] Step S204: Construct a behavior sequence feature embedding vector based on the operation behavior in the network behavior log sequence to be identified.

[0040] In this step, discrete features are extracted from the logs, specifically network operation type, access port, network protocol type, log timestamp, and network packet length. These discrete features are then mapped into continuous vectors using an embedding layer. Subsequently, the time interval between adjacent actions is calculated, and the time interval and packet length are normalized. Finally, the vectors of operation type, port, protocol, normalized time interval, and normalized packet length are concatenated to construct the behavior sequence feature embedding vector. This process transforms the original unstructured or semi-structured log data into dense vectors with fixed dimensions, enabling the model to simultaneously learn the user's operation type, the timing of the behavior, and traffic volume characteristics. This comprehensively characterizes the user's access habits and provides standardized input data for subsequent identity recognition.

[0041] The process of constructing a behavior sequence feature embedding vector based on the operational behaviors in the network behavior log sequence to be identified includes the following steps: First, extract the key fields of each log record in the network behavior log sequence to be identified. The key fields include at least the operation type, access port, network protocol type, timestamp, and message length. Second, use a pre-trained embedding layer to map the discrete operation type, access port, and network protocol type into continuous dense vectors to capture the semantic information of these discrete features. Next, calculate the time interval between two adjacent log records. Specifically, taking the current log record as the reference, if there is a previous log record, calculate the difference between the timestamp of the current log record and the timestamp of the previous log record as the time interval; if the current log record is the first log record in the sequence, then... The time interval is set to zero or a preset initial value. Then, the calculated time interval and message length are normalized to eliminate dimensional differences and accelerate model convergence. The statistical parameters in the normalization process are calculated based on historical data from the training set. Subsequently, the continuous dense vectors of operation type, access port, network protocol, normalized time interval, and normalized message length are concatenated to obtain an independent behavior representation vector for each log record. Finally, the behavior representation vectors corresponding to all log records in the network behavior log sequence to be identified are arranged sequentially according to the time order of the original logs to form a behavior sequence feature embedding vector with a temporal structure. This vector can simultaneously represent the user's operation habits, access patterns, and traffic scale characteristics.

[0042] To improve the robustness and anti-interference ability of the model for identity recognition, data augmentation can be performed on the network behavior log sequence before constructing the behavior sequence feature embedding vector, expanding the scale of the original sequence data. In a given behavior sequence, some log points are randomly selected, and their specific destination IPs are generalized and replaced within the same subnet mask segment or business asset group. This guides the model to learn generalized representations of access to similar business assets, rather than memorizing specific IPs. For the numerous meaningless TCP retransmissions, heartbeat keep-alive packets, and high-frequency, high-concurrency automated probes present in the network logs, which are continuous and highly consistent in content, a time sliding window is used for behavior merging and deduplication, eliminating redundant nodes, making the sequence more compact, and highlighting core business interaction instructions. Randomly masking some log points in the sequence with probability γ. Payload information is used to simulate scenarios where the payload is invisible due to traffic encryption and missing logs in a network environment, improving the model's robustness in blind encrypted environments. It can construct instruction type labels for specific business scenarios and randomly replace some log points in the sequence with probability γ. The payload information consists of replacement instructions under the same label, which is used to simulate behavioral differences caused by personal habits, code programs and other characteristics in the network environment, thereby improving the robustness of the model in the real environment.

[0043] Step S206: Determine the network topology feature embedding vector based on the source IP and destination IP in the network behavior log sequence to be identified.

[0044] In this step, the process of determining the network topology feature embedding vector based on the source IP and destination IP in the network behavior log sequence to be identified includes the following steps: First, a global network access graph is constructed. The node set of the global network access graph includes all IP addresses or network segment identifiers that have appeared in the enterprise's internal network, and the edge set represents the access connection relationship between IP addresses or network segment identifiers obtained based on historical behavior log statistics. Second, the global network access graph is trained using a graph embedding algorithm to learn the structural feature vector corresponding to each node and store it in a vector database. Then, for each log record in the network behavior log sequence to be identified, the nodes corresponding to its source IP address and destination IP address are found respectively. If the source IP address or destination IP address is a dynamically allocated address, it is first mapped to the IP network segment identifier or business asset group label, and then the corresponding node is found. Then, the source node structure feature vector corresponding to the source IP address and the destination node structure feature vector corresponding to the destination IP address are obtained from the vector database. Subsequently, the source node structure feature vector and the destination node structure feature vector are concatenated to obtain the network topology feature embedding vector of the log record. Finally, the network topology feature embedding vectors corresponding to all log records in the log sequence to be identified are arranged in chronological order to form a network topology feature sequence, which can characterize the structural pattern and topological relationship of user access to network assets.

[0045] Step S208: Input the behavior sequence feature embedding vector and the network topology feature embedding vector into the preset target user representation model, extract feature encoding based on the dual-branch encoder in the preset target user representation model and fuse them through the cross-attention mechanism to obtain the query vector.

[0046] In this step, the behavior sequence feature embedding vector and the network topology feature embedding vector are respectively input to the position encoding module for absolute position encoding to preserve the temporal order information and structural position information in the sequence, resulting in position-encoded behavior sequence feature vectors and position-encoded network topology feature vectors. The position-encoded behavior sequence feature vectors are then input to the behavior sequence branch encoder in the dual-branch encoder, where a multi-head self-attention mechanism and a feedforward neural network are used to extract temporal dependency feature encodings of the behavior sequence. The multi-head self-attention mechanism is used to capture long-term temporal dependencies between user actions. The position-encoded network topology feature vectors are then input to the topology branch encoder in the dual-branch encoder, where... A multi-head self-attention mechanism and a feedforward neural network are used to extract structural association feature encodings of network accessed assets. The multi-head self-attention mechanism is used to learn structural transfer relationships between accessed assets. The behavioral sequence feature encoding output by the behavioral sequence branch encoder is used as the input to the query matrix, and the topological structure feature encoding output by the topological structure branch encoder is used as the input to the key matrix and the value matrix. Scaling dot product cross-attention calculation is performed. Attention weights are obtained by calculating the dot product of the query matrix and the key matrix and normalizing it. Then, the attention weights are used to perform a weighted summation on the value matrix, thereby deeply fusing the structural association information in the network topology with the temporal dependency information in the user behavior sequence, and finally obtaining a query vector containing multi-dimensional complementary information.

[0047] Step S210: Calculate the similarity between the query vector and multiple vectors in the preset user vector correspondence relationship, wherein the preset user vector correspondence relationship represents multiple candidate users and the vectors corresponding to each candidate user.

[0048] In this step, the similarity between the query vector and multiple vectors in the preset user vector correspondence is calculated, specifically including the following steps: First, the preset user vector correspondence is read. The preset user vector correspondence stores multiple candidate users and their corresponding baseline feature vectors. The baseline feature vectors are obtained by inputting the historical behavior log sequences of known users into a trained preset target user representation model, extracting user representation vectors, and then performing mean aggregation or clustering on multiple segments of the same user's vectors. Next, the cosine similarity algorithm is used to calculate the cosine similarity between the query vector and the baseline feature vector corresponding to each candidate user in the preset user vector correspondence. The calculation formula is to divide the inner product of the query vector and the target baseline feature vector by the product of the magnitude of the query vector and the magnitude of the target baseline feature vector. Finally, the similarity score set between the query vector and the baseline feature vectors corresponding to all candidate users is output. This set reflects the degree of matching between the behavioral characteristics of the current user to be identified and the behavioral characteristics of historically known users.

[0049] Step S212: Based on the preset user vector correspondence, select candidate users corresponding to vectors whose similarity meets the preset conditions as target users.

[0050] In this step, based on the preset user vector correspondence, candidate users corresponding to vectors whose similarity meets preset conditions are selected as target users. Specifically, this includes the following steps: First, the query vector is compared with all baseline feature vectors in the preset user vector correspondence to obtain the maximum similarity score and the corresponding candidate user. Second, anomaly blocking verification is performed. If the candidate user corresponding to the maximum similarity score is a known malicious user, and the maximum similarity score is greater than or equal to a preset dangerous behavior threshold, the current identity is determined to be abnormal, triggering a security alarm and disconnecting the network session. Next, identity spoofing verification is performed. If no abnormal blocking is triggered, it is further determined whether the candidate user corresponding to the maximum similarity score is the holder of the currently logged-in account. If the maximum similarity score is less than a preset security trust threshold, the current traffic is determined to be inconsistent with the account holder's consistent behavior, identifying it as account credentials being stolen or misused, or malicious retaliation by internal personnel. Access permissions are automatically suspended and forced authentication is initiated. Finally, if the maximum similarity score is less than the preset security trust threshold and no known malicious user is matched, it is identified as an unknown user, and the identification result and similarity score are sent to the manual review process.

[0051] Specifically, given a sequence of behaviors of the user to be identified The goal is to determine whether it belongs to the known set of users. Alternatively, it can be identified as engaging in harmful behavior / an unknown user. Formally, a coding mapping is learned:

[0052]

[0053] Variable-length behavior sequences are mapped to fixed-dimensional user representation vectors. Recognition is performed using cosine similarity.

[0054]

[0055] If the maximum similarity is below the threshold If the identity is abnormal, it is considered abnormal; if the similarity with a vector in the blacklist is higher than a threshold. If so, it is determined to be harmful behavior.

[0056] The above steps not only achieve accurate identity recognition based on deep behavioral representation, but also avoid the slow speed of one-by-one comparison in traditional technologies, achieving efficient and accurate fast retrieval. Therefore, it can solve the problems of insufficient capture of deep behavioral patterns and poor robustness of identity recognition in existing technologies when facing real-world scenarios such as missing network logs and IP changes, due to reliance on manual feature engineering and the lack of an effective self-supervised learning framework to build user identity recognition systems. This results in improved identity recognition accuracy and system robustness, as well as increased retrieval efficiency.

[0057] As an optional embodiment, a behavior sequence feature embedding vector is constructed based on the operational behaviors in the network behavior log sequence to be identified. This includes: filtering log records from the network behavior log sequence to obtain multiple log records, each including a valid operation type, access port, network protocol, timestamp, and message length; mapping the valid operation type, access port, and network protocol in the multiple log records to continuous vectors of discrete features, obtaining multiple discrete vectors corresponding to each log record; calculating the time interval between each log record (excluding the first log record) and the previous log record based on the timestamps corresponding to the multiple log records, determining the time intervals corresponding to each log record, where the time interval corresponding to the first log record is a preset value; combining the message length, time interval, and multiple discrete vectors corresponding to each log record to obtain a behavior representation vector corresponding to each log record; and arranging the behavior representation vectors corresponding to the multiple log records in chronological order to obtain the behavior sequence feature embedding vector.

[0058] Optionally, the process of constructing behavior sequence feature embedding vectors based on the operation behaviors in the network behavior log sequence to be identified specifically includes: first, parsing and filtering the network behavior log sequence to be identified to extract multiple log records containing valid operation type, access port, network protocol, timestamp, and message length; second, using an embedding layer to map the three discrete features of valid operation type, access port, and network protocol in each log record into continuous high-dimensional dense vectors, thereby obtaining multiple discrete feature vectors corresponding to each log record; then, calculating the time difference between adjacent log records based on the timestamp of each log record, and setting the time interval of the first log record in the sequence to a preset value. The initial value is used, and for each subsequent log record, the difference between its timestamp and the immediately preceding log record is calculated as the time interval of that log record. Then, the calculated time interval and the original message length are normalized to eliminate the influence of dimensions. The normalized time interval, the normalized message length, and the aforementioned discrete feature vectors are then concatenated to generate the behavior representation vector corresponding to each log record. Finally, the behavior representation vectors corresponding to multiple log records are sequentially arranged in chronological order according to the original logs to form a complete behavior sequence feature embedding vector. This vector can comprehensively represent the user's operating habits, access patterns, and traffic timing characteristics.

[0059] Specifically, the preprocessed and data-augmented behavior logs are converted into a continuous, dense vector representation that the model can learn. User behavior can be feature-embedded from three dimensions: behavior sequence features, network topology features, and entity association features, thereby obtaining a more complete description of user identity features. Let the user's behavior log sequence generated within a time window be:

[0060]

[0061] The i-th log record is represented as:

[0062]

[0063] in: Indicates the type of network operation currently being performed; Indicates the access port; Indicates the network protocol type; Represents the log timestamp; Indicates the length of the network message.

[0064] First, the Embedding layer is used to map discrete features into continuous vectors:

[0065]

[0066]

[0067]

[0068] Further calculate the time interval between adjacent actions:

[0069]

[0070] The time interval and message length are normalized.

[0071]

[0072]

[0073] Finally, the above features are concatenated to obtain the behavior representation of the (i)th log point:

[0074]

[0075] in This indicates a vector concatenation operation.

[0076] The network behavior feature embedding representation corresponding to the entire behavior sequence is as follows:

[0077]

[0078] in This refers to the behavioral characteristic dimension.

[0079] Through the above construction, the model can not only learn what operations users perform, but also learn the timing patterns and traffic volume characteristics of the behaviors, thereby characterizing user access habits.

[0080] As an optional embodiment, the network topology feature embedding vector is determined based on the source IP and destination IP in the network behavior log sequence to be identified, including: obtaining a global network access graph, wherein the nodes of the global network access graph represent IP addresses and the edges represent the access relationships between IP addresses; based on the source IP and destination IP in the network behavior log sequence to be identified, the source node embedding vector corresponding to the source IP and the destination node embedding vector corresponding to the destination IP are determined according to the global network access graph; the source node embedding vector and the destination node embedding vector are concatenated to determine the network topology feature embedding vector.

[0081] Optionally, a global network access graph is obtained, whose node set can cover all IP addresses appearing in the internal network, and edge set represents the access connection relationship between IP addresses obtained based on historical log statistics. Next, each log record in the network behavior log sequence to be identified is processed to extract its source IP address and destination IP address. If the source IP address or destination IP address is a dynamically allocated address, it is first mapped to its corresponding IP network segment identifier or business asset group label, and then the corresponding node is found in the global network access graph. Then, the pre-trained node embedding vector database is queried to obtain the source node embedding vector corresponding to the source IP address and the destination node embedding vector corresponding to the destination IP address. Finally, the source node embedding vector and the destination node embedding vector are concatenated to generate a network topology feature embedding vector representing the network access topology of the log record.

[0082] Specifically, in order to describe the network topology of user access to assets, a directed network access graph is constructed based on the source IP address and destination IP address in the logs:

[0083]

[0084] in: Represents all IP nodes in the network; This indicates the actual access connection relationship that occurred.

[0085] Subsequently, a graph embedding algorithm is used to learn the structural representation of the network access graph. For any IP node Its structural feature vector is represented as:

[0086]

[0087] in This represents a graph embedding function.

[0088] For log points The node representation is obtained based on its corresponding source IP and destination IP:

[0089] Obtain the network topology characteristics corresponding to the i-th log entry.

[0090] The network topology corresponding to the entire behavioral sequence is represented as follows:

[0091]

[0092] in For topological feature dimensions.

[0093] To further depict the relationships between users, devices, and services, this invention constructs an internal entity relationship diagram: The node set includes: User, Device, and Host. The edge set represents the relationships between entities, such as (User, Device), (Device, Host), etc.

[0094] Then, a graph attention network is used for entity relationship modeling. For node i and its neighbor node j, the attention weights are first calculated:

[0095]

[0096] in: denoted as the initial features of the node; W is the linear transformation matrix; and a is the learnable parameter.

[0097] Further normalization:

[0098]

[0099] The node representation is updated as follows:

[0100]

[0101] Ultimately, the entity association representation of the user account and its associated device is obtained:

[0102]

[0103] in This represents the dimension of entity association features.

[0104] Entity graph modeling can fully utilize high-order relationships between users, devices, and hosts, improving the model's ability to identify scenarios such as account sharing, permission abuse, and identity theft.

[0105] As an optional embodiment, the behavioral sequence feature embedding vector and the network topology feature embedding vector are input into a preset target user representation model. Based on the dual-branch encoder in the preset target user representation model, feature codes are extracted and fused through a cross-attention mechanism to obtain a query vector. This includes: inputting the behavioral sequence feature embedding vector into the behavioral sequence branch encoder of the dual-branch encoder to extract the temporal dependency feature code of the behavioral sequence, obtaining the behavioral feature code; inputting the network topology feature embedding vector into the topology branch encoder of the dual-branch encoder to extract the structural association feature code of network access assets, obtaining the topology feature code; and using the behavioral feature code as the input to the query matrix and the topology feature code as the input to the key matrix and value matrix, performing scaling dot product cross-attention calculation to obtain the query vector.

[0106] Optionally, the behavior sequence feature embedding vector is input into the behavior sequence branch encoder of the dual-branch encoder. A multi-head self-attention mechanism and a feedforward neural network are used to extract long-term temporal dependencies between user actions, generating behavior feature encoding. Next, the network topology feature embedding vector is input into the topology branch encoder of the dual-branch encoder. A multi-head self-attention mechanism and a feedforward neural network are used to learn structural migration relationships between network access assets, generating topology feature encoding. Then, the behavior feature encoding is used as input to the query matrix, and the topology feature encoding is used as input to the key matrix and value matrix. Next, a scaled dot product cross-attention calculation is performed. Attention weights are obtained by calculating the dot product of the query matrix and the key matrix and normalizing the result. These attention weights are then used to perform a weighted summation of the value matrix, thereby deeply fusing the structural association information in the network topology with the temporal dependency information in the user behavior sequence. Finally, the fused vector is output as the query vector.

[0107] Specifically, sine and cosine functions are introduced to perform absolute position encoding on the network behavior sequence feature embedding vector B and the network topology feature embedding vector S. For the j-th dimension of the embedding of the i-th log point in the sequence, the calculation formula is:

[0108]

[0109] in, This indicates the dimension of the feature embedding S or B. Both the behavioral sequence feature embedding vector B and the spatial structure feature embedding vector S need to be superimposed with positional encoding to obtain the final vectors B' and S' input to the attention encoder module.

[0110] To learn the temporal dependencies in user behavior sequences and the structural relationships in network access topology, the behavior sequence feature embedding vector B' and the network topology feature embedding vector S' are encoded separately. The behavior sequence branch focuses on learning the long-term temporal dependencies between user actions, while the network topology branch focuses on learning the structural relationships between accessed assets. Joint modeling using a dual-branch Transformer Encoder simultaneously preserves both behavioral semantic features and network structural features, improving the discriminative power of the user identity representation vector and thus enhancing the accuracy of subsequent vector retrieval and identity recognition.

[0111] For the behavioral feature sequence B', the query matrix, key matrix, and value matrix are first generated through linear mapping:

[0112]

[0113]

[0114]

[0115] in, , , is a learnable parameter matrix.

[0116] Then calculate the scaled dot product attention:

[0117]

[0118] in, This represents the dimension of the key vector.

[0119] To enhance the model's ability to represent different semantic subspaces, a multi-head attention mechanism is introduced:

[0120]

[0121]

[0122] in, This indicates the number of heads receiving multi-head attention.

[0123] Then perform residual joins and layer normalization:

[0124]

[0125] Further utilize feedforward networks for nonlinear mapping:

[0126]

[0127] in, This represents the activation function.

[0128] The final result of the behavior sequence branching encoding is as follows:

[0129]

[0130] For the topological feature sequence S′, the same Transformer Encoder structure is used for modeling.

[0131] First, calculate:

[0132]

[0133]

[0134]

[0135] in, , , is a learnable parameter matrix.

[0136] Then, the structural transition relationships in the network asset access topology are learned through a multi-head self-attention mechanism:

[0137]

[0138] The intermediate representation of the topology is obtained:

[0139]

[0140] Further, the network topology encoding results were obtained:

[0141]

[0142] Since behavioral sequence features mainly describe users' operating habits and time dependencies, while network topology features mainly describe the structural patterns of users accessing assets, the two are highly complementary.

[0143] Therefore, feature splicing is used for fusion: .

[0144] make , Cross-attention calculation is performed to obtain the user representation vector H:

[0145]

[0146] in, , , The output parameters are set.

[0147] The user representation vector H generated by the model is used to obtain the prediction result of the user's next behavior category through the output layer:

[0148]

[0149] Cross-entropy is used as the loss function for predicting behavior categories:

[0150]

[0151] Using the augmented dataset, analyze the user logs of user u. and one of its random enhanced variants Composed as a pair of positive samples, With different users and Negative samples are used for training. These include user logs. The calculated user representation vector is H. The calculated user representation vector is H`, and the training representation vector obtained from the negative sample j is... The loss function uses cosine distance to maximize positive sample similarity and minimize negative sample similarity. The loss function is defined as follows:

[0152]

[0153] The loss function is obtained by comparing a positive sample with... Model optimization is performed using a number of negative samples; more negative samples help generate more robust embeddings.

[0154] To improve the accuracy of identity recognition, this method employs a multi-task learning strategy, jointly optimizing the location prediction task and the self-supervised contrastive learning task. The final loss function is designed as follows:

[0155]

[0156] in These are adjustable parameters.

[0157] As an optional embodiment, historical behavior log sequences corresponding to multiple historical users are collected; these sequences are input into a preset target user representation model to extract multiple historical user representation vectors; historical users with multiple corresponding historical user representation vectors are identified as first historical users, and the remaining historical users are identified as second historical users; clustering is performed on the multiple historical user representation vectors corresponding to the first historical user to generate a baseline feature vector corresponding to the first historical user; based on the historical user representation vectors corresponding to the second historical users, a baseline feature vector corresponding to the second historical user is determined; and based on the baseline feature vectors corresponding to the first and second historical users, a preset user vector correspondence is determined.

[0158] Optionally, the process of constructing the pre-defined user vector correspondence includes: First, collecting historical behavior log sequences corresponding to multiple historical users within the enterprise, and inputting these sequences into a pre-trained pre-defined target user representation model to extract one or more historical user representation vectors corresponding to each historical user; Second, performing statistical distribution analysis on the extracted historical user representation vectors to determine those historical users who have corresponding representation vectors in multiple different time windows or multiple independent behavior segments, and marking them as first historical users (i.e., known users with stable behavior patterns and sufficient data), while marking historical users who only have a few or single representation vectors as second historical users. Next, for the first historical user, a clustering algorithm (such as K-Means or mean aggregation) is performed on its corresponding multiple historical user representation vectors to extract cluster centers or calculate average vectors as the baseline feature vector of the first historical user, so as to eliminate the randomness of single behavior and establish a stable identity baseline; then, for the second historical user, its unique or main historical user representation vector is directly used as its baseline feature vector; finally, the baseline feature vectors of the first and second historical users are bound and stored with their corresponding user identity identifiers to form a preset user vector correspondence relationship, which constitutes the basis of the whitelist or blacklist feature library of the identity recognition layer.

[0159] Specifically, the pre-defined user vector correspondence can be constructed in the form of a vector feature library. This library can include a whitelist feature library and a blacklist feature library. It continuously collects historical multi-dimensional behavior logs of each legally registered account within the enterprise during normal office or operational periods. The log sequences of each account are segmented and input into the model to extract their corresponding standard behavior representation vectors. Multiple vector segments for the same account are then clustered using the mean or the Top-K core cluster centers are retained as the user's baseline identity feature vector, stored in the vector database, denoted as the whitelist library.

[0160]

[0161] Collect logs of historical red-blue team (RBF) attacks, known abnormal traffic from Trojan horse external connections (C2), and typical violation operation logs such as unauthorized probes. Input these threat logs into the model, extract high-risk behavior representation vectors, and label them with corresponding threat tags such as "scanning," "brute force," and "data outreach," storing them in a feature database as a blacklist.

[0162]

[0163] During real-time network auditing, the currently logged-in account is dynamically captured using a fixed-length sliding window through a streaming computing framework. Real-time network behavior logs are input into the model to generate behavior representation vectors to be compared. .

[0164] Parallel computation using cosine similarity algorithm Similarity to vectors in the vector feature library:

[0165]

[0166] The decision logic performs the following composite check:

[0167] Abnormal blocking (blacklist triggered): Calculation Blacklist database The highest similarity among all known threat vectors .like (β is a preset threshold for dangerous behavior) indicates that the current operation is highly similar to a known historical attack. The system will immediately trigger the highest level security alert and disconnect the account's network session.

[0168] Identity spoofing verification (whitelist not passed): If the blacklist is not triggered, then calculate... The account is in the whitelist. The highest similarity of the baseline feature vectors registered in the database .like (α is the preset security trust threshold) indicates that the current traffic topology and operation sequence are extremely inconsistent with the account holder's usual behavior habits, and are judged as "account credentials have been stolen and misused" or "internal personnel maliciously betray". The system automatically suspends access permissions and forcibly initiates permission authentication.

[0169] Through the above steps, this solution effectively solves the problem of insufficient representativeness of a single sample due to missing network logs or IP changes. It uses clustering to automatically extract user behavior baselines with strong anti-interference capabilities and high stability from massive historical data. Compared with direct comparison using raw log vectors, it significantly improves the robustness and accuracy of the identity recognition system in complex real-world scenarios.

[0170] As an optional embodiment, an initial user representation model is constructed, which includes a dual-branch encoder and a cross-attention module; historical user behavior log sequences are obtained; data augmentation is performed on the behavior log sequences to obtain augmented training samples; based on the augmented training samples, the parameters of the initial user representation model are optimized using a self-supervised contrastive learning loss function to obtain a preset target user representation model, wherein the loss function aims to maximize the similarity of representation vectors of the same user across different augmented views and minimize the similarity of representation vectors between different users.

[0171] Optionally, the process of constructing a preset target user representation model specifically includes: First, constructing an initial user representation model. The network architecture of this model includes a dual-branch encoder (used to process behavioral sequence features and network topology features respectively) and a cross-attention module to achieve deep fusion of multiple feature information. Second, acquiring historical behavior log sequences of historical users within the enterprise as raw training data. Next, applying data augmentation algorithms to the behavior log sequences, including destination IP network segment generalization offset, high-frequency repetitive operation simplification, operation command masking, and operation command behavior transformation, generating multiple different augmented views from the original sequence, thus forming augmented training sample pairs. Then, inputting the augmented training samples into the initial user representation model, and using a self-supervised contrastive learning strategy for parameter optimization. Its loss function aims to maximize the cosine similarity of the representation vectors generated between different augmented views of the same user, while minimizing the similarity of representation vectors between different users. Through this contrastive learning mechanism, the model can learn user behavior representations with strong discriminative power and robustness. Finally, after iterative training convergence, the preset target user representation model with optimized parameters is obtained.

[0172] Figure 3 This is a system architecture diagram corresponding to the user identification method provided by an optional embodiment of the present invention. As one optional embodiment, such as... Figure 3 As shown, the overall architecture consists of three layers: a data acquisition layer, a model training layer, and an identity recognition layer. The data acquisition layer collects raw behavior logs from sources such as network egress, terminal devices, and server logs, including network traffic logs such as source IP, destination IP, protocol, operation type, and timestamps. The model training layer preprocesses and augments the collected data, trains a user representation model using self-supervised contrastive learning, outputs user representation vectors, and constructs a whitelist vector library (known normal users) or a blacklist vector library (known harmful users). The identity recognition layer receives the behavior logs to be identified, obtains a query vector through the same preprocessing and model inference, performs similarity retrieval with the feature library, and outputs the identification result (known user / harmful user / unknown user).

[0173] The following provides a specific implementation method. Figure 4 This is a network-based deployment diagram of the system corresponding to the user identification method provided in an optional embodiment of the present invention, as shown below. Figure 4As shown, traffic probes are deployed in an enterprise's internal network to collect logs from the core switch and firewall. Each log entry includes: source IP, destination IP, protocol (TCP / UDP / ICMP / HTTP), operation type (GET, POST, CONNECT, file transfer, etc.), and timestamp (accurate to milliseconds). Simultaneously, the system retrieves the account-IP mapping relationship from the authentication system and user interaction records from the mail server and file sharing server as social relationship data.

[0174] Preprocessing and enhancement: Aggregate logs from 7 consecutive days by user ID to form a behavior sequence for each user. For cases where the login IP changes, IP geolocation or subnet mapping is used. Then, data augmentation operations are performed on the training data, including destination IP network segment generalization offset, simplification of high-frequency repetitive operations, operation command masking, and operation command behavior transformation. After augmentation, the data volume is increased to 5 times the original.

[0175] Model Training: The model was implemented using the PyTorch framework. The behavioral sequence feature embedding dimension D=256, the multi-head attention head count was 8, and the encoder layer count was 4. The social relationship graph embedding used node2vec, with a walk length of 80, sampling 10 walks per node, and an embedding dimension of 128. During training, the batch size was 64, and the learning rate was 1e-4.

[0176] Vector Feature Library Construction: After training, the representation vectors of all employees with known identities are extracted. An average vector is generated from the logs of each employee for 7 consecutive days and stored in the whitelist library. At the same time, logs of 200 known malicious behavior samples (such as ransomware communication, port scanning, and brute-force attacks) are collected, and their representation vectors are calculated and stored in the blacklist library.

[0177] Online identification: Real-time collection of the user's recent 10-minute behavior logs (approximately 200-500 entries) is performed, and a query vector is obtained after the same preprocessing and model inference. The whitelist is searched, returning the three most similar users and their cosine similarity. If the maximum similarity is greater than 0.9, the user is identified; otherwise, the blacklist is searched. If the maximum similarity is greater than 0.80, the behavior is deemed harmful and an alarm is triggered; otherwise, the user is marked as "unknown" and sent for manual analysis. The threshold is set to maximize the accuracy of allowing users to proceed and improve the ability to filter unknown identities.

[0178] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0179] Through the above description of the embodiments, those skilled in the art can clearly understand that the user identification method according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0180] According to embodiments of the present invention, a user identification device for implementing the above-described user identification method is also provided. Figure 5 This is a structural block diagram of a user identification device provided according to an embodiment of the present invention, such as... Figure 5 As shown, the user identification device includes: a data acquisition module 502, a data construction module 504, a data determination module 506, an input module 508, a calculation module 510, and a selection module 512. The user identification device will be described below.

[0181] The acquisition module 502 is used to acquire the log sequence of network behavior to be identified.

[0182] Module 504 is used to construct a behavior sequence feature embedding vector based on the operation behavior in the network behavior log sequence to be identified.

[0183] The determination module 506 is used to determine the network topology feature embedding vector based on the source IP and destination IP in the network behavior log sequence to be identified.

[0184] The input module 508 is used to input the behavioral sequence feature embedding vector and the network topology feature embedding vector into the preset target user representation model. Based on the dual-branch encoder in the preset target user representation model, the feature encoding is extracted and fused through the cross-attention mechanism to obtain the query vector.

[0185] The calculation module 510 is used to calculate the similarity between the query vector and multiple vectors in the preset user vector correspondence relationship, wherein the preset user vector correspondence relationship represents multiple candidate users and the vectors corresponding to each candidate user.

[0186] The selection module 512 is used to select candidate users whose similarity satisfies preset conditions as target users based on preset user vector correspondence.

[0187] It should be noted that the acquisition module 502, construction module 504, determination module 506, input module 508, calculation module 510, and selection module 512 mentioned above correspond to steps S202 to S212 in the embodiments. Multiple modules and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of the device, can run on the computer terminal 10 provided in the embodiments.

[0188] Embodiments of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one of a plurality of network devices in a computer network. The computer device includes a memory and a processor.

[0189] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the user identification method and apparatus in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned user identification method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to a computer terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0190] The processor can access information and applications stored in memory via a transmission device to execute any of the aforementioned user identification methods.

[0191] This invention provides a user identification method that involves collecting a sequence of network behavior logs to be identified; constructing a behavior sequence feature embedding vector based on the operational behaviors in the logs; determining a network topology feature embedding vector based on the source and destination IPs in the logs; inputting the behavior sequence feature embedding vector and the network topology feature embedding vector into a preset target user representation model; extracting feature codes based on a dual-branch encoder in the model and fusing them through a cross-attention mechanism to obtain a query vector; calculating the similarity between the query vector and multiple vectors in a preset user vector correspondence, where the preset user vector correspondence represents multiple candidate users and their respective vectors; and selecting candidate users whose similarity satisfies preset conditions as target users based on the preset user vector correspondence. This method achieves the goal of deep behavior representation learning without requiring a large amount of labeled data, thereby improving the identification effect and solving the technical problem of poor identification performance caused by reliance on manual feature engineering and the lack of an effective self-supervised learning framework.

[0192] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a non-volatile storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0193] Embodiments of the present invention also provide a non-volatile storage medium. Optionally, in this embodiment, the aforementioned non-volatile storage medium can be used to store the program code executed by the user identification method provided in the above embodiments.

[0194] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0195] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing any of the above-described user identification methods.

[0196] Embodiments of the present invention also provide a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, it can implement any of the user identification methods described above.

[0197] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0198] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0199] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0200] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0201] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0202] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0203] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A user identification method, characterized in that, include: Collect log sequences of network behaviors to be identified; Based on the operational behaviors in the network behavior log sequence to be identified, construct a behavior sequence feature embedding vector; Based on the source IP and destination IP in the network behavior log sequence to be identified, determine the network topology feature embedding vector; The behavior sequence feature embedding vector and the network topology feature embedding vector are input into a preset target user representation model. Feature encoding is extracted based on the dual-branch encoder in the preset target user representation model and fused through a cross-attention mechanism to obtain a query vector. Calculate the similarity between the query vector and multiple vectors in the preset user vector correspondence relationship, wherein the preset user vector correspondence relationship represents multiple candidate users and the vectors corresponding to each of the multiple candidate users; Based on the preset user vector correspondence, candidate users corresponding to vectors whose similarity meets the preset conditions are selected as target users.

2. The method according to claim 1, characterized in that, The step of constructing a behavior sequence feature embedding vector based on the operational behaviors in the network behavior log sequence to be identified includes: Log records are filtered from the network behavior log sequence to be identified to obtain multiple log records, wherein each log record includes the valid operation type, access port, network protocol, timestamp and message length; The valid operation type, access port, and network protocol in the multiple log records are mapped to continuous vectors of discrete features, respectively, to obtain multiple discrete vectors corresponding to each of the multiple log records; Based on the timestamps corresponding to the multiple log records, the time interval between each log record (excluding the first log record) and the previous log record is calculated, and the time interval corresponding to each of the multiple log records is determined, wherein the time interval corresponding to the first log record is a preset value; By taking the message length, time interval, and multiple discrete vectors corresponding to each of the multiple log records, we obtain the behavior representation vector corresponding to each of the multiple log records. The behavior representation vectors corresponding to the multiple log records are arranged in chronological order to obtain the behavior sequence feature embedding vector.

3. The method according to claim 1, characterized in that, The step of determining the network topology feature embedding vector based on the source IP and destination IP in the network behavior log sequence to be identified includes: Obtain a global network access graph, wherein nodes in the global network access graph represent IP addresses and edges represent access relationships between IP addresses; Based on the source IP and destination IP in the network behavior log sequence to be identified, the source node embedding vector corresponding to the source IP and the destination node embedding vector corresponding to the destination IP are determined according to the global network access graph. The source node embedding vector and the destination node embedding vector are concatenated to determine the network topology feature embedding vector.

4. The method according to claim 1, characterized in that, The process involves inputting the behavior sequence feature embedding vector and the network topology feature embedding vector into a preset target user representation model, extracting feature codes based on the dual-branch encoder in the preset target user representation model, and fusing them through a cross-attention mechanism to obtain a query vector, including: The behavior sequence feature embedding vector is input into the behavior sequence branch encoder in the dual-branch encoder to extract the temporal dependency feature encoding of the behavior sequence and obtain the behavior feature encoding. The network topology feature embedding vector is input into the topology branch encoder of the dual-branch encoder to extract the structural association feature encoding of network access assets and obtain the topology feature encoding. Using the behavioral feature encoding as input to the query matrix and the topological structure feature encoding as input to the key matrix and value matrix, scaling dot product cross attention calculation is performed to obtain the query vector.

5. The method according to claim 1, characterized in that, Also includes: Collect historical behavior log sequences corresponding to multiple historical users; The historical behavior log sequences corresponding to each of the multiple historical users are input into the preset target user representation model to extract multiple historical user representation vectors; The historical user with multiple corresponding historical user representation vectors is identified as the first historical user, and the remaining historical users are identified as the second historical users. Clustering is performed on the multiple historical user representation vectors corresponding to the first historical user to generate the baseline feature vector corresponding to the first historical user. Based on the historical user representation vector corresponding to the second historical user, determine the baseline feature vector corresponding to the second historical user; The preset user vector correspondence is determined based on the baseline feature vector corresponding to the first historical user and the baseline feature vector corresponding to the second historical user.

6. The method according to any one of claims 1 to 5, characterized in that, Also includes: Construct an initial user representation model, wherein the initial user representation model includes a dual-branch encoder and a cross-attention module; Obtain the historical user behavior log sequence; Data augmentation is performed on the behavior log sequence to obtain augmented training samples; Based on the enhanced training samples, the parameters of the initial user representation model are optimized using a self-supervised contrastive learning loss function to obtain the preset target user representation model. The loss function aims to maximize the similarity of the representation vectors of the same user across different enhanced views and minimize the similarity of the representation vectors between different users.

7. A user identification device, characterized in that, include: The acquisition module is used to collect the log sequences of network behaviors to be identified. The construction module is used to construct a behavior sequence feature embedding vector based on the operation behavior in the network behavior log sequence to be identified; The determination module is used to determine the network topology feature embedding vector based on the source IP and destination IP in the network behavior log sequence to be identified; The input module is used to input the behavior sequence feature embedding vector and the network topology feature embedding vector into a preset target user representation model, extract feature encoding based on the dual-branch encoder in the preset target user representation model and fuse them through a cross-attention mechanism to obtain a query vector; The calculation module is used to calculate the similarity between the query vector and multiple vectors in the preset user vector correspondence relationship, wherein the preset user vector correspondence relationship represents multiple candidate users and the vectors corresponding to each of the multiple candidate users; The selection module is used to select candidate users whose similarity satisfies preset conditions as target users based on the preset user vector correspondence relationship.

8. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the non-volatile storage medium to perform the user identification method according to any one of claims 1 to 6.

9. A computer device, characterized in that, include: Memory and processor The memory stores computer programs; The processor is configured to execute a computer program stored in the memory, wherein when the computer program is executed, the processor performs the user identification method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the user identification method according to any one of claims 1 to 6.

Images