CN115906927A

CN115906927A - Data access analysis method and system based on artificial intelligence and cloud platform

Info

Publication number: CN115906927A
Application number: CN202211508578.9A
Authority: CN
Inventors: 李星; 王高峰
Original assignee: Individual
Current assignee: Beijing Guolian Video Information Technology Co ltd
Priority date: 2022-11-29
Filing date: 2022-11-29
Publication date: 2023-04-04
Anticipated expiration: 2042-11-29
Also published as: CN115906927B

Abstract

According to the data access analysis method, the data access analysis system and the cloud platform based on the artificial intelligence, at least one candidate neural network is screened from a plurality of candidate neural networks for knowledge vector mining of the access behavior detection records through the access behavior detection records and the corresponding behavior element description phrases, and not only can a model cluster be expanded through the candidate neural networks, but also the cross-border early warning analysis quality of the cross-border early warning analysis network is improved; in the actual border crossing early warning analysis, part of candidate neural networks can be screened to realize border crossing early warning analysis on the detection records of the access behaviors, so that excessive operation overhead can be avoided, the processing pressure of an artificial intelligent cloud platform is reduced, and the timeliness and the precision of the border crossing early warning analysis on the access behaviors are improved.

Description

Data access analysis method and system based on artificial intelligence and cloud platform

Technical Field

The invention relates to the technical field of artificial intelligence, in particular to a data access analysis method and system based on artificial intelligence and a cloud platform.

Background

Since the birth of artificial intelligence, theories and technologies become mature day by day, and application fields are expanded continuously, so that science and technology products brought by artificial intelligence in the future can be assumed to be 'containers' of human intelligence. In the network data access process, the application scene of the cross-border early warning analysis based on artificial intelligence is to safely identify the network data access behavior in the cloud service process, namely to perform early warning analysis on the access behavior authority cross-border, so that the safety and stability of the cloud service during operation are guaranteed. Nowadays, the access amount and access behavior involved in cloud services are increased dramatically, which brings about a few challenges to the out-of-range early warning analysis of network data access behavior.

Disclosure of Invention

In order to solve the technical problems in the related art, the invention provides a data access analysis method and system based on artificial intelligence and a cloud platform.

In a first aspect, an embodiment of the present invention provides an artificial intelligence-based data access analysis method, which is applied to an artificial intelligence cloud platform, and the method includes:

obtaining an access behavior detection record to be subjected to border crossing early warning analysis and a behavior element description phrase corresponding to the access behavior detection record;

screening at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster according to the access behavior detection record and the behavior element description phrase to serve as a pre-processing neural network;

and performing decision knowledge mining operation of the access behavior detection records through the pre-processing neural network to obtain behavior out-of-range decision knowledge corresponding to the access behavior detection records.

For an exemplary technical solution, the linkage AI model cluster includes not less than one AI algorithm model, and each AI algorithm model includes a plurality of candidate neural networks;

the screening of at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster as a pre-processing neural network according to the access behavior detection record and the behavior element description phrase comprises the following steps: and aiming at any AI algorithm model, screening at least one candidate neural network from a plurality of candidate neural networks contained in the AI algorithm model as the preprocessing neural network according to the access behavior detection record and the behavior element description phrase.

For an exemplary technical solution, the screening, according to the access behavior detection record and the behavior element description phrase, not less than one candidate neural network from a plurality of candidate neural networks included in the AI algorithm model as a pre-processing neural network includes:

combining the behavior element implicit knowledge and the behavior element description phrases to obtain linkage knowledge phrases, wherein the behavior element implicit knowledge is obtained by knowledge mining of the access behavior detection records;

obtaining a neural network screening instruction according to the linkage knowledge phrase, wherein the neural network screening instruction comprises X screening variables, X is equal to the number of the candidate neural networks to be screened in the AI algorithm model, and the screening variables are used for representing the screened possibility of the candidate neural networks corresponding to the screening variables;

and determining the preprocessing neural network from X candidate neural networks to be screened in the AI algorithm model according to the screening variables in the neural network screening instruction.

For an exemplary technical solution, the determining the pre-processing neural network from X candidate neural networks to be filtered in the AI algorithm model according to the filtering variables in the neural network filtering indication includes: and determining the candidate neural network with the maximum screening possibility as the preprocessing neural network based on screening variables from X candidate neural networks to be screened in the AI algorithm model.

For an exemplary technical solution, the determining the pre-processing neural network from the X candidate neural networks to be filtered in the AI algorithm model according to the filtering variables in the neural network filtering indication includes: and determining a plurality of candidate neural networks with the screened possibility in a set possibility interval as a plurality of preprocessing neural networks based on screening variables from X candidate neural networks to be screened in the AI algorithm model.

For an exemplary technical solution, for any one AI algorithm model, on the basis that the number of the preprocessing neural networks screened from the AI algorithm model is multiple, the performing, by the preprocessing neural networks, a decision knowledge mining operation of the access behavior detection record includes:

loading the behavior element implicit knowledge to the plurality of preprocessing neural networks determined from the AI algorithm model respectively aiming at any one AI algorithm model to obtain preprocessing knowledge vectors generated by each preprocessing neural network respectively; the behavior element implicit knowledge is obtained by knowledge mining of the access behavior detection records;

and carrying out weight-based merging treatment on the preprocessing knowledge vectors generated by the preprocessing neural networks to obtain behavior out-of-range decision knowledge generated by the AI algorithm model.

For one exemplary aspect, the coordinated AI model cluster includes: a first AI algorithm model and a second AI algorithm model, the first AI algorithm model and the second AI algorithm model respectively comprising a plurality of candidate neural networks;

the method for screening at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster as a preprocessing neural network comprises the following steps: for one of the first AI algorithm model and the second AI algorithm model, screening at least one candidate neural network from the plurality of candidate neural networks as a pre-processing neural network;

the mining operation of the decision knowledge of the access behavior detection record through the preprocessing neural network to obtain the behavior out-of-bounds decision knowledge corresponding to the access behavior detection record comprises the following steps: taking decision knowledge generated after the decision knowledge mining operation is performed through the preprocessing neural network in the first AI algorithm model as behavior element implicit knowledge, and loading the behavior element implicit knowledge to the second AI algorithm model; performing the decision knowledge mining operation on the behavior element implicit knowledge through a preprocessing neural network in the second AI algorithm model; and on the basis that the second AI algorithm model is the last AI algorithm model in the linkage AI model cluster, taking the behavior boundary crossing decision knowledge generated by the second AI algorithm model as the behavior boundary crossing decision knowledge corresponding to the access behavior detection record.

For one exemplary aspect, the coordinated AI model cluster includes: a third AI algorithm model; the third AI algorithm model comprises a plurality of candidate neural networks;

the screening of at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster as a preprocessing neural network according to the access behavior detection record and the behavior element description phrase comprises: knowledge vector mining is carried out on the access behavior detection records through a vector mining unit in the linkage AI model cluster, and hidden knowledge of behavior elements is obtained; merging the behavior element implicit knowledge and the behavior element description phrases to obtain linkage knowledge phrases; and determining the preprocessing neural network from the candidate neural networks contained in the third AI algorithm model according to the linkage knowledge phrase.

For one exemplary aspect, the behavioral element descriptive phrase includes at least one of: and the access type, the access time period, the access authority authentication result, the access security evaluation, the access behavior state and the detection signal-to-noise ratio corresponding to the access behavior in the access behavior detection record.

For one exemplary aspect, the method further comprises: and performing border crossing early warning analysis processing according to the behavior border crossing decision knowledge.

For an exemplary technical scheme, performing border crossing early warning analysis processing according to the behavior border crossing decision knowledge is realized through a border crossing early warning analysis network, wherein the border crossing early warning analysis network comprises a linkage AI model cluster, and the linkage AI model cluster comprises a plurality of candidate neural networks; the debugging steps of the cross-border early warning analysis network are as follows:

obtaining an example access behavior detection record, an a priori annotation of the example access behavior detection record, and a behavior element description phrase corresponding to the example access behavior detection record;

loading the example access behavior detection records and behavior element description phrases corresponding to the example access behavior detection records to the out-of-range early warning analysis network;

screening at least one candidate neural network from the plurality of candidate neural networks as a pre-processing neural network by the border crossing early warning analysis network according to the example access behavior detection record and the behavior element description phrase, mining decision knowledge of the example access behavior detection record through the pre-processing neural network to obtain behavior border crossing decision knowledge of the example access behavior detection record, and performing border crossing early warning analysis on the example access behavior detection record according to the behavior border crossing decision knowledge to obtain a border crossing early warning analysis report of the example access behavior detection record;

and improving the neural network variables of the cross-border early warning analysis network by combining the comparison result between the cross-border early warning analysis report and the prior annotation.

In a second aspect, the present invention further provides an artificial intelligence based data access analysis system, which includes an artificial intelligence cloud platform and a service user device, where the artificial intelligence cloud platform is configured to: obtaining an access behavior detection record to be subjected to border crossing early warning analysis and a behavior element description phrase corresponding to the access behavior detection record; screening at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster according to the access behavior detection record and the behavior element description phrase to serve as a pre-processing neural network; and performing decision knowledge mining operation on the access behavior detection records through the pre-processing neural network to obtain behavior boundary-crossing decision knowledge corresponding to the access behavior detection records.

In a third aspect, the invention further provides an artificial intelligence cloud platform, which comprises a processor and a memory; the processor is in communication with the memory, and the processor is configured to read the computer program from the memory and execute the computer program to implement the method described above.

According to the data access analysis method, system and cloud platform based on artificial intelligence, provided by the embodiment of the invention, at least one candidate neural network is screened from a plurality of candidate neural networks for knowledge vector mining of access behavior detection records through the access behavior detection records and corresponding behavior element description phrases, so that a model cluster can be expanded through the plurality of candidate neural networks, and the quality of cross-border early warning analysis of a cross-border early warning analysis network is improved; in the actual border crossing early warning analysis, part of candidate neural networks can be screened to realize border crossing early warning analysis on the detection records of the access behaviors, so that excessive operation overhead can be avoided, the processing pressure of an artificial intelligent cloud platform is reduced, and the timeliness and the precision of the border crossing early warning analysis on the access behaviors are improved.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention.

Fig. 1 is a schematic flowchart of a data access analysis method based on artificial intelligence according to an embodiment of the present invention.

Fig. 2 is a schematic diagram of a communication architecture of an artificial intelligence based data access analysis system according to an embodiment of the present invention.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. The following description refers to the accompanying drawings in which the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the invention, as detailed in the appended claims.

It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order.

The method provided by the embodiment of the invention can be executed in an artificial intelligence cloud platform, computer equipment or a similar arithmetic device. Taking the example of operating on an artificial intelligence cloud platform, the artificial intelligence cloud platform 10 may include one or more processors 102 (the processors 102 may include but are not limited to processing devices such as a microprocessor MCU or a programmable logic device FPGA), and a memory 104 for storing data, and optionally, the artificial intelligence cloud platform may further include a transmission device 106 for communication functions. It will be understood by those of ordinary skill in the art that the above-described structure is merely illustrative and is not intended to limit the structure of the artificial intelligence cloud platform. For example, artificial intelligence cloud platform 10 may also include more or fewer components than shown above, or have a different configuration than shown above.

The memory 104 may be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to the artificial intelligence-based data access analysis method in the embodiment of the present invention, and the processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, so as to implement the above-mentioned method. The memory 104 may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, memory 104 may further include memory located remotely from processor 102, which may be connected to artificial intelligence cloud platform 10 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 106 is used for receiving or transmitting data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the artificial intelligence cloud platform 10. In one example, the transmission device 106 includes a Network adapter (NIC), which can be connected to other Network devices through a base station so as to communicate with the internet. In one example, the transmission device 106 may be a Radio Frequency (RF) module, which is used for communicating with the internet in a wireless manner.

Based on this, please refer to fig. 1, fig. 1 is a schematic flowchart of a data access analysis method based on artificial intelligence according to an embodiment of the present invention, where the method is applied to an artificial intelligence cloud platform, and may further include the technical solutions described in S100-S104.

S100, obtaining an access behavior detection record to be subjected to border crossing early warning analysis and a behavior element description phrase corresponding to the access behavior detection record.

For example, the behavior element description phrase corresponding to the access behavior detection record may be obtained by mining a behavior element of the access behavior detection record to be subjected to the border crossing early warning analysis through a behavior element mining network that has completed debugging. The out-of-range early warning analysis in the embodiment of the invention can be understood as analyzing the out-of-range authority of the access behavior, such as early warning analysis and judgment on whether a certain access behavior executes operation exceeding the own due authority, so that the embodiment of the invention designs the authority safety of the access behavior and the safety analysis of related data information. By performing the authority early warning analysis, the operation of individual access behaviors exceeding the authority range of the user can be avoided, so that the safety of related data information is guaranteed.

For example, the behavioral element description phrase includes at least one of the following: and the access type, the access time period, the access authority authentication result, the access security evaluation, the access behavior state, the detection signal-to-noise ratio and the like in the access behavior detection record. For example, the behavioral element description phrase generated by the behavioral element mining network may be an array, and the array may include multidimensional features, each of which may represent information corresponding to different description angles of the access behavior. For example, one of the dimensional features may represent the result of the access right authentication, for example, "N" represents that the access right authentication passes, and "Y" represents that the access right authentication fails. For another example, another dimension feature may represent an access type, "N" characterizing a local type, and "Y" characterizing a remote type. Further, the access security evaluation may be understood as an evaluation level, an execution state of a behavior corresponding to the access behavior state and the detection signal-to-noise ratio, and a noise rate of behavior data, which may also be understood in the related art and will not be described herein.

In addition, the access behavior detection records may be designed for various cloud services, such as e-commerce, digital office, virtual reality, block chain, and the like, and are not limited herein.

And S102, screening at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster as a preprocessing neural network based on the access behavior detection records and the behavior element description phrases.

The linkage AI model cluster (mixed model set) of the embodiment of the invention can comprise a plurality of candidate neural networks (such as sub models built based on an expert system). For example, the architecture of each candidate neural network may include one sliding filter unit (conv), or may include an architecture in which a plurality of sliding filter units are overlapped, and the number of specific conv may be flexibly set. The structural diversity of the candidate neural networks included in the linkage AI model cluster is not limited.

For the embodiment of the present invention, based on the access behavior detection record and the corresponding behavior element description phrase, at least one candidate neural network may be selected from the plurality of candidate neural networks to process the access behavior detection record. The candidate neural network that is screened may be considered a pre-processing neural network (e.g., a target neural network). For example, one candidate neural network may be selected from a plurality of candidate neural networks, or a plurality of candidate neural networks may be selected from a plurality of candidate neural networks. For example, assuming that the linkage AI model cluster includes 5 candidate neural networks, 2 of the candidate neural networks may be screened as preprocessing neural networks to implement decision knowledge mining operations (such as feature extraction processing based on an expert system) for access behavior detection records, or 4 of the candidate neural networks may also be screened as preprocessing neural networks. In other words, for the embodiments of the present invention, the pre-processing neural network that is screened may be part of the candidate neural networks in the linkage AI model cluster to add the current round of visiting behavior cross-border analysis, rather than utilizing all the candidate neural networks included in the linkage AI model cluster. Optionally, all candidate neural networks in the linkage AI model cluster may also be screened as pre-processing neural networks.

In addition, when the pre-processing neural network is filtered based on the access behavior detection records and the corresponding behavior element description phrases, the pre-processing neural networks filtered by different access behavior detection records may have differences. Supposing that the border crossing early warning analysis network for performing border crossing analysis of the access behaviors comprises a plurality of candidate neural networks NN1-NN7, when the preprocessing neural networks are screened, if behavior element description phrases of the access behavior detection records indicate that the access behavior detection records are access behavior detection records passing the access authority authentication, the candidate neural networks NN1 can be screened to serve as preprocessing neural networks for processing the access behavior detection records; if the behavior element description phrase of the access behavior detection record indicates that the access behavior detection record fails to pass the access authority authentication, the candidate neural network NN2 can be screened as a pre-processing neural network for processing the access behavior detection record; if the behavior element description phrase of the access behavior detection record indicates that the access behavior detection record is in an active state, candidate neural networks NN3 and NN4 can be screened as preprocessing neural networks for processing the access behavior detection record; if the behavior element description phrase of the access behavior detection record indicates that the access behavior detection record is an access behavior detection record with a high signal-to-noise ratio, the candidate neural networks NN1 and NN5 may be screened as corresponding pre-processing neural networks.

Based on the above, the behavior element description phrase may represent features of different angles of the access behavior detection record to be subjected to the border crossing early warning analysis, and when the pre-processing neural network is screened based on the behavior element description phrase, the candidate neural network for correspondingly processing the access behavior detection record having the features may be screened based on the features of the access behavior detection record. For example, the access behavior detection records passing the access right authentication may be processed by the candidate neural network NN1, and the access behavior detection records with a high signal-to-noise ratio may be processed by the candidate neural networks NN1 and NN 5.

And S104, performing decision knowledge mining operation on the access behavior detection records through the pre-processing neural network to obtain behavior boundary-crossing decision knowledge corresponding to the access behavior detection records.

For the embodiment of the present invention, after the preprocessing neural networks are selected in S102, in S104, a decision knowledge mining operation for the access behavior detection records may be implemented by the preprocessing neural networks. It can be understood that in the embodiment of the present invention, the decision knowledge mining operation on the access behavior detection records is implemented by using the pre-processing neural network, that is, the input of the pre-processing neural network is not required to be the access behavior detection records, and may also be an out-of-range analysis knowledge vector obtained by performing knowledge mining on the access behavior detection records. For example, the behavior boundary-crossing decision knowledge feature obtained by knowledge mining on the access behavior detection record may be input into the pre-processing neural network to continue the processing of knowledge vector mining. In other words, in the process of performing border crossing early warning analysis on the access behavior detection records through the linkage AI model cluster, the preprocessing neural network is added to knowledge vector mining on the access behavior detection records in the process.

Further, after behavior out-of-range decision knowledge corresponding to the access behavior detection record is obtained, an out-of-range early warning analysis report can be obtained continuously based on the behavior out-of-range decision knowledge. For example, an access behavior cloud storage space is created in advance, the cloud storage space includes a plurality of stored access behavior detection records, and behavior out-of-bounds decision knowledge of each access behavior detection record is correspondingly cached. Assuming that a group of access behavior detection records to be subjected to border crossing early warning analysis is collected currently, which group of access behavior detection records is matched with the access behavior detection records to be subjected to border crossing early warning analysis correspondingly is sought from the access behavior cloud storage space, in this case, behavior border crossing decision knowledge corresponding to the access behavior detection records to be subjected to border crossing early warning analysis can be obtained by using the border crossing early warning analysis network of the embodiment of the invention, and the behavior border crossing decision knowledge is temporarily regarded as first behavior border crossing decision knowledge. And respectively calculating a knowledge common value (such as feature similarity) between the first behavior boundary-crossing decision knowledge and behavior boundary-crossing decision knowledge of each access behavior detection record in the access behavior cloud storage space, and taking the access behavior detection record which meets a common value index in the access behavior cloud storage space as a determined target access behavior detection record.

In other words, the data access analysis method based on artificial intelligence described in the embodiment of the present invention focuses on mining behavior boundary crossing decision knowledge of an access behavior detection record to be subjected to boundary crossing early warning analysis (the behavior boundary crossing decision knowledge can be used as a basis for determining a boundary crossing early warning analysis report, and the behavior boundary crossing decision knowledge includes a series of abnormal operation features, behavior preference/intention features, and the like of an access behavior), and for how to further analyze the access behavior detection record based on the behavior boundary crossing decision knowledge to obtain the boundary crossing early warning analysis report, a skilled person in the art can select the decision based on actual needs.

According to the data access analysis method based on artificial intelligence, at least one candidate neural network is screened from a plurality of candidate neural networks for knowledge vector mining of access behavior detection records based on the access behavior detection records and corresponding behavior element description phrases, model clusters can be expanded through the candidate neural networks, and therefore the border-crossing early warning analysis quality of the border-crossing early warning analysis network is improved; in the actual border crossing early warning analysis, if a part of candidate neural networks are screened, border crossing early warning analysis on the access behavior detection records is realized, so that excessive operation overhead can be avoided, the processing pressure of an artificial intelligent cloud platform is reduced, and the timeliness and the precision of the border crossing early warning analysis on the access behaviors are improved.

The following related contents are introduced for mining the behavior out-of-range decision knowledge provided by at least one embodiment of the present invention, where the behavior out-of-range decision knowledge mining may be implemented by a linkage AI model cluster, and the linkage AI model cluster may include at least one AI algorithm model, and each AI algorithm model includes a plurality of candidate neural networks. The screening of not less than one candidate neural network from a plurality of candidate neural networks in the linkage AI model cluster as a preprocessing neural network may include: and aiming at any one AI algorithm model, screening at least one candidate neural network from a plurality of candidate neural networks contained in the AI algorithm model as the preprocessing neural network according to the access behavior detection record and the behavior element description phrase. In other words, for each AI algorithm model in the coordinated AI model cluster, a pre-processing neural network is screened from a plurality of candidate neural networks.

The following is an introduction of processing a neural network before screening a plurality of candidate neural networks included in an AI algorithm model, and the embodiment of the present invention is described by taking an example in which the AI algorithm model includes 4 candidate neural networks. Further, an access behavior detection record to be subjected to cross-border early warning analysis and a behavior element description phrase 22 corresponding to the access behavior detection record are loaded into an AI algorithm model. It is understood that the AI algorithm model may further include an access behavior element mining node for mining a behavior element description phrase from the access behavior detection record, and based on this, it may be understood that the access behavior detection record is used as a raw material of the AI algorithm model, and the mining process of the behavior element description phrase is performed by the AI algorithm model.

For the embodiment of the present invention, the AI algorithm model may filter a part of candidate neural networks from 4 candidate neural networks included in the obtained access behavior detection records and corresponding behavior element description phrases as a preprocessing neural network for processing the access behavior detection records. The screening idea of the pretreatment neural network is as follows: knowledge vector mining can be performed on the access behavior detection record21 through a vector mining unit23 in the AI algorithm model to obtain the implicit knowledge of the behavior elements. For example, the vector mining unit23 may include 2 sliding filter units. The behavior element description phrase description22 can be subjected to feature processing by the feature processing unit24, and a corresponding one-hot vector is output. Wherein the feature processing unit24 may be a relevant coding unit.

Further, the above-mentioned unique heat vector and the stated behavior element implicit knowledge may be input to the filtering processing unit25. The screening processing unit25 may continue to use the architecture of the existing model, and the screening processing unit25 may merge the behavior element implicit knowledge and the behavior element descriptive phrase to obtain the linkage knowledge phrase. For example, the implicit knowledge of the behavior elements may be adjusted into a one-dimensional descriptive phrase, and the descriptive phrase may be combined with the one-dimensional unique heat vector, and the combined result may be understood as a linkage knowledge phrase. The filtering processing unit25 may derive the neural network filtering instruction based on the linkage knowledge phrase. For example, the linkage knowledge phrase may be processed through the architecture of the existing model, and a neural network filtering indication (which may be understood as a filtering decision vector of the neural network) is output.

Further, the neural network screening instruction may include X screening variables, where X is equal to the number of candidate neural networks to be screened in the AI algorithm model, and the screening variables are used to represent the screened possibility of the candidate neural networks corresponding to the screening variables. For example, 4 candidate neural networks are included, which are the candidate neural network NN261, the candidate neural network NN262, the candidate neural network NN263, and the candidate neural network NN264, respectively. Based on this, the neural network screening indication obtained by the screening processing unit25 may be [ 0.09,0.02,0.13,0.81 ], which includes 4 screening variables, each of which represents the screened possibility of the corresponding candidate neural network.

The embodiment of the invention does not restrict the establishment rule of the corresponding list (mapping relation) of the screening variable and each candidate neural network, for example, the screening variable and the candidate neural networks can be sequentially corresponding. In other words, the filter variable 0.09 corresponds to the candidate neural network NN261, the filter variable 0.02 corresponds to the candidate neural network NN262, and so on.

Further, the screening processing unit25 may determine the pre-processing neural network from the X candidate neural networks to be screened according to the screening variable in the neural network screening instruction.

For example, the candidate neural network with the highest screening possibility may be determined as the pre-processing neural network based on the screening variable from the 4 candidate neural networks to be screened. Namely, the candidate neural network NN264 corresponding to 0.81 in the neural network screening indications (0.09, 0.02,0.13, 0.81) can be screened as the preprocessing neural network.

For another example, from among the 4 candidate neural networks to be screened, a plurality of candidate neural networks with the screened possibility within the set possibility interval are determined as a plurality of pre-processing neural networks based on the screening variable. The set probability interval may be obtained by sorting the screening variables in the neural network screening instruction according to the descending order of the screened probability, and screening the candidate neural networks corresponding to the screening variables with the screened probability in the first two digits. For another example, if one possibility determination value is set and the screened possibility is larger than the possibility determination value, the corresponding candidate neural network can be used as the pre-processing neural network. For example, if the screened possibility corresponding to two screening variables in the neural network screening instruction is higher than the possibility determination value, 2 pre-processing neural networks can be screened.

Further, after the preprocessing neural network is screened and determined, the decision knowledge mining operation of the access behavior detection record can be carried out through the preprocessing neural network. If a preprocessed neural network is selected from the 4 candidate neural networks, the preprocessed neural network outputs the mined knowledge. And if the minimum two pre-processing neural networks are screened from the 4 candidate neural networks, the outputs of the minimum two pre-processing neural networks can be combined.

Taking two pre-processing neural networks from 4 candidate neural networks as an example: it is assumed that the candidate neural network NN263 and the candidate neural network NN264 are screened as the pre-processing neural network. Then, the screening processing unit25 may load the implicit knowledge of the behavior elements generated by the vector mining unit23 into the two pre-processing neural networks NN263 and NN264, respectively, to process the implicit knowledge of the behavior elements, for example, perform convolution processing through the sliding filter unit therein, so as to obtain the pre-processing knowledge vectors generated by the pre-processing neural networks, respectively. It is assumed that the preprocessed knowledge vector generated by the candidate neural network NN263 is feature2, and the preprocessed knowledge vector generated by the candidate neural network NN264 is feature3.

Furthermore, the preprocessing knowledge vectors generated by the preprocessing neural networks can be combined based on the weight to obtain the behavior out-of-bounds decision knowledge generated by the AI algorithm model. For example, based on the pre-processing knowledge vectors generated by the pre-processing neural networks and the screening variables corresponding to the pre-processing neural networks, the pre-processing knowledge vectors generated by the pre-processing neural networks are combined based on the weights, and behavior out-of-bounds decision knowledge generated by the pre-processing neural networks is obtained and used as behavior out-of-bounds decision knowledge generated by the AI algorithm model. For example, the jointly generated behavior boundary crossing decision knowledge is the result generated by the AI algorithm model, and can be understood as w hole _ F = feature2 × 0.13+ feature3 × 0.81. For example, the filter variables 0.13 and 0.81 can be used as the corresponding merging coefficients. It should be understood that the combination coefficients of 0.13 and 0.81 are only examples, but not limited thereto.

The jointly generated behavior out-of-range decision knowledge is decision knowledge generated after combining the generation results of the candidate neural network NN263 and the candidate neural network NN264. In one example, the whole _ F can be directly used as behavior out-of-bounds decision knowledge generated by the AI algorithm model and corresponding to the access behavior detection record. In another example, the behavior out-of-bounds decision knowledge generated by the AI algorithm model can be used as the behavior element implicit knowledge and continuously loaded into the subsequent AI algorithm model.

The embodiment of the invention discloses a linkage AI model cluster, which comprises a plurality of AI algorithm models, such as an AI algorithm model1, an AI algorithm model2, an AI algorithm model3 \8230, an AI algorithm model 82n. The embodiment of the invention can take the vector mining unit23 as a processing unit which is not associated with each AI algorithm model in the linkage AI model cluster, can perform knowledge vector mining on the visit behavior detection records through the vector mining unit23 to obtain the implicit knowledge of the behavior elements, and inputs the implicit knowledge of the behavior elements into the AI algorithm model1. Each AI algorithm model may include a feature processing unit, a screening processing unit, and a plurality of candidate neural networks, for example, AI algorithm model1 may include: the feature processing unit24, the screening processing unit25, and the 4 candidate neural networks are respectively: candidate neural network NN 311-candidate neural network NN314.

The remaining AI algorithm models, which are similar to the AI algorithm model1 in architecture, may each include a feature processing unit, a screening processing unit, and a plurality of candidate neural networks to be screened. The number of candidate neural networks or the network architecture included in different AI algorithm models may be different. For example, the AI algorithm model1 may include 4 candidate neural networks, and the AI algorithm model2 may include 3 candidate neural networks: candidate neural networks NN321 through candidate neural networks NN323. In combination with the above, although the AI algorithm model2 includes a plurality of candidate neural networks, the AI algorithm model2 further includes related functional units such as a feature processing unit and a screening processing unit, which are not described herein.

In addition, the above is also only an example of the architecture of the linkage AI model cluster, in other cases, the feature processing unit may include a feature processing unit such as the AI algorithm model1 in each AI algorithm model, or may separate the feature processing unit from each AI algorithm model, and perform feature processing on the behavior element description phrases by the feature processing unit, similar to the vector mining unit, and then load the behavior element description phrases after feature processing into each AI algorithm model, so that the feature processing unit is not configured inside each AI algorithm model, and the screening processing unit and a plurality of candidate neural networks are included.

Further, when the decision-making knowledge mining operation is executed through the linkage AI model cluster, for one AI algorithm model, at least one candidate neural network can be screened from a plurality of candidate neural networks contained in the AI algorithm model to serve as a preprocessing neural network, and knowledge vector mining is carried out through the preprocessing neural networks. For example, after any AI algorithm model obtains the implicit knowledge of the behavior element, the implicit knowledge of the behavior element and the description phrases of the behavior element can be combined to obtain linkage knowledge phrases, and then the pre-processing neural network is determined from a plurality of candidate neural networks included in the AI algorithm model based on the linkage knowledge phrases. The specific mode of processing the neural network before the linkage knowledge phrase screening can be combined with the thought of generating the neural network screening indication.

Under some possible examples, taking the AI algorithm model2 therein as an example, the processing of the AI algorithm model is described: the AI algorithm model2 can receive the behavior element descriptive phrase and the first behavior element implicit knowledge generated by the AI algorithm model1. It can be seen that the input to each AI algorithm model can be both the implicit knowledge of the behavior element and the phrase that the behavior element describes. For example, the AI algorithm model1 is behavior element implicit knowledge obtained after a decision-making knowledge mining operation is implemented through a selected preprocessing neural network, and can be regarded as first behavior element implicit knowledge. The first behavioral element implicit knowledge can be further loaded into an AI algorithm model2; the AI algorithm model2 can perform feature processing on the behavior element description phrases through a feature processing unit therein, and input a result after the feature processing and implicit knowledge of the first behavior element into a screening processing unit after combining the result and the implicit knowledge of the first behavior element; the screening processing unit in the AI algorithm model2 may generate a neural network screening instruction, which includes a plurality of screening variables, and the number of the screening variables may be equal to the number of candidate neural networks included in the AI algorithm model 2. For example, it is assumed that the screening variable may be [ 0.59,0.42,0.13 ], and based on the neural network screening indication, the candidate neural network NN321 (corresponding to the variable 0.59) and the candidate neural network NN322 (corresponding to the variable 0.42) may be screened as the pre-processing neural network.

Then, the AI algorithm model2 may perform a decision knowledge mining operation on the implicit knowledge of the first action element through the selected candidate neural network NN321 and the candidate neural network NN322, for example, may be processed through a plurality of sliding filter units. Finally, behavior boundary crossing decision knowledge generated by the AI algorithm model2 can be regarded as second behavior element implicit knowledge.

Further, the second behavior element implicit knowledge can be continuously loaded to an AI algorithm model3 contained in the out-of-range early warning analysis network, and knowledge vector mining is continuously carried out. After the last AI algorithm model _ n is processed, the behavior boundary crossing decision knowledge generated by the AI algorithm model _ n can be used as the behavior boundary crossing decision knowledge of the corresponding access behavior detection record21 generated by the linkage AI model cluster. Thus, implicit knowledge of a behavioral element may also be understood as an intermediate layer feature vector or a transition feature vector.

Based on this, the linkage AI model cluster includes a plurality of AI algorithm models, wherein any two neighbor AI algorithm models can be understood as a first AI algorithm model and a second AI algorithm model. For example, the AI algorithm model1 can be regarded as a first AI algorithm model, and the AI algorithm model2 can be regarded as a second AI algorithm model. For another example, the AI algorithm model2 may be regarded as a first AI algorithm model, and the AI algorithm model3 may be regarded as a second AI algorithm model, and so on.

Further, the AI algorithm model1 has another advantage that the behavior element implicit knowledge obtained by the AI algorithm model1 is generated by the vector mining unit, that is, the vector mining unit performs knowledge vector mining on the access behavior detection records to obtain the behavior element implicit knowledge. The behavior element implicit knowledge obtained by other AI algorithm models such as the AI algorithm model2 and the AI algorithm model3 is generated by the previous AI algorithm model, for example, the behavior element implicit knowledge input into the AI algorithm model2 is generated by the AI algorithm model1. In view of the above-described advantages of the AI algorithm model1, the AI algorithm model1 can also be understood as a third AI algorithm model.

Therefore, if the "implicit knowledge of the behavior elements generated by the vector mining unit" and the "implicit knowledge of the behavior elements generated by the previous AI algorithm model" can be included from the source of the implicit knowledge of the behavior elements used by the AI algorithm model, the AI algorithm model having the feature of the "implicit knowledge of the behavior elements generated by the vector mining unit" can be regarded as the third AI algorithm model. As such, the third AI algorithm model may generally be the first AI algorithm model in the coordinated AI model cluster in which events are processed, e.g., AI algorithm model1 is at the head of the coordinated AI model cluster in the above-described related example. In addition, the related architecture includes a plurality of AI algorithm models, and in practice, the linkage AI model cluster may also include one AI algorithm model, for example, only include the AI algorithm model1, where the behavior element implicit knowledge obtained by the AI algorithm model1 is also obtained by the vector mining unit output.

In addition, if the "previous AI algorithm model outputs implicit knowledge of the behavior element and the associated next AI algorithm model receives the implicit knowledge of the behavior element", the "previous AI algorithm model" may be regarded as the first AI algorithm model and the "associated next AI algorithm model" may be regarded as the second AI algorithm model, which is also possible. Based on the above-mentioned relevant contents, the AI algorithm model2 is regarded as a first AI algorithm model, and the AI algorithm model3 is regarded as a second AI algorithm model.

Further, on the basis that the second AI algorithm model is the last AI algorithm model in the linkage AI model cluster, the behavior boundary crossing decision knowledge generated by the second AI algorithm model can be used as the behavior boundary crossing decision knowledge corresponding to the access behavior detection record. For example, the AI algorithm model _ n-1 is regarded as a first AI algorithm model, the AI algorithm model _ n is regarded as a second AI algorithm model, and in combination with the above-mentioned related contents, the AI algorithm model _ n is already the last AI algorithm model in the linkage AI model cluster, so the behavior boundary crossing decision knowledge generated by the AI algorithm model _ n is used as the behavior boundary crossing decision knowledge corresponding to the access behavior detection record. Assuming that the second AI algorithm model is not the last AI algorithm model in the linkage AI model cluster, the behavior out-of-bounds decision knowledge generated by the second AI algorithm model may be used as the behavior element implicit knowledge and continuously loaded to the next AI algorithm model. For example, the behavior out-of-bounds decision knowledge generated by the AI algorithm model2 can be used as the implicit knowledge of the behavior elements and continuously loaded into the AI algorithm model3.

According to the data access analysis method based on the artificial intelligence, disclosed by the embodiment of the invention, on the basis of the access behavior detection records and the corresponding behavior element description phrases, at least one candidate neural network is screened from a plurality of candidate neural networks contained in the linkage AI model cluster to carry out knowledge vector mining on the access behavior detection records, so that not only is the expansion of the networks realized through the plurality of candidate neural networks and the border-crossing early warning analysis quality of the border-crossing early warning analysis network improved, but also the addition of part of the candidate neural networks in the linkage AI model cluster is realized, the overlarge operation overhead is avoided, and the efficiency of the border-crossing analysis of the access behavior is improved. In addition, the number of the AI algorithm models or the number of the candidate neural networks can be flexibly determined based on actual conditions, for example, if the accuracy requirement is emphasized, a larger number of candidate neural networks can be screened or a plurality of numbers of AI algorithm models can be set; if the resource saving requirement is emphasized, the number of AI algorithm models can be reduced appropriately.

In some embodiments, the method further comprises: and performing border crossing early warning analysis processing according to the behavior border crossing decision knowledge, and further performing border crossing early warning analysis processing according to the behavior border crossing decision knowledge is realized through a border crossing early warning analysis network. The following is a debugging scheme of an out-of-range early warning analysis network provided in at least one embodiment of the present invention, where the out-of-range early warning analysis network may include a linkage AI model cluster, and the linkage AI model cluster includes a plurality of candidate neural networks. For example, the coordinated AI model cluster may include a plurality of AI algorithm models, each AI algorithm model including a plurality of candidate neural networks. The network model debugging can be performed according to the following idea.

S400, obtaining an example access behavior detection record, a priori annotation of the example access behavior detection record and a behavior element description phrase corresponding to the example access behavior detection record.

S402, loading the example type access behavior detection record and a behavior element description phrase corresponding to the example type access behavior detection record to the out-of-range early warning analysis network; and screening at least one candidate neural network from a plurality of candidate neural networks as a preprocessing neural network by the cross-border early warning analysis network according to the example access behavior detection record and the behavior element description phrase.

S404, performing decision knowledge mining operation of the example type access behavior detection record through the preprocessing neural network to obtain behavior out-of-bounds decision knowledge of the example type access behavior detection record.

The above-mentioned processing from S400 to S404 may be combined with introduction of the data access analysis method based on artificial intelligence. The exemplary access behavior detection records and the corresponding behavior element description phrases used in debugging the border-crossing early warning analysis network can be obtained by mining the exemplary access behavior detection records through the behavior element mining network in advance, and establishing the corresponding relation between the exemplary access behavior detection records and the mined behavior element description phrases, so that the corresponding relation between the exemplary access behavior detection records and the behavior element description phrases can be input into the border-crossing early warning analysis network to be debugged subsequently.

S406, performing border crossing early warning analysis on the exemplary access behavior detection record according to the behavior border crossing decision knowledge to obtain a border crossing early warning analysis report of the exemplary access behavior detection record.

S408, improving the neural network variables of the cross-border early warning analysis network by combining the comparison result between the cross-border early warning analysis report and the prior annotation.

The embodiment of the invention does not restrict the exemplary thought of the border crossing early warning analysis based on the behavior border crossing decision knowledge, for example, the thought of multivariate regression analysis (multi-classification) can be adopted for debugging, and the report label corresponding to the forecast exemplary access behavior detection record is used as the border crossing early warning analysis report. And based on the report tag prior annotation value of the exemplary access behavior detection record as prior annotation (annotation information), improving the neural network variable (model parameter) of the cross-border early warning analysis network based on the comparison result (difference value) between the prior annotation and the cross-border early warning analysis report. For example, neural network variables of feature processing units, screening processing units, and candidate neural networks in the out-of-range early warning analysis network may be improved.

Further, the above exemplary visit behavior detection records may be understood as training samples, and other exemplary data information may be similarly understood.

Under some design ideas which can be independently implemented, after the border-crossing early warning analysis processing is carried out according to the behavior border-crossing decision knowledge, the method can further comprise the following steps: if the target boundary-crossing early warning analysis report obtained after the boundary-crossing early warning analysis processing represents that the access behavior detection record to be subjected to boundary-crossing early warning analysis has boundary-crossing risks, determining a boundary-crossing protection strategy based on the behavior boundary-crossing decision knowledge; and utilizing the border-crossing protection strategy to restrict the access behavior corresponding to the access behavior detection record.

For example, if the access behavior detection records have a boundary crossing risk, advanced boundary crossing protection policy customization can be performed based on behavior boundary crossing decision knowledge, and then the related access behaviors are limited and restricted by combining the boundary crossing protection policy, so that the protection processing of related data information is realized. The access behavior detection records can be updated in real time, so that the border-crossing protection strategy can also be adaptively updated in real time or updated at intervals of a certain period, and the quality of border-crossing protection is improved.

Under some independently implementable design ideas, determining the boundary-crossing protection strategy based on the behavior boundary-crossing decision knowledge may include the following contents: performing deep knowledge refinement (knowledge reduction processing) on a first abnormal operation preference knowledge cluster of the behavior out-of-bounds decision knowledge to obtain a first target risk knowledge distribution cluster corresponding to the first abnormal operation preference knowledge cluster; performing simulation (for example, performing prediction processing on event trend characteristics) according to the first target risk knowledge distribution cluster to obtain a simulated second target risk knowledge distribution cluster; performing deep knowledge conversion on the second target risk knowledge distribution cluster to obtain a first out-of-bounds event trend information set corresponding to the second target risk knowledge distribution cluster; and generating an out-of-range protection strategy by utilizing the first out-of-range event trend information set. Therefore, the trend model prediction is carried out by utilizing the first target risk knowledge distribution cluster refined by the deep knowledge, the second target risk knowledge distribution cluster can be quickly and accurately obtained, and the first boundary-crossing event trend information set can be obtained based on the deep knowledge conversion (feature translation) so as to efficiently and accurately generate the boundary-crossing protection strategy.

Under some independently implementable design considerations, after the obtaining of the first cross-border event trend information set corresponding to the second target risk knowledge distribution cluster, the method further includes: simulating according to at least part of abnormal operation preference knowledge in the first abnormal operation preference knowledge cluster to obtain a simulated second out-of-bounds event trend information set; and obtaining a third simulated out-of-range event trend information set according to the first out-of-range event trend information set and the second out-of-range event trend information set.

Under some design ideas which can be independently implemented, the deep knowledge refinement is performed on a first abnormal operation preference knowledge cluster of the behavior boundary-crossing decision knowledge to obtain a first target risk knowledge distribution cluster corresponding to the first abnormal operation preference knowledge cluster, and the method includes: performing first knowledge mapping on a first abnormal operation preference knowledge cluster of the behavior out-of-bounds decision knowledge to obtain a first risk knowledge migration distribution cluster corresponding to the first abnormal operation preference knowledge cluster; and performing convolution processing on the first risk knowledge migration distribution cluster to obtain a first target risk knowledge distribution cluster corresponding to the first abnormal operation preference knowledge cluster.

Under some design ideas which can be independently implemented, performing deep knowledge conversion on the second target risk knowledge distribution cluster to obtain a first out-of-bounds event trend information set corresponding to the second target risk knowledge distribution cluster, including: performing deep knowledge conversion on the second target risk knowledge distribution cluster to obtain a second risk knowledge migration distribution cluster corresponding to the second target risk knowledge distribution cluster; and performing second knowledge mapping on the second risk knowledge migration distribution cluster to obtain a first out-of-bounds event trend information set corresponding to the second target risk knowledge distribution cluster. The first knowledge mapping and the second knowledge mapping are reciprocal, so that the accuracy and the reliability of different target risk knowledge distribution clusters in the knowledge refining and knowledge conversion processes can be ensured.

Based on the same or similar inventive concepts, please refer to fig. 2 in combination, the present invention further provides an architecture diagram of an artificial intelligence based data access analysis system 30, which includes an artificial intelligence cloud platform 10 and a service user device 20 that communicate with each other, and the artificial intelligence cloud platform 10 and the service user device 20 implement or partially implement the technical solution described in the above method embodiment when running.

Further, a readable storage medium is provided, on which a program is stored, which when executed by a processor implements the method described above.

In the embodiments provided in the present invention, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus and method embodiments described above are illustrative only, as the flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, the functional modules in the embodiments of the present invention may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

The functions may be stored in a computer-readable storage medium if they are implemented in the form of software functional modules and sold or used as separate products. Based on such understanding, the technical solution of the present invention or a part thereof, which essentially contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a media service server 10, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes. It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising a," "8230," "8230," or "comprising" does not exclude the presence of additional like elements in a process, method, article, or apparatus that comprises the element.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data access analysis method based on artificial intelligence is applied to an artificial intelligence cloud platform, and comprises the following steps:

obtaining the access behavior detection record to be subjected to border crossing early warning analysis and a behavior element description phrase corresponding to the access behavior detection record;

2. The method of claim 1, wherein the coordinated AI model cluster includes no less than one AI algorithm model, each AI algorithm model including a plurality of candidate neural networks;

the screening of at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster as a preprocessing neural network according to the access behavior detection record and the behavior element description phrase comprises: aiming at any one AI algorithm model, screening at least one candidate neural network from a plurality of candidate neural networks contained in the AI algorithm model as the preprocessing neural network according to the access behavior detection record and the behavior element description phrase;

wherein the screening of at least one candidate neural network from a plurality of candidate neural networks included in the AI algorithm model as a pre-processing neural network according to the access behavior detection record and the behavior element description phrase comprises: combining the behavior element implicit knowledge and the behavior element description phrases to obtain linkage knowledge phrases, wherein the behavior element implicit knowledge is obtained by knowledge mining of the access behavior detection records; obtaining a neural network screening instruction according to the linkage knowledge phrase, wherein the neural network screening instruction comprises X screening variables, X is equal to the number of the candidate neural networks to be screened in the AI algorithm model, and the screening variables are used for representing the screened possibility of the candidate neural networks corresponding to the screening variables; determining the preprocessing neural network from X candidate neural networks to be screened in the AI algorithm model according to the screening variables in the neural network screening instruction;

wherein, for any one of the AI algorithm models, on the basis that the number of the preprocessing neural networks screened from the AI algorithm model is multiple, the performing, by the preprocessing neural networks, a decision-making knowledge mining operation of the access behavior detection record includes: loading the behavior element implicit knowledge to the plurality of preprocessing neural networks determined from the AI algorithm model respectively aiming at any one AI algorithm model to obtain preprocessing knowledge vectors generated by each preprocessing neural network respectively; the behavior element implicit knowledge is obtained by knowledge mining of the access behavior detection records; and carrying out weight-based combination treatment on the pretreatment knowledge vectors generated by the pretreatment neural networks to obtain behavior boundary crossing decision knowledge generated by the AI algorithm model.

3. The method of claim 2, wherein determining the pre-processing neural network from the X candidate neural networks to be filtered in the AI algorithm model based on the filter variables in the neural network filter indication comprises: and determining the candidate neural network with the maximum screening possibility as the preprocessing neural network based on screening variables from X candidate neural networks to be screened in the AI algorithm model.

4. The method of claim 2, wherein the determining the pre-processing neural network from the X candidate neural networks to be filtered in the AI algorithm model based on the filter variables in the neural network filter indication comprises: and determining a plurality of candidate neural networks with the screened possibility in a set possibility interval as a plurality of preprocessing neural networks based on screening variables from X candidate neural networks to be screened in the AI algorithm model.

5. The method of claim 1, wherein the coordinated AI model cluster comprises: a first AI algorithm model and a second AI algorithm model, the first AI algorithm model and the second AI algorithm model respectively comprising a plurality of candidate neural networks;

the performing, by the pre-processing neural network, a decision-making knowledge mining operation of the access behavior detection record to obtain behavior boundary-crossing decision-making knowledge corresponding to the access behavior detection record includes: taking decision knowledge generated after the decision knowledge mining operation is performed through the preprocessing neural network in the first AI algorithm model as behavior element implicit knowledge, and loading the behavior element implicit knowledge to the second AI algorithm model; performing the decision knowledge mining operation on the behavior element implicit knowledge through a preprocessing neural network in the second AI algorithm model; and on the basis that the second AI algorithm model is the last AI algorithm model in the linkage AI model cluster, taking the behavior boundary-crossing decision knowledge generated by the second AI algorithm model as the behavior boundary-crossing decision knowledge corresponding to the access behavior detection record.

6. The method of claim 1, wherein the coordinated AI model clustering comprises: a third AI algorithm model; the third AI algorithm model comprises a plurality of candidate neural networks;

the screening of at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster as a preprocessing neural network according to the access behavior detection record and the behavior element description phrase comprises: knowledge vector mining is carried out on the access behavior detection records through a vector mining unit in the linkage AI model cluster to obtain hidden knowledge of behavior elements; merging the behavior element implicit knowledge and the behavior element description phrases to obtain linkage knowledge phrases; and determining the preprocessing neural network from the candidate neural networks contained in the third AI algorithm model according to the linkage knowledge phrase.

7. The method of claim 1, wherein the behavioral element descriptive phrase comprises at least one of: and the access type, the access time period, the access authority authentication result, the access security evaluation, the access behavior state and the detection signal to noise ratio which correspond to the access behavior in the access behavior detection record.

8. The method of claim 1, wherein the method further comprises: performing border crossing early warning analysis processing according to the behavior border crossing decision knowledge;

the behavior out-of-range decision making knowledge is used for performing out-of-range early warning analysis processing, and the out-of-range early warning analysis processing is realized through an out-of-range early warning analysis network, wherein the out-of-range early warning analysis network comprises a linkage AI model cluster, and the linkage AI model cluster comprises a plurality of candidate neural networks; the debugging steps of the cross-border early warning analysis network are as follows:

obtaining an example access behavior detection record, a priori annotation of the example access behavior detection record, and a behavior element description phrase corresponding to the example access behavior detection record;

9. An artificial intelligence based data access analysis system, characterized in that the system comprises an artificial intelligence cloud platform and a service user device which are communicated with each other, wherein the artificial intelligence cloud platform is used for: obtaining an access behavior detection record to be subjected to border crossing early warning analysis and a behavior element description phrase corresponding to the access behavior detection record; screening at least one candidate neural network from a plurality of candidate neural networks contained in the linkage AI model cluster according to the access behavior detection record and the behavior element description phrase to serve as a pre-processing neural network; and performing decision knowledge mining operation of the access behavior detection records through the pre-processing neural network to obtain behavior out-of-range decision knowledge corresponding to the access behavior detection records.

10. An artificial intelligence cloud platform comprising a processor and a memory; the processor is connected in communication with the memory, and the processor is configured to read the computer program from the memory and execute the computer program to implement the method of any one of claims 1 to 9.