User behavior sequence anomaly detection method, terminal and storage medium

Abstract

The invention provides a user behavior sequence anomaly detection method, a terminal and a storage medium. The method comprises the steps of obtaining user behavior information in a preset time period; aggregating the characteristic attributes according to a sequence; configuring behaviors of the user in a preset time period into row vectors, and then forming a behavior row vector time sequence; extracting behavior row vector time sequences of any two users, calculating correlation coefficients, and judging vector similarity; searching the optimal distance between the behavior row vector timesequences of the two users by adopting a dynamic warping algorithm; calculating a distance average value and a standard deviation among all users; and if the distance between the user and other usersis greater than +3 times of the standard deviation of the average value, judging that the user is an abnormal user. User behavior details can be analyzed, the problems that a feature matrix cannot begenerated and sequence lengths are inconsistent due to the fact that a user does not have continuous behaviors are solved, and the false alarm rate of anomaly detection is reduced. Therefore, abnormalbehaviors hidden in the group can be identified, and the security of data information is ensured.

Description

technical field [0001] The invention relates to the technical field of data processing, in particular to an anomaly detection method based on user behavior sequence similarity, a terminal and a storage medium. Background technique [0002] With the continuous development of science and technology, data information has become an important carrier at present. Data information carries enterprise information, user information, transaction information and communication information. Data information plays a very important role for everyone and every enterprise. [0003] The abnormal problem of data information is a problem that needs to be paid attention to at present. For data anomalies, traffic analysis based on big data mining can dynamically and comprehensively search for malicious behaviors in the intranet. The IPS / IDS in the prior art, that is, the intrusion detection system, is a network security device that monitors network transmissions in real time, and sends an alarm...

AI Technical Summary

Problems solved by technology

[0004] The existing technology also involves NTA, that is, traffic anomaly analysis methods. These two methods are based on rule matching and preset statistical threshold methods, which cannot identify abnormal behaviors hidden in the group, which leads to the security of data information. Can't guarantee

Images