58 results about "Normal behaviour" patented technology

The invention relates to the technical field of pet behavior data processing, and discloses a time-space sequence data processing method and system for pet abnormal behavior recognition, and the method comprises the steps: 1, obtaining multi-modal data, carrying out the time alignment, building a multi-scale scene semantic graph, and generating a grid occupancy frequency and a region transfer matrix; 2, constructing a normal behavior template library, and generating window-level spatio-temporal features; 3, establishing group normal behavior distribution by using a generative density model, calculating a residual error in combination with a time sequence prediction model, and obtaining individual model parameters; 4, performing statistics on historical rhythm distribution and calculating differences of the day to obtain rhythm deviations; 5, fusing multi-component anomalies to obtain a comprehensive anomaly score; step 6, introducing an Internet of Things event to generate a gating coefficient and adjusting an abnormal score; and 7, comparing the abnormal score after gating with a threshold value, and outputting an abnormal alarm. According to the invention, accurate identification and stable alarm of the abnormal behavior of the pet are realized.

The invention belongs to the technical field of artificial intelligence, and discloses an operation behavior characteristic-driven rehabilitation training effect dynamic evaluation method, which comprises the following steps of: extracting compensatory behavior characteristics and recessive behavior mode characteristics by acquiring multi-dimensional operation behavior data and physiological sensor data of a patient on a simulated driving device; and constructing a behavior pattern migration feature set. And calculating a behavior pattern migration index based on the compensatory behavior characteristics in the characteristic set, and accurately identifying the progressive transformation process of the patient from the compensatory behavior to the normal behavior. Further constructing a rehabilitation capability dynamic evaluation model, generating a real-time rehabilitation capability score, dynamically adjusting the complexity of a simulated driving scene, collecting adaptive behavior data, constructing a behavior mode migration trend curve and a rehabilitation effect prediction model, and realizing closed-loop optimization of a personalized training scheme. According to the method, subjectivity and static limitation of traditional rehabilitation evaluation are broken through, and the accuracy and effectiveness of neural rehabilitation are remarkably improved.

The invention provides a personal health abnormal behavior monitoring system fused with unsupervised learning, and relates to the technical field of data processing, and the system is used for carrying out the clustering processing of historical behavior data, dividing the historical behavior data into a plurality of behavior tags, extracting the feature vector of each behavior tag, building an individual behavior physical model according to the feature vector, and carrying out the analysis of the individual behavior physical model. Inputting the target feature data into the individual behavior physical model, calculating the deviation degree of the recent behavior of the user, monitoring and recording the deviation degree to obtain an observation label group, judging whether the observation label group meets the absorption condition of the individual behavior physical model or not, if not, judging that the behavior label is an abnormal behavior, and if not, judging that the behavior label is an abnormal behavior. And according to the deviation degree and the duration of the abnormal behavior, calculating a behavior inhibition factor, and according to the behavior inhibition factor, dynamically adjusting the individual behavior physical model to limit the abnormal behavior from being identified as a normal behavior. According to the invention, the system can be prevented from mistakenly considering periodic abnormal behaviors as normal behaviors.

The invention provides a personnel abnormal behavior detection and alarm system based on a real-time video, and relates to the technical field of behavior detection, and the system comprises a data collection module which is used for capturing a video image of a target monitoring area in real time, and carrying out the video processing, and obtaining first video data; the model training module is used for acquiring historical video data of a target monitoring area and identifying and extracting key features of target personnel so as to perform behavior modeling to obtain a first normal behavior model and a first abnormal behavior model; the behavior detection module is used for comparing current video frame data in the first video data with a first normal behavior model, and if an abnormal behavior exists, determining a first behavior detection result based on the current video frame data; and the alarm processing module is used for comprehensively determining alarm information of the target monitoring area according to the first behavior detection result and the monitoring area information, and carrying out abnormal behavior alarm. The behavior model can be adjusted in real time, and the monitoring flexibility and the behavior detection accuracy are improved.

The invention discloses a monitoring analysis method and system based on big data, and relates to the technical field of monitoring data analysis, and the method comprises the following steps: S1, collecting multi-source behavior perception data in real time, carrying out the data preprocessing, and constructing a fusion data flow structure; s2, constructing a time sequence video analysis model, outputting an atomic behavior tag sequence, extracting key micro-feature indexes, and performing judgment and evaluation on individual behavior offset; s3, on the basis of the atomic behavior tag sequence, constructing a behavior sequence diagram, performing behavior chain matching and evolution evaluation, and taking exception supervision measures; s4, comprehensive risks are evaluated through the multi-source behavior perception data, and graded early warning is carried out; s5, manual auditing and event label feedback are carried out, abnormal behaviors are judged, and whether the behaviors deviate from a normal mode or not is analyzed; the problem that in dense areas such as shopping mall corridors and escalators, some theft preparation behaviors do not have the violent characteristic, are submerged by normal behaviors and cannot be captured is solved.

The invention relates to a zero-trust abnormal behavior detection method and device, computer equipment, a readable storage medium and a program product. Respectively processing the to-be-detected behavior log and the normal behavior log through a preset feature extraction model to obtain a to-be-detected behavior feature vector and a normal behavior feature vector, and then inputting the to-be-detected behavior feature vector and the normal behavior feature vector into a preset detection model, obtaining a prediction similarity between the to-be-detected behavior log and the normal behavior log; whether the to-be-detected behavior log is an abnormal behavior or not can be judged by comparing the obtained predicted similarity with a preset similarity threshold value. Therefore, on the basis of the zero-trust abnormal behavior detection method, continuous risk assessment can be carried out on the real-time access behavior of the zero-trust user and / or equipment, and the detection accuracy of the abnormal behavior is improved.

The invention provides a behavior chain analysis and abnormal association detection method, which comprises the following steps: collecting program operation behavior data, and constructing a behavior chain graph model, each node representing one operation, and each edge representing the sequence or relationship between the operations; calculating the correlation degree of each node by using the modeling information, and comparing the calculated node correlation degree with a baseline model of a normal behavior chain to judge whether abnormity exists or not; extracting features from the detected abnormal behavior chain, including degrees of abnormal nodes and weights of abnormal edges, and training a malicious behavior detection model by using the extracted features as input data; and the malicious behavior detection model learns the relationship between the extracted features and malicious behaviors, and identifies and classifies the input new behavior chain to judge whether the behavior chain is abnormal or malicious. According to the method, the false positive rate and the false negative rate can be effectively reduced, the processing speed is high, and the problems caused by program malicious behaviors in related technologies are solved.

This application provides a method and system for detecting and protecting software supply chain risks. Among them, third-party components are obtained from the software supply chain, and their multi-level dynamic behaviors are analyzed; the Bayesian network algorithm is used to predict risk behavior patterns and construct a behavior pattern library; the behaviors during the runtime of third-party components are monitored, and the behavior data stream is recorded; the time series anomaly detection algorithm of deep learning is applied to identify abnormal behaviors that deviate from the normal behavior pattern; the graph neural network is used to evaluate the risk level of abnormal behaviors, and combined with the relevance and propagation path between behaviors, an abnormal behavior list is generated; according to the list, through the adaptive policy selection algorithm, the response policies in the security control measure library are dynamically adjusted to formulate security control measures for third-party components. This application improves the ability to identify and predict potential risk behaviors.

A computer implemented method for detecting anomalous behaviour within a system is provided. The method generates an autoencoder for detecting anomalous behaviour within the system. The method also generates a classifier for predicting a classification of behaviour within the system. An input to the classifier comprises an output from one or more internal layers of the autoencoder. The method jointly trains the autoencoder and the classifier using a set of training data comprising a plurality of sample inputs that represent normal behaviour within the system and a plurality of sample inputs that represent anomalous behaviour within the system. The training is based on an output from a joint loss function that is configured to combine any reconstruction loss from the autoencoder with any prediction error from the classifier. The joint loss function is further configured to negate any reconstruction loss of the autoencoder in response to the sample input representing anomalous behaviour within the system. The trained autoencoder is used to classify a behaviour of the system as being normal or anomalous.

A system and method for cloud native virtual machine (VM) runtime protection. The method includes creating a normal behavior model for a cloud native VM by training a machine learning model using a training data set including training activities performed by the cloud native VM, the cloud native VM being configured to provide at least one service, wherein the normal behavior model defines at least one capability of each service based on a set of capabilities for respective known services stored within a library of service-to-capability mappings, wherein each capability of a service indicates a plurality of discrete behaviors required by the service; and monitoring an execution of the cloud native VM to detect a deviation from the normal behavior model, wherein the deviation is caused by at least one abnormal behavior of one of the services that is not among the discrete behaviors defined in capabilities for the service.

A method of behavior monitoring includes determining, by one or more trained behavior models associated with a monitored asset, output data indicative of operation of the monitored asset. The method also includes determining a risk score based on the output data and determining feature importance data based on the output data. The method further includes determining whether to generate an alert based on the risk score and the feature importance data.

Systems and methods are provided for learning normal behavior for user roles of an application running within a cluster of container orchestration platform and based thereon proactively taking action responsive to suspicious events. According to one embodiment, an event data stream is created by an API server of the cluster. The data for each event includes information regarding a request made to an API exposed by the API server with which the event is associated and a user of the application by which the event was initiated. The data is augmented with a role associated with the user and an anomaly threshold for the role. Normal behavior is learned by an ML algorithm of respective user roles by processing the augmented data. When an anomaly score associated with a particular event is output by the ML algorithm that exceeds the anomaly threshold, a predefined or configurable action may be triggered.

The present disclosure provides a construction method of a behavior baseline library, a security inspection method, an apparatus and a medium, wherein the construction method of the behavior baseline library includes: testing the application system in the application testing phase to obtain test results; analyzing the current normal behavior and attack behavior of the application system based on the test results to obtain a first behavior analysis result; and constructing the behavior baseline library based on the behavior analysis result. The present disclosure begins to analyze the normal behavior and attack behavior of the application and construct the behavior baseline library in the application testing phase, which promotes the left shift of the behavior baseline library construction and saves the time for behavior monitoring and application behavior baseline learning after the application system goes online. It can at least effectively solve the current problem of delay lag in the face of attacks caused by security inspection by monitoring the behavior of the application after the application system goes online, and effectively defends against attack behaviors, thereby improving the security of the system.

The invention discloses a user behavior analysis method and system.The method comprises the steps that on the basis of normal behavior data of a user, frequent item sets and rare item sets of normal behaviors are mined from mass unlabeled behavior data, and an accurate basis is provided for data classification; a rare item set is used as a standard to divide majority class and minority class data sets, and minority class data is anchored based on rare features, so that the processing accuracy is improved; performing N times of conversion on the majority class data set based on the rare item set, classifying the converted data into a minority class data set, dynamically balancing the two classes of data, and improving the sensitivity of the model to a minority class normal behavior mode; and constructing a user behavior graph and a graph neural network learning model based on the balanced training data, carrying out structured representation on a user complex behavior pattern, inputting graph neural network learning to obtain a graph structure, nodes and edge features of a normal behavior pattern, inputting actual user behavior data into the trained model, and outputting an accurate user behavior analysis result.

This application relates to a behavior detection method, apparatus, computer device, computer-readable storage medium, and computer program product. The method includes: acquiring client behavior, a key feature detection set, and a full feature detection set; the key feature detection set is obtained by extracting and summarizing from the full feature detection set; detecting client behavior based on the key feature detection set; if the client behavior does not contain any key features from the key feature detection set, the client behavior is determined to be normal behavior; if the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior based on each full feature detection set; if the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior. This method can improve the efficiency of client behavior detection.

The application relates to the technical field of industrial control safety, in particular to a PLC runtime abnormal behavior identification method and system based on a behavior model, which comprises the following steps: S1, in the PLC program running process, a behavior monitoring module performs real-time monitoring and preliminarily judges abnormal behavior; S2, normal behavior and abnormal behavior are filtered out respectively according to the monitoring results of the behavior monitoring module, and behavior rule extraction is performed on the behavior monitoring module; and S3, behavior modeling is performed based on the extracted behavior rules, normal behavior model generation or update of behavior rule information files is performed on the detected normal behavior, and abnormal behavior model learning of abnormal characteristics, rapid abnormal identification and measure processing are performed on the detected abnormal behavior. The application uses a data model to describe the normal behavior model of the control behavior and the process behavior through the dependent relationship of the normal input and output data of the control and controlled process, so that the intrusion behavior can be accurately identified, and active defense can be performed.

The application discloses a railway ticket intelligent safety monitoring and early warning system and belongs to the technical field of safety monitoring. Through the combination of MSET and SPRT, complex and changeable normal behavior patterns in a ticket network can be effectively captured, and abnormal behaviors can be quickly identified through accurate statistical inference. Compared with a traditional fixed threshold detection method, the accuracy of abnormal detection is greatly improved, and the false negative rate and the false positive rate are reduced, thereby providing strong support for timely discovery and treatment of safety hazards. In combination with a multilayer and multimodal safety monitoring and early warning mechanism, the system can comprehensively, timely and accurately monitor safety threats in a ticket operation environment, timely discovers and early warns potential risks, and makes real-time defense according to the early warning, so that the safety accident rate is effectively reduced.

The invention relates to the technical field of network security, in particular to a network security information protection method based on AI learning, and the method comprises the steps: collecting historical user behavior data of different departments, the user behavior data comprising daily data and authorization data; based on the historical daily data and authorization data, outputting a clustering result through a daily normal behavior model and an authorization normal behavior model; collecting existing user behavior data, comparing the existing user behavior data with the clustering result, and judging that an abnormal behavior exists if the existing user behavior data is not matched with the clustering result; grading the abnormal behaviors, and making corresponding restrictions according to different grades; therefore, the currently collected user data is respectively compared with the daily normal behavior model and the authorized normal behavior model, so that whether the user has the abnormal behavior threatening the network information security or not is accurately judged, the authorized behavior and the daily behavior do not need to use the same monitoring mode, and the monitoring efficiency is greatly improved.

The invention discloses an abnormal user analysis system based on big data, and relates to the technical field of big data, and the technical scheme is characterized in that the system comprises a division module which is used for obtaining behavior characteristic data of game platform users, and performing category division on the game platform users according to the abnormal degree of the behavior characteristic data to obtain a user category division result set; collecting behavior data of a second type of users in the user type division result set according to different monitoring dimensions to obtain a first behavior data set, a second behavior data set and a third behavior data set; extracting abnormal deviation degrees between the user behaviors of the second type of users in different monitoring dimensions and the normal behaviors to obtain a first risk data set, a second risk data set and a third risk data set respectively; the method has the effect that fairness and normal order of the game are guaranteed by effectively identifying and processing the abnormal users.

A method for automatically scoring primate actions based on a behavioral interaction network includes the following steps: Step 1, acquiring primate video images, scoring and labeling them; the primate video images include normal behavior, post-medication behavior, and sham surgery behavior; Step 2, extracting monkey features from the primate video images using a neural network; training the neural network three times using the monkey features: the first training input is monkey features for normal behavior, the second training input is monkey features for sham surgery behavior, and the third training input is monkey features for post-medication behavior; finally, outputting the primate action score through a GAP layer and a fully connected layer.

Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.

The invention relates to the technical field of construction site safety, and discloses a GAN-based construction site personnel unsafe behavior detection method and system, and the method comprises the following steps: 1, carrying out the literature analysis and summarization, and selecting an application scene with representative personnel unsafe behaviors; 2, collecting and constructing a construction site personnel behavior video data set containing normal and unsafe behaviors; 3, designing a generative adversarial network model framework of unsupervised learning; 4, training the proposed model on the self-built data set, evaluating the performance of the model, and comparing the model with a baseline model; 5, eliminating each pseudo-anomaly generation module through an ablation experiment, and evaluating the contribution of each pseudo-anomaly generation module to the model performance; the method is executed in the system. According to the invention, intelligent detection of unsafe behaviors of workers can be realized by using normal behavior data training, and safety management is carried out by using an informatization technology, so that the safety production level is improved.

The invention relates to the technical field of intelligent nursing, solves the problem that abnormal behaviors of old people cannot be accurately predicted and identified in the prior art, and provides an old people behavior monitoring method and device based on rule mining, equipment and a medium. The method comprises the following steps: according to historical video stream data, acquiring behavior characteristic data of a target old person in different time periods; mining the action feature data in different time periods according to a time sequence matching algorithm, and obtaining a behavior pattern of the target old person and corresponding behavior rule data; establishing a normal behavior pattern library according to the behavior pattern and the corresponding behavior rule data; according to real-time video stream data and the normal behavior pattern library, judging whether the target old person has an abnormal behavior or not; and when the abnormal behavior exists, giving an alarm according to the abnormal behavior. The method can improve the comprehensive behavior analysis capability, thereby improving the accuracy and stability of abnormal behavior recognition.

This invention discloses an abnormal user analysis system based on big data, belonging to the field of big data technology. Its key technical solution includes a segmentation module: acquiring behavioral characteristic data of game platform users; classifying game platform users according to the degree of abnormality in the behavioral characteristic data to obtain a user category segmentation result set; collecting behavioral data from the second category of users in the user category segmentation result set according to different monitoring dimensions to obtain a first behavior dataset, a second behavior dataset, and a third behavior dataset; extracting the abnormal deviation between the user behavior and normal behavior of the second category of users under different monitoring dimensions to obtain a first risk dataset, a second risk dataset, and a third risk dataset, respectively; the effect is that by effectively identifying and handling abnormal users, the fairness and normal order of the game are ensured.

An object of a system according to an embodiment is to analyze behavior history data, detect an abnormal behavior, and notify the abnormal behavior.SOLUTION: A system includes a collection unit, an analysis unit, and a notification unit. The collection unit collects action history data. The analysis unit analyzes the data collected by the collection unit and compares the data with a normal behavior pattern to detect an abnormal behavior. The notification unit notifies the abnormal behavior detected by the analysis unit.SELECTED DRAWING: Figure 1

Systems and methods are provided for learning normal behavior for user roles of an application running within a cluster of container orchestration platform and based thereon proactively taking action responsive to suspicious events. According to one embodiment, an event data stream is created by an API server of the cluster. The data for each event includes information regarding a request made to an API exposed by the API server with which the event is associated and a user of the application by which the event was initiated. The data is augmented with a role associated with the user and an anomaly threshold for the role. Normal behavior is learned by an ML algorithm of respective user roles by processing the augmented data. When an anomaly score associated with a particular event is output by the ML algorithm that exceeds the anomaly threshold, a predefined or configurable action is triggered.

The system comprises a prediction module (1) equipped with artificial intelligence to predict neurological disorders in an individual patient and identify a level of neurological disorders; a central processing unit (2) to detect triggering events and circumstances due to which the neurological disorders trigger in an individual patient upon receiving real-time behavior information data generated by a playing ball (3) of an individual patient and distinguish between a normal behavior and a neurological disorders behavior; an alert module (4) to alert the individual patient upon determining neurological disorders behavior; and an entertainment platform (5) to entertain and engage the individual patient with a specific set of activities assigned according to detected triggering events and circumstances upon determining the neurological disorders behavior, wherein a specific set of activities includes listening to music, playing games, and talking to an AI chatbot.

The invention relates to the technical field of accurate checking of grid-connected monitoring data, in particular to an API access behavior intelligent identification method, system and device and a medium. Performing statistical learning and mode induction on the cleaned API historical behavior data according to the service function and the use purpose of the API, and constructing a normal behavior model with a dynamic updating capability; performing similarity calculation on the real-time API calling data and the normal behavior model, and evaluating whether the real-time API calling data deviates from the expected behavior model or not; on the basis of similarity calculation based on statistical rules, a recurrent neural network is introduced to model a sequence behavior, so that the recognition capability of a time sequence abnormal mode is enhanced. Automatic and intelligent API access behavior recognition is achieved, the dynamic adaptive capacity of a recognition system is improved, service changes and new access modes can be quickly responded, meanwhile, the accuracy of abnormal access behavior recognition is greatly improved, and the false alarm rate and the missing report rate are effectively reduced.

Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.

The invention belongs to the technical field of intelligent Internet of Things, and particularly discloses an indoor behavior analysis and safety monitoring method and system based on multi-source perception, which can realize accurate identification and monitoring of specific daily behaviors of a user through multi-source data fusion and habit portrait matching, effectively distinguish normal behaviors from abnormal conditions, and greatly reduce the monitoring false alarm rate; the subentry early warning rule and the weighted statistical rule are combined, so that the monitoring early warning has a clear basis, and the credibility and the disposal efficiency of the early warning are improved; only non-sensitive water, electricity, gas and heat data are analyzed, privacy information such as human faces, videos and biological characteristics is not involved, and in combination with hierarchical authority management, user privacy is protected to the maximum extent while safety is guaranteed; the user does not need to wear any equipment, the existing indoor layout does not need to be changed, and all-weather non-inductive safety monitoring on the user can be realized; and the monitoring pressure of a monitoring party can be effectively reduced while the direct and indirect monitoring cost is reduced.