CN107517203B - User behavior baseline establishing method and device - Google Patents

Abstract

Embodiments of the present invention disclose a method and device for establishing a user behavior baseline, wherein the method includes: acquiring a user behavior log sample set; based on the user behavior log sample set, according to a time axis, taking the session set as a minimum time statistical unit, establishing User behavior baselines of session sets of users and user groups; based on the session set user behavior baselines of users and user groups, and according to the time axis, establish user behavior baselines of users and user groups with preset time periods as time units. By using the embodiment of the present invention, the session set can be compared with the session set, and the preset time period can be compared with the preset time period. Compared with the prior art where a session or a single log is used as the minimum time statistical unit, the comparison can be made. It is easy to find abnormal user behavior reasonably and improve the recognition probability of abnormal user behavior.

Description

A method and device for establishing a user behavior baseline

technical field

Embodiments of the present invention relate to the technical field of network security, and in particular, to a method and device for establishing a user behavior baseline.

Background technique

The rapid development of computer networks and mobile Internet applications has brought great convenience to social work and life, but the threats and losses caused by various network security issues are also increasing. Moreover, with the rapid development of network application technology, the network behaviors of users are becoming more and more diverse. It is more important to identify the behaviors of network users, find abnormal behavior events, and ensure network security.

At present, whether the user behavior is abnormal is generally determined by analyzing the user behavior log.

In view of this, how to analyze the user behavior log to improve the identification probability of abnormal user behavior has become a technical problem that needs to be solved at present.

SUMMARY OF THE INVENTION

Due to the above-mentioned problems in the existing methods, the embodiments of the present invention provide a method and apparatus for establishing a user behavior baseline.

In a first aspect, an embodiment of the present invention provides a method for establishing a user behavior baseline, including:

Obtain a collection of user behavior log samples;

Based on the user behavior log sample set, according to the time axis, with the session set as the minimum time statistical unit, establish the session set user behavior baseline of the user and the user group;

Based on the session set user behavior baseline of the user and the user group, and according to the time axis, a user behavior baseline of the user and the user group with a preset time period as a time unit is established.

Optionally, based on the user behavior log sample set, according to the time axis, with the session set as the minimum time statistical unit, establish the session set user behavior baseline of the user and the user group, including:

Based on the user behavior log sample set, according to the time axis, with the session set as the minimum time statistical unit, by acquiring the user behavior information of each user and each user group in a session set, a session set of users and user groups is established. User behavior baseline.

Optionally, the user behavior information in a session set includes: the number of actions of various types in a session set, the amount of data downloaded or uploaded, the frequency of access and the length of time.

Optionally, the preset time period includes: daily, weekly, monthly and quarterly;

Correspondingly, the user behavior baseline of the session set based on the user and the user group, according to the time axis, establishes the user behavior baseline of the user and the user group with a preset time period as the time unit, including:

Based on the session set user behavior baselines of the users and user groups, according to the time axis, with days as the time unit, by acquiring the daily user behavior information of each user and each user group, establish the daily user behavior baseline of the user and the user group ;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, weekly user behavior information of each user and each user group is obtained by obtaining weekly user behavior information of each user and each user group according to the time axis. behavioral baseline;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, the monthly user behavior information of each user and each user group is obtained by obtaining the monthly user behavior information of each user and each user group according to the time axis. behavioral baseline;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, with the quarter as the time unit, by acquiring the user behavior information of each user and each user group in each quarter, establish the quarterly users of the user and the user group. behavioral baseline.

Optionally, the daily user behavior information includes: the number of sessions per day, the number of actions of various types, the size of the data volume, the session set time period of the visit, the overall access time, the source IP address and the source physical address;

The weekly user behavior information includes: the number of sessions per week, the number of actions of various types, the size of the data volume, the time period of the session set accessed, the overall access time, the source IP address, the source physical address, and the number of sessions accessed this week. days;

The monthly user behavior information includes: the number of sessions per month, the number of actions of various types, the size of the data volume, the time period of the session set accessed, the overall access time, the source IP address, the source physical address, and the number of sessions accessed this month. days;

The quarterly user behavior information includes: the number of sessions per quarter, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address, source physical days.

Optionally, the division of the session set is based on the user behavior log sample set to determine whether the time interval between two adjacent operations is less than or equal to the timeout interval of the session set; if so, then the two adjacent operations are divided. Divide into the same session set, otherwise, divide the two adjacent operations into different session sets.

Optionally, the timeout interval of the session set is obtained by aggregation based on the user behavior log sample set, learning the length of the user's operation interval;

or,

The timeout interval of the session set is preset according to the actual situation.

In a second aspect, an embodiment of the present invention further provides an apparatus for establishing a user behavior baseline, including:

The acquisition module is used to acquire a collection of user behavior log samples;

a first establishment module, configured to establish a session set user behavior baseline of a user and a user group based on the user behavior log sample set, according to the time axis, and taking the session set as the minimum time statistical unit;

The second establishment module is configured to establish a user behavior baseline of the user and the user group with a preset time period as a time unit according to the time axis based on the session set user behavior baseline of the user and the user group.

Optionally, the first establishment module is specifically used for

Based on the user behavior log sample set, according to the time axis, with the session set as the minimum time statistical unit, by acquiring the user behavior information of each user and each user group in a session set, a session set of users and user groups is established. User behavior baseline.

Optionally, the user behavior information in a session set includes: the number of actions of various types in a session set, the amount of data downloaded or uploaded, the frequency of access and the length of time.

Optionally, the preset time period includes: daily, weekly, monthly and quarterly;

Correspondingly, the second establishment module is specifically used for

Based on the session set user behavior baselines of the users and user groups, according to the time axis, with days as the time unit, by acquiring the daily user behavior information of each user and each user group, establish the daily user behavior baseline of the user and the user group ;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, weekly user behavior information of each user and each user group is obtained by obtaining weekly user behavior information of each user and each user group according to the time axis. behavioral baseline;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, the monthly user behavior information of each user and each user group is obtained by obtaining the monthly user behavior information of each user and each user group according to the time axis. behavioral baseline;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, with the quarter as the time unit, by acquiring the user behavior information of each user and each user group in each quarter, establish the quarterly users of the user and the user group. behavioral baseline.

Optionally, the daily user behavior information includes: the number of sessions per day, the number of actions of various types, the size of the data volume, the session set time period of the visit, the overall access time, the source IP address and the source physical address;

The weekly user behavior information includes: the number of sessions per week, the number of actions of various types, the size of the data volume, the time period of the session set accessed, the overall access time, the source IP address, the source physical address, and the number of sessions accessed this week. days;

The monthly user behavior information includes: the number of sessions per month, the number of actions of various types, the size of the data volume, the time period of the session set accessed, the overall access time, the source IP address, the source physical address, and the number of sessions accessed this month. days;

The quarterly user behavior information includes: the number of sessions per quarter, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address, source physical days.

Optionally, the division of the session set is based on the user behavior log sample set to determine whether the time interval between two adjacent operations is less than or equal to the timeout interval of the session set; if so, then the two adjacent operations are divided. Divide into the same session set, otherwise, divide the two adjacent operations into different session sets.

Optionally, the timeout interval of the session set is obtained by aggregation based on the user behavior log sample set, learning the length of the user's operation interval;

or,

The timeout interval of the session set is preset according to the actual situation.

In a third aspect, an embodiment of the present invention further provides an electronic device, including: a processor, a memory, a bus, and a computer program stored in the memory and running on the processor;

Wherein, the processor and the memory communicate with each other through the bus;

The above method is implemented when the processor executes the computer program.

In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium, where a computer program is stored on the non-transitory computer-readable storage medium, and the computer program implements the foregoing method when executed by a processor.

It can be known from the above technical solutions that in the embodiment of the present invention, by acquiring a user behavior log sample set, based on the user behavior log sample set, according to the time axis, and taking the session set as the minimum time statistical unit, the session set user behavior of the user and the user group is established. Baseline, based on the user behavior baseline of the session set of the user and the user group, and according to the time axis, establish the user behavior baseline of the user and the user group with the preset time period as the time unit. For comparison, the preset time period is compared with the preset time period. Compared with the prior art where a session or a single log is used as the minimum time statistical unit, it is easier to reasonably find abnormal user behaviors and improve the identification probability of abnormal user behaviors. .

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without creative efforts.

1 is a schematic flowchart of a method for establishing a user behavior baseline according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of an apparatus for establishing a user behavior baseline according to an embodiment of the present invention;

FIG. 3 is a logical block diagram of an electronic device according to an embodiment of the present invention.

Detailed ways

The specific embodiments of the present invention will be further described below with reference to the accompanying drawings. The following examples are only used to illustrate the technical solutions of the present invention more clearly, and cannot be used to limit the protection scope of the present invention.

FIG. 1 shows a schematic flowchart of a method for establishing a user behavior baseline provided by an embodiment of the present invention. As shown in FIG. 1 , the method for establishing a user behavior baseline in this embodiment includes:

S101. Obtain a set of user behavior log samples.

It can be understood that the set of user behavior log samples may include multiple user behavior log samples.

S102. Based on the user behavior log sample set, and according to the time axis, with the session set as the minimum time statistical unit (ie, the minimum analysis unit), establish a session set user behavior baseline of the user and the user group.

In a specific application, the division of the session set may be based on the user behavior log sample set to determine whether the time interval between two adjacent operations is less than or equal to the timeout interval of the session set; if the time interval between two adjacent operations is less than or equal to equal to the timeout interval of the session set, then divide the two adjacent operations into the same session set. If the time interval between the two adjacent operations is greater than the timeout interval of the session set, divide the two adjacent operations into the same session set. into a different session set.

It is understandable that when a user actually accesses the cloud or intranet, it is mainly for a period of time. Even if the current access exits, the next access is very close to the current one, for example, the difference is 5 minutes (less than the timeout of the session set). time interval), the two visits are still considered as a session set, that is, in one analysis unit, rather than as two separate sessions to be analyzed.

In a specific application, a machine learning algorithm can be used for the timeout interval of the session set, that is, based on the user behavior log sample set, the length of the user's operation interval is learned, and a smaller aggregation interval is obtained through aggregation as the session set the timeout interval;

or,

The timeout interval of the session set can also be preset according to the actual situation. For example, the timeout interval of the session set can be set according to a specific cloud service. For example, the timeout interval of the session set can be set. for 1 hour.

S103. Based on the session set user behavior baseline of the user and the user group, and according to the time axis, establish a user behavior baseline of the user and the user group with a preset time period as a time unit.

The preset time period may include: every day, every week, every month, every quarter, etc., which are not limited in this embodiment, and may also be other preset time periods according to actual conditions, such as every year.

It is understandable that in actual situations, many of the obtained user behavior logs may not have log-in and log-out logs, so it is not realistic to establish a user behavior baseline based on an existing single session. Therefore, in this embodiment, to analyze the behavior of a person or entity, it is to look at the operations he concentrated in a certain period of time, rather than simply using the session login and logout to distinguish. For example, a malicious user logs in to the cloud service at 2:00 in the morning and drags and drops data, and exits the cloud service at 2:30. If you log in to the cloud service again at 2:35 and log out at 3:00, this embodiment analyzes the session set in the time period from 2:00 to 3:00 as a unit, instead of using 2:00 to 2:30, 2:00 35 to 3:00 to analyze. This can better reflect the actions of the user in one operation, and the connection between the previous and previous operations will not be separated due to an exit in the middle.

The method for establishing a user behavior baseline in this embodiment can be implemented by a processor. By acquiring a user behavior log sample set, based on the user behavior log sample set, according to the time axis, with the session set as the minimum time statistical unit, users and users are established. The user behavior baseline of the session set of the group, based on the user behavior baseline of the session set of the user and the user group, and according to the time axis, establish the user behavior baseline of the user and the user group with the preset time period as the time unit. The session set is compared with the session set, and the preset time period is compared with the preset time period. Compared with the prior art where a session or a single log is used as the minimum time statistical unit, it is easier to find abnormal user behaviors later. It is more practical to improve the recognition probability of abnormal user behavior.

Further, on the basis of the foregoing method embodiments, step S102 in this embodiment may include:

Based on the user behavior log sample set, according to the time axis, with the session set as the minimum time statistical unit, by acquiring the user behavior information of each user and each user group in a session set, a session set of users and user groups is established. User behavior baseline.

Wherein, the user behavior information in a session set may include: the number of actions of various types in a session set (that is, the number of operations of various types), the amount of data downloaded or uploaded, the frequency of access and the length of time, etc. The embodiment does not limit it, and may also include other user behavior information of each other user and each user group in a session set according to the actual situation.

In this embodiment, by using the session set as the minimum time statistical unit, compared with the prior art where one session or a single log is used as the minimum time statistical unit, it is easier to find abnormal user behaviors in the follow-up and improve the identification probability of abnormal user behaviors. more practical.

Further, on the basis of the above method embodiments, the preset time period in this embodiment includes: every day, every week, every month and every quarter, correspondingly, the step S103 may include steps not shown in the figure. Steps A1-A4:

A1. Based on the user behavior baseline of the session set of the user and the user group, according to the time axis, taking days as the time unit, by acquiring the user behavior information of each user and each user group every day, establish the daily user of the user and the user group. behavioral baseline.

The daily user behavior information may include: the number of sessions per day, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, and the source IP (a protocol for interconnection between networks) The address and source physical address, etc., are not limited in this embodiment, and may also include other user behavior information of each other user and each user group every day according to the actual situation.

A2. Based on the user behavior baseline of the session set of the user and user group, according to the time axis, with weekly as the time unit, by acquiring the weekly user behavior information of each user and each user group, establish the user behavior information of each user and each user group. Weekly user behavior baseline.

The weekly user behavior information may include: the number of sessions per week, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address, the source physical address and the local The number of days of weekly access, etc., is not limited in this embodiment, and other weekly user behavior information of each other user and each user group may also be included according to the actual situation.

A3. Based on the user behavior baseline of the session set of the user and user group, according to the time axis, with the month as the time unit, by acquiring the monthly user behavior information of each user and each user group, establish the user behavior information of each user and each user group. Monthly user behavior baseline.

The monthly user behavior information may include: the number of sessions per month, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address, the source physical address and the local The number of days of monthly access, etc., is not limited in this embodiment, and other monthly user behavior information of each other user and each user group may also be included according to the actual situation.

A4. Based on the user behavior baseline of the session set of the user and user group, according to the time axis, with the quarter as the time unit, by obtaining the user behavior information of each user and each user group in each quarter, establish each user and user group. Quarterly user behavior baseline.

The quarterly user behavior information may include: the number of sessions per quarter, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address, the source physical address and the local The number of days for quarterly access, etc., is not limited in this embodiment, and other quarterly user behavior information of each other user and each user group may also be included according to the actual situation.

In the method for establishing a user behavior baseline in this embodiment, a session set can be compared with a session set, day with day, month with month, quarter with quarter, etc. Compared with the minimum time statistical unit, the log is easier to reasonably find the abnormal behavior of the user and improve the identification probability of the abnormal behavior of the user, which is more practical.

FIG. 2 shows a schematic structural diagram of an apparatus for establishing a user behavior baseline provided by an embodiment of the present invention. As shown in FIG. 2 , the apparatus for establishing a user behavior baseline in this embodiment includes: an acquisition module 21 and a first establishment module 22 and a second establishment module 23; wherein:

The obtaining module 21 is used to obtain a set of user behavior log samples;

The first establishment module 22 is configured to, based on the user behavior log sample set, and according to the time axis, take the session set as the minimum time statistical unit, and establish the session set user behavior baseline of the user and the user group;

The second establishing module 23 is configured to, based on the session set user behavior baseline of the user and the user group, establish a user behavior baseline of the user and the user group with a preset time period as a time unit according to the time axis.

Specifically, the acquisition module 21 acquires a set of user behavior log samples; the first establishment module 22 establishes a set of user and user groups based on the user behavior log sample set and according to the time axis, with the session set as the minimum time statistical unit. Conversation set user behavior baseline; the second establishing module 23 establishes a user behavior baseline of the user and the user group with a preset time period as a time unit according to the time axis based on the conversation set user behavior baseline of the user and the user group.

The preset time period may include: every day, every week, every month, every quarter, etc., which are not limited in this embodiment, and may also be other preset time periods according to actual conditions, such as every year.

In a specific application, the division of the session set may be based on the user behavior log sample set to determine whether the time interval between two adjacent operations is less than or equal to the timeout interval of the session set; if the time interval between two adjacent operations is less than or equal to equal to the timeout interval of the session set, then divide the two adjacent operations into the same session set. If the time interval between the two adjacent operations is greater than the timeout interval of the session set, divide the two adjacent operations into the same session set. into a different session set.

It is understandable that when a user actually accesses the cloud or intranet, it is mainly for a period of time. Even if the current access exits, the next access is very close to the current one, for example, the difference is 5 minutes (less than the timeout of the session set). time interval), the two visits are still considered as a session set, that is, in one analysis unit, rather than as two separate sessions to be analyzed.

In a specific application, a machine learning method can be used for the timeout interval of the session set, that is, based on the user behavior log sample set, the length of the user's operation interval is learned, and a smaller aggregation interval is obtained through aggregation as the session set the timeout interval;

or,

The timeout interval of the session set may also be preset according to the actual situation. For example, the timeout interval of the session set may be set according to a specific cloud service.

It is understandable that in actual situations, many of the obtained user behavior logs may not have log-in and log-out logs, so it is not realistic to establish a user behavior baseline based on an existing single session. Therefore, in this embodiment, to analyze the behavior of a person or entity, it is to look at the operations he concentrated in a certain period of time, rather than simply using the session login and logout to distinguish. For example, a malicious user logs in to the cloud service at 2:00 in the morning and drags and drops data, and exits the cloud service at 2:30. If you log in to the cloud service again at 2:35 and log out at 3:00, this embodiment analyzes the session set in the time period from 2:00 to 3:00 as a unit, instead of using 2:00 to 2:30, 2:00 35 to 3:00 to analyze. This can better reflect the actions of the user in one operation, and the connection between the previous and previous operations will not be separated due to an exit in the middle.

In the device for establishing a user behavior baseline in this embodiment, the session set can be compared with the session set, and the preset time period can be compared with the preset time period, which is different from the prior art that uses a session or a single log as the minimum time statistical unit. It is easier to find abnormal user behaviors reasonably and improve the recognition probability of abnormal user behaviors, which is more practical.

Further, on the basis of the foregoing method embodiments, the first establishment module 22 in this embodiment may be specifically used for

Based on the user behavior log sample set, according to the time axis, with the session set as the minimum time statistical unit, by acquiring the user behavior information of each user and each user group in a session set, a session set of users and user groups is established. User behavior baseline.

The user behavior information in a session set may include: the number of actions of various types in a session set, the amount of data downloaded or uploaded, the access frequency and time length, etc., which are not limited in this embodiment. , and can also include other user behavior information of each other user and each user group in a session set according to the actual situation.

In this embodiment, by using the session set as the minimum time statistical unit, compared with the prior art where one session or a single log is used as the minimum time statistical unit, it is easier to find abnormal user behaviors in the follow-up and improve the identification probability of abnormal user behaviors. more practical.

Further, on the basis of the above method embodiment, the preset time period in this embodiment includes: every day, every week, every month and every quarter, correspondingly, the second establishment module 23 can be specifically At

Based on the session set user behavior baselines of the users and user groups, according to the time axis, with days as the time unit, by acquiring the daily user behavior information of each user and each user group, establish the daily user behavior baseline of the user and the user group ;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, weekly user behavior information of each user and each user group is obtained by obtaining weekly user behavior information of each user and each user group according to the time axis. behavioral baseline;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, the monthly user behavior information of each user and each user group is obtained by obtaining the monthly user behavior information of each user and each user group according to the time axis. behavioral baseline;

Based on the user behavior baseline of the session set of the user and user group, according to the time axis, with the quarter as the time unit, by acquiring the user behavior information of each user and each user group in each quarter, establish the quarterly users of the user and the user group. behavioral baseline.

The daily user behavior information may include: the number of sessions per day, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address and the source physical address, etc. This implementation The example does not limit it, and can also include other user behavior information of each other user and each user group every day according to the actual situation.

The weekly user behavior information may include: the number of sessions per week, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address, the source physical address and the local The number of days of weekly access, etc., is not limited in this embodiment, and other weekly user behavior information of each other user and each user group may also be included according to the actual situation.

The monthly user behavior information may include: the number of sessions per month, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address, the source physical address and the local The number of days of monthly access, etc., is not limited in this embodiment, and other monthly user behavior information of each other user and each user group may also be included according to the actual situation.

The quarterly user behavior information may include: the number of sessions per quarter, the number of actions of various types, the amount of data, the time period of the session set accessed, the overall access time, the source IP address, the source physical address and the local The number of days for quarterly access, etc., is not limited in this embodiment, and other quarterly user behavior information of each other user and each user group may also be included according to the actual situation.

The user behavior baseline establishment device of this embodiment can subsequently compare session sets with session sets, days with days, months with months, quarters with quarters, etc. Compared with the minimum time statistical unit, the log is easier to reasonably find the abnormal behavior of the user and improve the identification probability of the abnormal behavior of the user, which is more practical.

The apparatus for establishing a user behavior baseline in this embodiment can be used to execute the technical solutions of the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.

FIG. 3 shows a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. As shown in FIG. 3 , the electronic device may include: a processor 11 , a memory 12 , a bus 13 , and storage on the memory 12 and available in the a computer program running on the processor 11;

The processor 11 and the memory 12 communicate with each other through the bus 13;

When the processor 11 executes the computer program, the methods provided by the above method embodiments are implemented, for example, including: acquiring a user behavior log sample set; based on the user behavior log sample set, according to the time axis, taking the session set as the smallest The time statistics unit establishes the user behavior baseline of the session set of the user and the user group; based on the user behavior baseline of the session set of the user and the user group, according to the time axis, establishes the user behavior of the user and the user group with the preset time period as the time unit baseline.

Embodiments of the present invention provide a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the methods provided by the foregoing method embodiments, for example, including: acquiring a user behavior log sample set; based on the user behavior log sample set, according to the time axis, with the session set as the minimum time statistical unit, establish the user behavior baseline of the session set of the user and the user group; based on the user behavior baseline of the session set of the user and the user group, According to the time axis, establish a user behavior baseline of users and user groups with a preset time period as a time unit.

It should be understood by those skilled in the art that the embodiments of the present application may be provided as a method, an apparatus, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus, and computer program products according to embodiments of the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce An apparatus/system for implementing the functions specified in one or more of the flowcharts and/or one or more blocks of the block diagrams.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

It should be noted that, in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. any such actual relationship or sequence exists. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element. The orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the indicated device or element must be It has a specific orientation, is constructed and operates in a specific orientation, and therefore should not be construed as a limitation of the present invention. Unless otherwise expressly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it may be a fixed connection, a detachable connection, or an integral connection; it may be a mechanical connection, It can also be an electrical connection; it can be a direct connection, an indirect connection through an intermediate medium, or an internal connection between two components. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific situations.

In the description of the present invention, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description. Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment in order to simplify the present disclosure and to aid in the understanding of one or more of the various aspects of the invention. , figures, or descriptions thereof. However, this method of disclosure should not be construed to reflect the intention that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention. It should be noted that the embodiments in the present application and the features of the embodiments may be combined with each other in the case of no conflict. The invention is not limited to any single aspect, nor to any single embodiment, nor to any combination and/or permutation of these aspects and/or embodiments. Furthermore, each aspect and/or embodiment of the invention may be used alone or in combination with one or more other aspects and/or embodiments thereof.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some or all of the technical features thereof can be equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the embodiments of the present invention. The scope of the invention should be included in the scope of the claims and description of the present invention.

Claims (8)

1. A user behavior baseline establishing method is characterized by comprising the following steps:

acquiring a user behavior log sample set;

based on the user behavior log sample set, taking a session set as a minimum time statistical unit according to a time axis, and establishing a session set user behavior baseline of users and user groups by acquiring user behavior information of each user and each user group in one session set;

establishing user behavior baselines of the users and the user groups by taking a preset time period as a time unit according to a time axis based on the conversation set user behavior baselines of the users and the user groups;

the division of the session set is based on the user behavior log sample set, and whether the time interval of two adjacent operations is less than or equal to the timeout time interval of the session set is judged; if so, dividing the two adjacent operations into the same session set, otherwise, dividing the two adjacent operations into different session sets; the timeout interval of the session set is obtained by aggregating the operation interval length of the learning user based on the user behavior log sample set; or the timeout interval of the session set is preset according to a specific cloud service; the user behavior information in a session set comprises: the number of various actions within a session set, the size of the data volume downloaded or uploaded, the access frequency and the length of time.

2. The method of claim 1, wherein the preset time period comprises: daily, weekly, monthly, and quarterly;

correspondingly, the establishing of the user behavior baseline of the user and the user group with the preset time period as the time unit according to the time axis based on the conversation set user behavior baseline of the user and the user group comprises:

establishing a daily user behavior baseline of the users and the user groups by acquiring daily user behavior information of each user and each user group according to a time axis and taking days as time units on the basis of the conversation set user behavior baselines of the users and the user groups;

based on the conversation set user behavior baselines of the users and the user groups, establishing weekly user behavior baselines of the users and the user groups by acquiring weekly user behavior information of each user and each user group according to a time axis and taking a week as a time unit;

establishing a monthly user behavior baseline of the users and the user groups by acquiring monthly user behavior information of each user and each user group according to a time axis and by taking months as time units on the basis of the conversation set user behavior baselines of the users and the user groups;

and based on the conversation set user behavior baselines of the users and the user groups, establishing the quarterly user behavior baselines of the users and the user groups by acquiring the quarterly user behavior information of each user and each user group according to a time axis.

3. The method of claim 2, wherein the daily user behavior information comprises: the number of times of each day of session set, the number of times of various actions, the size of data volume, the time period of the accessed session set, the overall access time, the source IP address and the source physical address;

the weekly user behavior information comprises: the number of times of the session set, the number of times of various actions, the data size, the time period of the accessed session set, the overall access time, the source IP address, the source physical address and the number of days of the access in the week;

the monthly user behavior information includes: the number of sessions, the number of actions, the data size, the time period of the accessed sessions, the overall access time, the source IP address, the source physical address and the number of days of access in the month;

the quarterly user behavior information comprises: number of session sets per quarter, number of actions of various types, data size, session set time period of access, overall access time, source IP address, source physical address, and number of days accessed in the quarter.

4. A user behavior baseline establishing apparatus, comprising:

the acquisition module is used for acquiring a user behavior log sample set;

the first establishing module is used for establishing a session set user behavior baseline of the users and the user groups by taking the session set as a minimum time statistical unit according to a time axis and acquiring user behavior information of each user and each user group in one session set based on the user behavior log sample set;

the second establishing module is used for establishing user behavior baselines of the users and the user groups by taking a preset time period as a time unit according to a time axis based on the conversation set user behavior baselines of the users and the user groups;

the division of the session set is based on the user behavior log sample set, and whether the time interval of two adjacent operations is less than or equal to the timeout time interval of the session set is judged; if so, dividing the two adjacent operations into the same session set, otherwise, dividing the two adjacent operations into different session sets; the timeout interval of the session set is obtained by aggregating the operation interval length of the learning user based on the user behavior log sample set; or the timeout interval of the session set is preset according to a specific cloud service; the user behavior information in a session set comprises: the number of various actions within a session set, the size of the data volume downloaded or uploaded, the access frequency and the length of time.

5. The apparatus of claim 4, wherein the preset time period comprises: daily, weekly, monthly, and quarterly;

accordingly, the second establishing module is specifically used for

Establishing a daily user behavior baseline of the users and the user groups by acquiring daily user behavior information of each user and each user group according to a time axis and taking days as time units on the basis of the conversation set user behavior baselines of the users and the user groups;

based on the conversation set user behavior baselines of the users and the user groups, establishing weekly user behavior baselines of the users and the user groups by acquiring weekly user behavior information of each user and each user group according to a time axis and taking a week as a time unit;

establishing a monthly user behavior baseline of the users and the user groups by acquiring monthly user behavior information of each user and each user group according to a time axis and by taking months as time units on the basis of the conversation set user behavior baselines of the users and the user groups;

and based on the conversation set user behavior baselines of the users and the user groups, establishing the quarterly user behavior baselines of the users and the user groups by acquiring the quarterly user behavior information of each user and each user group according to a time axis.

6. The apparatus of claim 5, wherein the daily user behavior information comprises: the number of times of each day of session set, the number of times of various actions, the size of data volume, the time period of the accessed session set, the overall access time, the source IP address and the source physical address;

the weekly user behavior information comprises: the number of times of the session set, the number of times of various actions, the data size, the time period of the accessed session set, the overall access time, the source IP address, the source physical address and the number of days of the access in the week;

the monthly user behavior information includes: the number of sessions, the number of actions, the data size, the time period of the accessed sessions, the overall access time, the source IP address, the source physical address and the number of days of access in the month;

the quarterly user behavior information comprises: number of session sets per quarter, number of actions of various types, data size, session set time period of access, overall access time, source IP address, source physical address, and number of days accessed in the quarter.

7. An electronic device, comprising: a processor, a memory, a bus, and a computer program stored on the memory and executable on the processor;

the processor and the memory complete mutual communication through the bus;

the processor, when executing the computer program, implements the method of any of claims 1-3.

8. A non-transitory computer-readable storage medium, having stored thereon a computer program which, when executed by a processor, implements the method of any one of claims 1-3.

Images