CN117633787A - A security analysis method and system based on user behavior data - Google Patents

Abstract

The invention discloses a security analysis method and system based on user behavior data, which relates to the technical field of security analysis and includes collecting user operation log data from various channels and performing preprocessing to obtain user behavior sequences; constructing abnormal behavior detection based on user behavior sequences model to identify and detect abnormal behavior; use the trained optimal abnormal behavior detection model to predict new user behavior sequences and determine the final state of user behavior; provide early warning based on the final state of user behavior and take corresponding response measures ; Establish a security monitoring mechanism to continuously monitor and evaluate user behavior data and promptly discover potential anomalies or security risks. By dividing the user behavior sequence into fixed-length behavior segments, the present invention achieves an accurate understanding of user behavior patterns and behavior changes, thereby improving the accuracy of analysis results.

Description

A security analysis method and system based on user behavior data

Technical field

The present invention relates to the technical field of security analysis, in particular to a security analysis method and system based on user behavior data.

Background technique

With the booming development of the Internet, most companies have established varying numbers of information systems. In addition to traditional network security issues, these information systems also face illegal operations by legitimate users. However, there are some problems in existing user behavior analysis technology methods, which are mainly reflected in the following aspects: First, existing methods mainly rely on rule engines for pattern matching, but this requires manual setting of the rule base. Due to the complexity and variability of user behavior, it is difficult for static rules to cover all abnormal situations. Once new attack methods appear, the rule engine will fail and cannot effectively detect abnormal behaviors.

Secondly, some methods use simple statistical analysis methods to identify anomalies by setting thresholds. However, it is difficult to balance sensitivity and false positive rate, which can easily lead to false negatives and false positives, thus affecting the accuracy of analysis results. In addition, most methods focus on the detection of a single account, making it difficult to achieve global monitoring of user groups, making it impossible to detect abnormal patterns in the network. Finally, existing methods lack continuous optimization and feedback mechanisms for detection strategies, making it difficult to keep up with changes in attack methods.

Contents of the invention

In view of the problems existing in the existing user behavior analysis technical methods in terms of rule engine dependency, limitations of statistical analysis methods, single account detection and policy optimization, the present invention is proposed.

Therefore, the problem to be solved by the present invention is how to detect and identify abnormal or risk patterns in user behavior data to conduct effective security monitoring and early warning.

In order to solve the above technical problems, the present invention provides the following technical solutions:

In the first aspect, embodiments of the present invention provide a security analysis method based on user behavior data, which includes collecting user operation log data from various channels and performing preprocessing to obtain a user behavior sequence; and constructing an abnormal behavior detection model based on the user behavior sequence. , to identify and detect abnormal behavior; use the trained optimal abnormal behavior detection model to predict new user behavior sequences and determine the final state of user behavior; provide early warning based on the final state of user behavior, and take corresponding response measures; Establish a security monitoring mechanism to continuously monitor and evaluate user behavior data, and promptly discover potential anomalies or security risks; building an abnormal behavior detection model based on user behavior sequences includes the following steps: Divide the user behavior sequence into fixed-length behavior segments in chronological order; Use the hidden Markov model to establish an abnormal behavior detection model and initialize the model; use the Baum-Welch algorithm to train the abnormal behavior detection model, iteratively calculate the forward probability, backward probability and state output probability, re-estimate and update the model parameters; save the update The latter model is used as the optimal abnormal behavior detection model; using the Baum-Welch algorithm to train the abnormal behavior detection model includes the following steps: using the forward algorithm and the backward algorithm to calculate the forward probability and backward probability at each time t respectively; according to the forward The forward probability and backward probability calculate the output probability of state i at each time t, and at the same time re-estimate and update the model parameters based on the output probability; the specific formula for updating the model parameters is as follows:

,/> ,/> ,/> ;

in, Represents the updated state probability vector,/> Represents the updated state transition probability,/> Indicates that the symbol /> is observed in state j after the update The emission probability of ,/> Represents the output probability of state j at the initial moment, t represents the time,/> Represents the length of the behavior fragment state sequence, /> Represents the output probability of state i at time t,/> Represents the output probability of transitioning from state i to state j at time t,/> Represents the output probability of state j at time t,/> Represents the observation symbol at time t,/> Represents an observation set/> The symbol in ,/> Represents the index of the observation symbol, /> and/> Both represent hidden states, Indicates the number of possible states,/> represents the number of possible observations.

As a preferred solution of the security analysis method based on user behavior data of the present invention, the calculation formula of forward probability is as follows:

;

in, Expressed in t/> The time status is/> The forward probability of ,/> Indicates that the state at time t is/> The forward probability of ,/> Represents slave status/> to status/> The transition probability of ,/> In status/> Next generate observations/> The emission probability of ,/> Indicates the number of possible states,/> Represents the length of the behavior fragment state sequence, /> and/> Both represent hidden states.

The calculation formula for backward probability is as follows:

;

in, Indicates that the state at time t is/> The backward probability of ,/> Expressed in t/> The time status is/> The backward probability of ,/> Represents slave status/> to status/> The transition probability of ,/> In status/> Next generate observations/> The emission probability,/> Indicates the number of possible states,/> Represents the length of the behavior fragment state sequence, /> and/> Both represent hidden states.

The calculation formula of the output probability is as follows:

;

in, Represents slave status/> to status/> The transition probability of ,/> In status/> Next generate observations/> The emission probability,/> Indicates that the state at time t is/> The forward probability of ,/> Expressed in t/> The time status is/> The backward probability of ,/> Indicates the number of possible states,/> and/> Both represent hidden states.

As a preferred solution of the security analysis method based on user behavior data of the present invention, wherein:

Determining the final state of user behavior includes the following steps: collect new user behavior data, perform preprocessing and segmentation steps to obtain fixed-length behavior segments; for each behavior segment, use the optimal abnormal behavior detection model to predict the user behavior state, and Output the most likely sequence of states ;The state sequence output by the model/> Match the set exception judgment rules to determine the final status of the behavior fragment; update the final status of the behavior fragment to the status label of the behavior fragment to obtain the user behavior status sequence/> ; Abnormality judgment rules include the following: if the status at all times is normal behavior, then the status of the entire behavior segment is determined to be normal; if the status at any time is abnormal behavior, then the status of the entire behavior segment is directly determined to be abnormal; otherwise, the behavior segment is calculated Proportion of suspicious behavior/> :if/> , then the entire behavior segment is judged to be normal; if/> , then the status of the entire behavioral segment is determined to be suspicious; if , then the status of the entire behavioral segment is determined to be abnormal; where,/> Represents the length of the behavior fragment state sequence.

As a preferred solution of the security analysis method based on user behavior data of the present invention, judging the user's risk level according to the final state of the user behavior segment includes the following steps: constructing a segment risk matrix ;Calculate user behavior sequence risk value/> and total number of behavioral clips/> ;Convert user behavior sequence risk value/> Match the preset risk rules to determine the user's risk level and take corresponding risk response measures; calculate the user behavior sequence risk value/> Includes the following steps: For each user behavior status sequence/> Behavioral snippets in/> , confirmed/> Category/> and status/> ;In Fragment Risk Matrix/> Find the corresponding risk weight value/> ; Summarize the risk weight values of all behavioral segments in the behavioral sequence/> As user behavior sequence risk value/> .

As a preferred solution of the security analysis method based on user behavior data of the present invention, the risk rules include the following: If , then it is judged that the user risk level is low, no early warning is required, user behavior will continue to be monitored and normal services will be maintained; if/> , then it is judged that the user's risk level is low to medium, then first-level measures will be responded to, non-critical functions of the account will be suspended, and the user will be prompted that there are security risks. Secondary verification will be added to key business operations, manual verification will be introduced, and functions will be restored in batches after confirming that there is no damage. and reassess regularly; if/> , it is judged that the user's risk level is medium to high, then secondary measures will be responded to, sensitive operation permissions will be suspended, the user will be prompted to proactively investigate the risk, the user will be required to submit a problem improvement report, enhanced multi-factor authentication will be enabled, and business will be partially resumed after expert review and evaluation, and the business will be partially restored on a regular basis. Reevaluate; if/> , it is judged that the user's risk level is high, then Level 3 measures will be responded to, the account will be frozen immediately, the regulatory department will be notified to conduct an internal audit of the system to trace the evidence chain, and the user will be required to conduct a comprehensive self-examination and correct the operation. Experts will conduct a comprehensive verification and assessment to determine if the risk has been eliminated. Resume business in batches.

In the second aspect, embodiments of the present invention provide a security analysis system based on user behavior data, which includes a data preprocessing module for collecting user operation log data from various channels and performing preprocessing to obtain user behavior sequences; model construction The module is used to establish an abnormal behavior detection model using hidden Markov models, and uses the Baum-Welch algorithm to train the abnormal behavior detection model on each behavioral segment; the state determination module is used to compare the state sequence output by the model with the set abnormality The judgment rules are matched to determine the final state of the behavior fragment; the response measure module is used to determine the user's risk level based on the final state of the user's behavior fragment and take corresponding response measures.

The beneficial effects of the present invention are: by dividing the user behavior sequence into fixed-length behavior segments, the present invention achieves an accurate understanding of user behavior patterns and behavior changes, thereby improving the accuracy of the analysis results; at the same time, through sequence modeling Identifying abnormal patterns significantly improves the efficiency of risk detection and realizes intelligent and dynamic security monitoring; in addition, it subdivides multiple risk levels and combines multiple judgment rules such as fixed thresholds and confidence intervals for decision-making, effectively improving The robustness of the system; finally, adding optimization methods such as monitoring feedback and matrix adjustment can continuously improve system performance.

Description of drawings

In order to explain the technical solutions of the embodiments of the present invention more clearly, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. Those of ordinary skill in the art can also obtain other drawings based on these drawings without exerting creative efforts.

Figure 1 is a method flow chart of the security analysis method based on user behavior data.

Figure 2 is a computer equipment diagram of the security analysis method based on user behavior data.

Detailed ways

In order to make the above objects, features and advantages of the present invention more obvious and understandable, the specific implementation modes of the present invention will be described in detail below with reference to the accompanying drawings.

Many specific details are set forth in the following description to fully understand the present invention. However, the present invention can also be implemented in other ways different from those described here. Those skilled in the art can do so without departing from the connotation of the present invention. Similar generalizations are made, and therefore the present invention is not limited to the specific embodiments disclosed below.

Second, reference herein to "one embodiment" or "an embodiment" refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. "In one embodiment" appearing in different places in this specification does not all refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

Example 1

Referring to Figures 1 and 2, a first embodiment of the present invention is shown. This embodiment provides a security analysis method based on user behavior data, including:

S1: Collect user operation log data from each channel and perform preprocessing to obtain user behavior sequences.

Preferably, collect the original operation logs of users from different channels, classify the logs by user ID, and merge them into user behavior sequences in chronological order; clean the logs, including filtering irrelevant records, deleting duplicate records, etc.; parse the logs and extract the key points of the behavior. fields, and aggregate the extracted behavior fields to generate standardized records describing a single behavior; connect the behavior records of individual users in chronological order to form a complete user behavior sequence; merge the behavior sequences of different users to form a unified Behavior sequence data set; perform security desensitization on the data set, delete identification information, and obtain a usable behavior sequence set.

S2: Build an abnormal behavior detection model based on user behavior sequences to identify and detect abnormal behaviors.

Specifically, it includes the following steps:

S2.1: Divide the user behavior sequence into fixed-length behavior segments in chronological order.

preferred, definition Represents the set of all possible behavioral states,/> represents the set of all possible observations,/> The representative length is/> Behavior fragment state sequence, /> Represents the fragment observation sequence corresponding to the state.

Specifically, in this embodiment, the user behavior sequence is divided into fixed-length behavior segments every 10 minutes, and the user behavior status includes normal behavior, suspicious behavior and abnormal behavior, and the behavior status set , where 0 represents normal behavior, 1 represents suspicious behavior, and 2 represents abnormal behavior.

S2.2: Use the hidden Markov model to establish an abnormal behavior detection model and initialize the model.

Specifically, initialize the model , at this time the state probability vector/> , initial state transition probability matrix/> , initial observation probability matrix/> , of which/> Indicates the number of possible states,/> is the number of possible observations, and/> ,/> ,/> ,/> Indicates that time t is in/> status but in t/> Time transfer to/> The probability of the state,/> Indicates that time t is in/> State generation observation/> state probability.

Further, the abnormal behavior detection model input is a length of Behavior fragment, the output is the state probability vector at each time t/> , select the state with the highest probability/> As the state recognition result at time t, after the entire length/> sequence, and finally get the status result sequence/> .

It should be noted that the abnormal behavior detection model is established by learning historical normal user operation sequences. For example, in the ERP system, some common operations such as order making, review, warehousing, outgoing, adding suppliers, adding customers, Querying customers, logging in to accounts, modifying personal information, etc. are all normal user behaviors; if certain operations are too frequent or the amount is abnormally large, they will be judged as suspicious behaviors. These suspicious behaviors include querying and exporting customer information in batches, batch Query and export warehousing information, log in to accounts in different locations within a short period of time, fail to log in multiple times in a row, etc.

Specifically, the abnormal behavior detection model establishes a pattern of normal behavior by learning the user's historical normal operation sequence. When it is detected that some of the user's operational characteristics deviate significantly from the normal behavior pattern or violate the preset rules, these operations will It was judged to be unusual and suspicious behavior.

S2.3: Use the Baum-Welch algorithm to train the abnormal behavior detection model, iteratively calculate the forward probability, backward probability and state output probability, and re-estimate and update the model parameters.

Specifically, it includes the following steps:

S2.3.1: Use the forward algorithm and the backward algorithm to calculate the forward probability and backward probability at each time t respectively.

Specifically, the calculation formula of forward probability is as follows:

;

;

in, Indicates that the state is/> at the initial time t=1 The forward probability of ,/> represents the initial state probability vector, In status/> Next generate observations/> The emission probability,/> Expressed in t/> The time status is/> The forward probability of , Indicates that the state at time t is/> The forward probability of ,/> Represents slave status/> to status/> The transition probability of ,/> In status/> Next generate observations/> The emission probability,/> Indicates the number of possible states,/> Represents the length of the behavior fragment state sequence, /> and/> Both represent hidden states.

Preferably, the calculation formula of backward probability is as follows:

;

;

in, Indicates that the backward probability of state i at the last moment is 1,/> Indicates that the state at time t is/> The backward probability of ,/> Expressed in t/> The time status is/> The backward probability of ,/> Represents slave status/> to status/> The transition probability of ,/> In status/> Next generate observations/> The emission probability,/> Indicates the number of possible states,/> Represents the length of the behavior fragment state sequence, /> and/> Both represent hidden states.

S2.3.2: Calculate the output probability of state i at each time t based on the forward probability and backward probability, and re-estimate and update the model parameters based on the output probability.

Specifically, the output probability of state i at time t The specific formula is as follows:

;

in, Indicates that the state at time t is/> The backward probability of ,/> Indicates that the state at time t is/> The forward probability of ,/> Indicates the number of possible states,/> Represents hidden state.

Furthermore, the output probability of transitioning from state i to state j at time t The specific formula is as follows:

;

in, Represents slave status/> to status/> The transition probability of ,/> In status/> Next generate observations/> The emission probability,/> Indicates that the state at time t is/> The forward probability of ,/> Expressed in t/> The time status is/> The backward probability of ,/> Indicates the number of possible states,/> and/> Both represent hidden states.

Furthermore, the specific formula for re-estimating and updating model parameters based on the output probability is as follows:

,/> ,/> ,/> ;

in, Represents the updated state probability vector,/> Represents the updated state transition probability,/> Indicates that the symbol /> is observed in state j after the update The emission probability,/> Represents the output probability of state j at the initial moment, t represents the time,/> Represents the length of the behavior fragment state sequence, /> Represents the output probability of state i at time t,/> Represents the output probability of transitioning from state i to state j at time t,/> Represents the output probability of state j at time t,/> Represents the observation symbol at time t,/> Represents an observation set/> The symbol in /> Represents the index of the observation symbol, /> and/> Both represent hidden states, Indicates the number of possible states,/> represents the number of possible observations.

S2.4: Save the updated model as the optimal abnormal behavior detection model.

S3: Use the optimal abnormal behavior detection model to predict abnormality in new user behavior sequences and determine the final state of user behavior.

Preferably, it includes the following steps:

S3.1: Collect new user behavior data and execute The preprocessing step obtains the user behavior sequence and executes/> The segmentation step divides the user behavior sequence into fixed-length behavior segments in chronological order.

S3.2: For each behavior segment, use the optimal abnormal behavior detection model to predict the user's behavior state and output the most likely state sequence .

S3.3: State sequence output by the model Match the set exception judgment rules to determine the final status of the behavior fragment.

Preferably, the abnormality judgment rules include the following: if the status at all times is normal behavior 0, then the status of the entire behavior segment is determined to be normal; if the status at any time is abnormal behavior 2, then the status of the entire behavior segment is directly determined to be abnormal; otherwise, the status of the entire behavior segment is determined to be abnormal. , calculate the proportion of suspicious behavior in the behavior fragments :if/> , then the entire behavior segment is judged to be normal; if/> , then the status of the entire behavior segment is determined to be suspicious; if/> , then the status of the entire behavior segment is determined to be abnormal.

It should be noted that, with and/> The reason for the threshold dividing line is as follows: based on typical distribution considerations, means in fragment/> The moment is in a suspicious state, which is acceptable for the overall judgment to be normal;/> means in fragment/> The moment is in a suspicious state, which can be judged as an abnormal sign; and use/> and/> As a threshold dividing line, the final segment abnormality judgment can be intuitively interpretable and ensure a certain degree of robustness, while also leaving room for adjustment and improvement.

S3.4: Update the final status of the behavior fragment to the status label of the behavior fragment to obtain the user behavior status sequence .

S4: Determine the user's risk level based on the user's behavior status sequence, and take corresponding response measures.

Specifically, it includes the following steps:

S4.2: Construct a fragment risk matrix .

Preferred, fragment risk matrix The size is/> ,/> Indicates the number of fragment status categories (normal, suspicious and abnormal in this embodiment), /> Indicates the number of fragment types (including login, order making, transfer, etc.),/> Representation type/> The fragment is in status/> The risk weight under , the weight is generated based on knowledge graph analysis, ranging from 0 to 1.

S4.2: Calculate user behavior sequence risk value .

Preferably, for each user behavior status sequence Behavioral snippets in/> , determine its category/> and status/> , and in the fragment risk matrix/> Find the corresponding risk weight value/> , summarizing all behavior fragments in the behavior sequence/> As user behavior sequence risk value/> .

Specifically, user behavior sequence risk value The calculation formula is as follows:

;

in, Represents the user behavior sequence risk value,/> Represents the total number of behavioral fragments,/> Represents the user behavior sequence/> The risk weight value of each behavioral segment.

S4.3: Match user behavior sequence risk values with preset risk rules to determine user risk levels and take corresponding risk response measures.

like , then it is judged that the user's risk level is low, no early warning is required, user behavior will continue to be monitored, and normal services will be maintained;

like , then it is judged that the user's risk level is low to medium, then first-level measures will be responded to, non-critical functions of the account will be suspended, and the user will be prompted that there are security risks. Secondary verification will be added to key business operations, manual verification will be introduced, and functions will be restored in batches after confirming that there is no damage. and reassess regularly;

like , it is judged that the user's risk level is medium to high, then secondary measures will be responded to, sensitive operation permissions will be suspended, the user will be prompted to proactively investigate risks, the user will be required to submit a problem improvement report, enhanced multi-factor authentication will be enabled, and business will be partially resumed after expert review and assessment, and the business will be partially resumed on a regular basis. Reassess;

like , it is judged that the user's risk level is high, then Level 3 measures will be responded to, the account will be frozen immediately, the regulatory department will be notified to conduct an internal audit of the system to trace the evidence chain, and the user will be required to conduct a comprehensive self-examination and correct the operation. Experts will conduct a comprehensive verification and assessment to determine if the risk has been eliminated. Resume business in batches;

S5: Establish a security monitoring mechanism to continuously monitor and evaluate user behavior data and discover potential anomalies or security risks in a timely manner.

Further, this embodiment also provides a security analysis system based on user behavior data, including a data preprocessing module for collecting and preprocessing user operation log data from various channels to obtain user behavior sequences; a model building module for The hidden Markov model is used to establish an abnormal behavior detection model, and the Baum-Welch algorithm is used to train the abnormal behavior detection model on each behavioral segment; the state determination module is used to compare the state sequence output by the model with the set abnormality judgment rules. matching to determine the final state of the behavior fragment; the response measure module is used to determine the user's risk level based on the final state of the user's behavior fragment and take corresponding response measures.

In summary, the present invention achieves an accurate understanding of user behavior patterns and behavior changes by dividing user behavior sequences into fixed-length behavior segments, thereby improving the accuracy of analysis results; at the same time, identifying abnormal patterns through sequence modeling , significantly improves the efficiency of risk detection and realizes intelligent and dynamic security monitoring; in addition, it subdivides multiple risk levels and combines multiple judgment rules such as fixed thresholds and confidence intervals for decision-making, which effectively improves the system's robustness. stickiness; finally, adding optimization methods such as monitoring feedback and matrix adjustment can continuously improve system performance.

Example 2

Referring to Figures 1 and 2, a second embodiment of the present invention is shown. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculations and simulation experiments.

Specifically, taking an ERP system as an example, the operation logs of 100 users on the system in June 2022 were extracted through the ERP system background, and the logs were classified according to user IDs to generate complete behavior sequences of 100 users, including system For operations such as ordering, querying suppliers, and querying customers, the user behavior sequence is divided into behavioral segments with a length of 10 minutes. Part of the data is shown in Table 1.

Table 1 Some behavioral fragments of users

Preferably, define a collection of user behavior states , 0 represents normal behavior, 1 represents suspicious behavior, and 2 represents abnormal behavior. Initialize the model parameters of the abnormal behavior detection model and use the Baum-Welch algorithm to train the model. After 10 iterations, the parameters converge and the optimal abnormal behavior detection model is obtained.

Further, new user logs are collected to generate 12 behavioral segments with a length of 10 minutes, and the status sequence of each behavioral segment is length/> is 15, use the optimal abnormal behavior detection model to predict the state sequence of each fragment, and select the state with the highest probability as the state identification result, we can get fragment 1:/> , fragment 2:/> ,...,Fragment 12:/> . Convert each status sequence/> Match with the set exception judgment rules to judge the user behavior status sequence as/> .

Further, construct a fragment risk matrix , calculate the user behavior sequence risk value/> , and/> , match the risk rules, determine the user's risk level as low to medium, respond to secondary measures, suspend sensitive operation permissions, prompt the user to actively investigate risks, require the user to submit a problem improvement report, enable enhanced multi-factor authentication, and partially restore after expert verification and evaluation Business, re-evaluate regularly; re-evaluate the risk level until the risk level is reduced to low risk.

Preferably, the comparison indexes between the method of the present invention and the traditional method are shown in Table 2.

Table 2 Comparison table of indicators between the method of the present invention and the traditional method

Preferably, as can be seen from Table 2, the method of the present invention shows significant advantages over traditional methods in terms of accuracy, sensitivity, false positive rate, real-time performance, scalability and system compatibility.

It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solution of the present invention can be carried out. Modifications or equivalent substitutions without departing from the spirit and scope of the technical solution of the present invention shall be included in the scope of the claims of the present invention.

Claims (6)

1. A safety analysis method based on user behavior data is characterized in that: comprising the steps of (a) a step of,

collecting user operation log data of each channel and preprocessing the user operation log data to obtain a user behavior sequence;

constructing an abnormal behavior detection model based on the user behavior sequence to identify and detect abnormal behaviors;

predicting a new user behavior sequence by using the trained optimal abnormal behavior detection model, and determining the final state of the user behavior;

early warning is carried out according to the final state of the user behavior, and corresponding response measures are adopted;

establishing a safety monitoring mechanism to continuously monitor and evaluate user behavior data, and timely discovering potential abnormality or safety risk;

the construction of the abnormal behavior detection model based on the user behavior sequence comprises the following steps:

dividing a user behavior sequence into behavior fragments with fixed lengths according to time sequence;

establishing an abnormal behavior detection model by using a hidden Markov model, and initializing the model;

training an abnormal behavior detection model by using a Baum-Welch algorithm, iteratively calculating forward probability, backward probability and state output probability, and re-estimating and updating model parameters;

storing the updated model as an optimal abnormal behavior detection model;

the training of the abnormal behavior detection model by using the Baum-Welch algorithm comprises the following steps:

respectively calculating the forward probability and the backward probability of each moment t by using a forward algorithm and a backward algorithm;

calculating the output probability of the state i at each t moment according to the forward probability and the backward probability, and simultaneously re-estimating and updating the model parameters according to the output probability;

the specific formula for updating the model parameters is as follows:

，/>，/>，/>;

wherein,representing updated state probability vectors +.>Representing the updated state transition probability, +.>Indicating that the sign +.>Is>Output probability indicating that the state is j at the initial time, t indicates time,/>Representing the length of the behavior fragment state sequence, +.>Output probability indicating that the state is i at time t, < >>Output probability indicating transition from state i to state j at time t, < >>Output probability of j representing state at time t, +.>Observation symbol indicating time t,/->Representing the observation set +.>Symbols in->Index representing observation symbol->And->All of which represent a hidden state and,representing the number of possible states,/->Representing the number of possible observations.

2. The security analysis method based on user behavior data according to claim 1, wherein: the forward probability is calculated as follows:

;

wherein,indicated at t->The time status is +.>Forward probability of>Indicating a state of +.>Forward probability of>Representing slave status +.>To state->Transition probability of->In state->Down-generated observations->Is used to determine the transmission probability of (1),representing the number of possible states,/->Representing the length of the behavior fragment state sequence, +.>And->All represent hidden states;

the calculation formula of the backward probability is as follows:

;

wherein,indicating a state of +.>Backward probability of>Indicated at t->The time status is +.>Backward probability of>Representing slave status +.>To state->Transition probability of->In state->Down-generated observations->Is used to determine the transmission probability of (1),representing the number of possible states,/->Representing the length of the behavior fragment state sequence, +.>And->All represent hidden states;

the calculation formula of the output probability is as follows:

;

wherein,representing slave status +.>To state->Transition probability of->In state->Down-generated observations->Is>Indicating a state of +.>Forward probability of>Indicated at t->The time status is +.>Is used to determine the backward probability of (1),representing the number of possible states,/->And->All represent hidden states.

3. The security analysis method based on user behavior data according to claim 2, wherein: said determining the final state of the user behavior comprises the steps of:

collecting new user behavior data, and performing preprocessing and segmentation steps to obtain behavior fragments with fixed lengths;

for each behavior segment, predicting the behavior state of the user by using the optimal abnormal behavior detection model, and outputting the most likely state sequence；

State sequence for outputting modelMatching with a set abnormality judgment rule to judge the final state of the behavior segment;

updating the final state of the behavior segment to the state label of the behavior segment to obtain the user behavior state sequence；

The abnormality judgment rule includes the following:

if the state at all moments is normal behavior, judging that the state of the whole behavior segment is normal;

if the state at any moment is abnormal behavior, directly judging that the state of the whole behavior segment is abnormal;

otherwise, calculating the proportion of suspicious behaviors in the behavior segment：

If it isJudging that the state of the whole behavior segment is normal;

if it isJudging the state of the whole behavior fragment to be suspicious;

if it isJudging the state of the whole behavior segment to be abnormal;

wherein,representing the length of the behavior fragment state sequence.

4. A security analysis method based on user behavior data according to claim 3, wherein: the step of judging the risk level of the user according to the final state of the user behavior segment comprises the following steps:

construction of segment risk matrix；

Calculating risk values of user behavior sequencesAnd action segment total->；

Sequence risk values of user behaviorsMatching with a preset risk rule to judge the risk level of the user and taking corresponding risk response measures;

the calculation of risk values of a user behavior sequenceThe method comprises the following steps:

for each user behavior state sequenceBehavior segment->Confirm->Category of->And state->；

In-segment risk matrixFind the corresponding risk weight value +.>；

Summarizing risk weight values of all behavior fragments in behavior sequenceRisk value as a sequence of user actions->。

5. The method for security analysis based on user behavior data according to claim 4, wherein: the risk rule includes the following:

if it isIf the risk level of the user is judged to be low, early warning is not needed, the user behavior is continuously monitored, and normal service is maintained;

if it isIf the risk level of the user is low and medium, responding to a first-level measure, suspending the non-key function of the account number, prompting the user to have potential safety hazard, adding secondary verification to key business operation, introducing artificial verification, determining the function of batch recovery after no damage, and periodically reevaluating;

if it isJudging the medium and high risk of the user risk level, responding to the secondary measure, suspending the sensitive operation authority, prompting the user to actively check the risk, and asking the user to submit the problemImproving the report, enabling the enhanced multi-factor authentication, and checking part of recovered business after evaluation by an expert to periodically re-evaluate;

if it isAnd if the risk level of the user is high, responding to the three-level measures, immediately freezing the account number, notifying a supervision department to perform system internal inspection so as to trace back an evidence chain, requiring the user to comprehensively self-inspect and correct operation, and enabling an expert to perform comprehensive inspection and evaluation to determine that the business is recovered in batches after the risk is eliminated.

6. A security analysis system employing the security analysis method based on user behavior data according to any one of claims 1 to 5, characterized in that: comprising the steps of (a) a step of,

the data preprocessing module is used for collecting user operation log data of each channel and preprocessing the data so as to acquire a user behavior sequence;

the model construction module is used for establishing an abnormal behavior detection model by adopting a hidden Markov model and training the abnormal behavior detection model on each behavior segment by using a Baum-Welch algorithm;

the state determining module is used for matching the state sequence output by the model with a set abnormality judging rule so as to judge the final state of the behavior segment;

and the response measure module is used for judging the risk level of the user according to the final state of the user behavior segment and taking corresponding response measures.