User abnormal behavior detection method and system

Abstract

The invention provides a user abnormal behavior detection method and system, and the method comprises the steps: obtaining historical transaction data, carrying out the training through a Markov modeland a probability suffix tree model according to the historical transaction data, and obtaining a Markov transition probability matrix and a probability suffix tree transition probability matrix; combining the Markov transition probability matrix and the probability suffix tree transition probability matrix through a linear weighted fusion method to obtain a fraud early warning transition probability matrix, and obtaining a fraud transaction early warning model according to the fraud early warning transition probability matrix; identifying the historical transaction data through a preset critical value and the fraud transaction early warning model, and adjusting the preset critical value according to an identification result to obtain a final critical value; and identifying to-be-detectedtransaction data according to the final critical value and the fraud transaction early warning model to obtain a detection result.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method and system for detecting abnormal user behavior. Background technique [0002] Abnormal user behavior refers to hackers maliciously detecting Internet applications and services, looking for ways to attack, and directly obtaining benefits. [0003] At present, malicious detection behavior identification for attackers has become a common pain point in the industry, and there is no mature solution. The existing network security protection methods and business risk control methods in the industry are difficult to detect. Discovering this kind of malicious detection behavior mainly faces the following two difficulties: [0004] 1. Since the information submitted during the detection process does not contain unreasonable content, and the transaction frequency has no obvious abnormal characteristics, the network protection rules will not be triggered; the detection process ...

AI Technical Summary

Problems solved by technology

If expert rules are set based on known risk events, they can be effectively identified in a short period of time, but when the attack method changes, the rules cannot be adaptively adjusted, and the accuracy will decrease, resulting in the inability to perceive unknown malicious behaviors in advance

Images