基于模式挖掘和比较的用户异常行为检测算法  

Users’Abnormal Behavior Detection Algorithm Based on Pattern Mining and Comparison

作　　者：邓莎 操文成 徐允彪 李镭[1] 郭志君 DENG Sha;CAO Wencheng;XU Yunbiao;LI Lei;GUO Zhijun(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2025年第3期302-309,共8页Communications Technology

摘　　要：常见的用户异常行为检测方法主要依赖经验规则和统计针对用户单点的行为进行分析,检测的融合性较低,难以识别新的行为模式,也缺乏对异常行为的事前预测能力。为了解决上述问题,针对用户行为模式的周期性和时变性等特点,提出了一种基于模式挖掘和比较的用户异常行为检测算法框架。该算法对用户单点的行为进行融合分析,能够从历史行为样本中抽象出用户差异化的行为模式;然后基于提出的模式比较算法与用户实际行为序列进行对比,判断用户行为序列的风险性,预测可能出现的异常行为,提升用户异常行为检测的融合性和预见性;同时对特定的新增行为数据进行增量学习,发现新的行为模式,提升用户异常行为检测的实用性。Conventional methods for detecting users’abnormal behavior primarily rely on empirical rules and statistical analysis focused on isolated instances of user actions,with low integration of detection,difficulty in identifying new behavioral patterns,and lack of ability to predict abnormal behavior preemptively.To address the above problems,aiming at the characteristics of users’behavioral patterns such as periodicity and timevarying,this paper proposes an algorithm for detecting users’abnormal behavior based on pattern mining and comparison.The proposed algorithm first integrates the analysis of isolated user actions,abstracting user’s differentiated behavioral patterns from historical behavior samples.Then,it compares the proposed pattern comparison algorithm with the user’s actual behavioral sequences to assess the risk level of user’s behavioral sequences,predict potential abnormal behaviors,and enhance the integration and predictability of user’s abnormal behavior detection.At the same time,it carries out incremental learning on specific new behavioral data to discover new behavioral patterns and enhance the practicality and adaptability of users’abnormal behavior detection.

关 键 词：频繁序列挖掘 模式比较 融合分析 异常行为检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]