CN118797629A - User portrait construction method and device - Google Patents

Abstract

The application relates to the technical field of computers, and provides a user portrait construction method and device. The method comprises the following steps: obtaining target operation activity of a user according to operation time, operation frequency and sensitivity level of the user for executing various operation instructions on each system; calculating target weight of instruction class labels of various operation instructions executed by the user on each system; and constructing the portrait of the user according to the target operation activity and the target weight. The user portrait construction method and device provided by the application can construct the user portrait from two dimensions of the target operation activity of the user and the target weights of various operation instructions, so that the user operation behaviors can be more comprehensively reflected, the accuracy of user portrait construction is improved, and the sensitivity level of the operation instructions is considered in the construction process of the user portrait, so that the user portrait construction method and device are suitable for the user operation behavior analysis scene related to data security, and the accuracy of user portrait construction is further improved.

Description

User portrait construction method and device

Technical Field

The present application relates to the field of computer technology, and in particular to a method and device for constructing a user portrait.

Background Art

As the amount of business data in each business system increases, users are operating the business system more frequently. In order to maintain the data security in the business system, it is necessary to conduct security assessments on the operations of each user. By building a profile of the user's operation, it is possible to quickly and effectively analyze the user's operation behavior and conduct security assessments.

In the field of enterprise marketing or product promotion, the RFM model is generally used, that is, the user is evaluated and analyzed through the user's most recent purchase time (recency), purchase frequency (frequency) and purchase amount (monetary), and a user portrait is constructed, based on which user classification and precise marketing promotion are carried out. However, this method only considers the amount, frequency and time factors of user transactions, and does not consider the sensitivity level of different user operation behaviors. It can only simply construct user portraits through indicator statistics. In the user operation behavior analysis scenario involving data security, the user portrait constructed by this method has a low accuracy rate.

Summary of the invention

The embodiments of the present application provide a method and device for constructing a user portrait, which are used to solve the technical problem that the traditional user portrait construction method only considers the amount, frequency and time factors of the user's transaction, but does not consider the sensitivity level of different user operation behaviors. In the user operation behavior analysis scenario involving data security, the user portrait constructed by this method has a low accuracy rate.

In a first aspect, an embodiment of the present application provides a method for constructing a user portrait, comprising:

According to the operation time, operation frequency and sensitivity level of the user's execution of various operation instructions on each system, the target operation activity of the user is obtained;

Calculate the target weight of the instruction category label of each type of operation instruction executed by the user on each system;

A profile of the user is constructed according to the target operation activity and the target weight.

In one embodiment, obtaining the target operation activity of the user according to the operation time, operation frequency and sensitivity level of the user executing various operation instructions on each system includes:

According to multiple target operation logs, obtain the operation time, operation frequency and sensitivity level of the user performing any type of operation instruction on any system;

Performing dimensionless conversion on the operation time to obtain a time conversion value;

Performing dimensionless conversion on the operation frequency to obtain a frequency conversion value;

Performing a weighted summation on the maximum value of the moment conversion value, the frequency conversion value, and the sensitivity level to obtain the operation activity of the user executing any type of operation instruction on any system;

The average value of the operation activity of the user executing various types of operation instructions on each system is calculated to obtain the target operation activity of the user.

In one embodiment, the calculating of the target weights of the instruction category labels of the user's execution of various types of operation instructions on each system includes:

Calculating a ratio of the number of occurrences of any instruction category label corresponding to the user to the total number of occurrences of each instruction category label corresponding to the user in multiple target operation logs to obtain a first ratio;

Calculating a ratio of a total number of occurrences of each instruction category label corresponding to each user in the plurality of target operation logs to a total number of occurrences of any instruction category label corresponding to each user to obtain a second ratio;

Calculating the product of the first ratio and the second ratio to obtain an initial weight of any instruction category label;

According to the initial weight of any instruction category label and the instruction category to which it belongs, a target weight of any instruction category label is obtained.

In one embodiment, obtaining the target weight of any instruction category label according to the initial weight of any instruction category label and the instruction category to which it belongs includes:

If the instruction category to which any instruction category label belongs is the operation and maintenance deployment category, then the target weight of any instruction category label is obtained according to the initial weight and the target time difference; the target time difference is the time difference between the current time and the time when any instruction category label appears in the latest target operation log;

If the instruction category to which any instruction category label belongs is non-sensitive query, export and login, the initial weight is determined as the target weight of any instruction category label;

If the instruction category to which any instruction category label belongs is sensitive query, export and modification, then the target weight of any instruction category label is obtained based on the initial weight and the target number of times; the target number of times is the number of occurrences of any instruction category label in the period between the initial moment and the operation moment in the latest target operation log.

In one embodiment, the target operation log is obtained based on the following method:

If there is a sensitivity level in the operation log, the operation log is determined as an operation log to be processed;

If there is no sensitivity level in the operation log, inputting the operation log into a sensitivity level identification model to obtain a sensitivity level output by the sensitivity level identification model;

Adding the sensitivity level to the operation log to obtain an operation log to be processed;

Normalizing the operation log to be processed to obtain the target operation log;

The sensitivity level recognition model is obtained by training historical operation logs and their corresponding sensitivity level labels based on any classification model.

In one embodiment, the sensitivity level identification model is determined based on the following method:

Inputting the system data, operation instruction data and sensitivity level data in the first historical operation log set into any classification model, and obtaining the predicted sensitivity level corresponding to each first historical operation log output by any classification model;

A second historical operation log set is added, and the second historical operation log set is added to the first historical operation log set. The step of inputting the system data, operation instruction data and sensitivity level data in the first historical operation log set into any classification model is returned, until the overall accuracy of each predicted sensitivity level obtained from two consecutive trainings is greater than or equal to the accuracy threshold, and any classification model at this time is determined as a sensitivity level recognition model.

In one embodiment, performing dimensionless conversion on the operation time to obtain a time conversion value includes:

If the operation time is within the preset working period of the working day, converting the operation time into a first time conversion value;

If the operation time is within a non-preset working period of a working day, converting the operation time into a second time conversion value;

If the operation time is on the weekend, converting the operation time into a third time conversion value;

If the operation time is a holiday, converting the operation time into a fourth time conversion value;

The conversion value at the first moment is smaller than the conversion value at the second moment, the conversion value at the second moment is smaller than the conversion value at the third moment, and the conversion value at the third moment is smaller than the conversion value at the fourth moment.

In one embodiment, performing dimensionless conversion on the operation frequency to obtain a frequency conversion value includes:

If the operation frequency is less than or equal to a first frequency threshold, converting the operation frequency into a first frequency conversion value;

If the operation frequency is greater than the first frequency threshold and less than a second frequency threshold, converting the operation frequency into a second frequency conversion value;

If the operation frequency is greater than or equal to the second frequency threshold, converting the operation frequency into a third frequency conversion value;

The first frequency threshold is smaller than the second frequency threshold, the first frequency conversion value is smaller than the second frequency conversion value, and the second frequency conversion value is smaller than the third frequency conversion value.

In a second aspect, an embodiment of the present application provides a user portrait construction device, including:

The target operation activity calculation module is used to obtain the target operation activity of the user according to the operation time, operation frequency and sensitivity level of the user executing various operation instructions on each system;

A target weight calculation module is used to calculate the target weight of the instruction category label of each type of operation instruction executed by the user on each system;

The user portrait construction module is used to: construct a portrait of the user according to the target operation activity and the target weight.

In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory storing a computer program, wherein when the processor executes the program, the steps of the user portrait construction method described in the first aspect are implemented.

In a fourth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the user portrait construction method described in the first aspect.

In a fifth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium, including a computer program, which, when executed by a processor, implements the steps of the user portrait construction method described in the first aspect.

The user portrait construction method and device provided in the present application obtain the target operation activity of the user according to the operation time, operation frequency and sensitivity level of the user's execution of various operation instructions on various systems, calculate the target weight of the instruction category label of the user's execution of various operation instructions on various systems, and construct the user's portrait according to the target operation activity and target weight. On the one hand, the present application constructs the user portrait from two dimensions: the user's target operation activity and the target weight of various operation instructions, which can more comprehensively reflect the user's operation behavior and improve the accuracy of user portrait construction; on the other hand, the user's target operation activity is obtained through the user's operation time, operation frequency and the sensitivity level of the operation instruction, and the sensitivity level of the operation instruction is also taken into account in the process of user portrait construction, which is suitable for user operation behavior analysis scenarios involving data security, and further improves the accuracy of user portrait construction.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a flow chart of a method for constructing a user portrait according to an embodiment of the present application;

FIG2 is a second flow chart of a method for constructing a user portrait according to an embodiment of the present application;

FIG3 is a third flow chart of the method for constructing a user portrait provided in an embodiment of the present application;

FIG4 is a fourth flow chart of the method for constructing a user portrait provided in an embodiment of the present application;

FIG5 is a schematic diagram of the structure of a user portrait construction device provided in an embodiment of the present application;

FIG. 6 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

DETAILED DESCRIPTION

In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

FIG1 is a flow chart of a method for constructing a user portrait provided in an embodiment of the present application. Referring to FIG1 , an embodiment of the present application provides a method for constructing a user portrait, which may include:

101. Obtain the user's target operation activity according to the operation time, operation frequency and sensitivity level of the user's execution of various operation instructions on each system;

102. Calculate the target weight of the instruction category label of each type of operation instruction executed by the user on each system;

103. Build a profile of the user based on the target operation activity and target weight.

In step 102, all operation instructions executed by a single user on all systems have different categories. These operation instructions are classified and identified to obtain instruction category labels, and weights are set for these categories to represent the importance of the operation instruction category to the user's operation behavior.

In practical applications, there is no strict timing relationship between step 101 and step 102; that is, they can be executed simultaneously, or any one step can be executed first, depending on actual needs and is not limited here.

The user portrait construction method provided in this embodiment obtains the target operation activity of the user according to the operation time, operation frequency and sensitivity level of the user's execution of various operation instructions on each system, calculates the target weight of the instruction category label of the user's execution of various operation instructions on each system, and constructs the user's portrait according to the target operation activity and target weight. On the one hand, this embodiment constructs the user portrait from two dimensions: the user's target operation activity and the target weight of various operation instructions, which can more comprehensively reflect the user's operation behavior and improve the accuracy of user portrait construction; on the other hand, the user's target operation activity is obtained through the user's operation time, operation frequency and the sensitivity level of the operation instruction, and the sensitivity level of the operation instruction is also taken into account in the process of user portrait construction, which is suitable for user operation behavior analysis scenarios involving data security, and further improves the accuracy of user portrait construction.

FIG2 is a second flow chart of the user portrait construction method provided in an embodiment of the present application. Referring to FIG2, in one embodiment, according to the operation time, operation frequency and sensitivity level of the user executing various operation instructions on each system, the user's target operation activity is obtained, which may include:

201. Based on multiple target operation logs, obtain the operation time, operation frequency and sensitivity level of a user executing any type of operation instruction on any system;

202. Perform dimensionless conversion on the operation time to obtain a time conversion value;

203. Perform dimensionless conversion on the operation frequency to obtain a frequency conversion value;

204. Perform a weighted summation of the maximum value of the moment conversion value, the frequency conversion value, and the sensitivity level to obtain the operation activity of the user in executing the operation instruction of this type on the system;

205. Calculate the average value of the operation activity of the user executing various types of operation instructions on various systems to obtain the target operation activity of the user.

In step 201, each target operation log may include seven fields: user, operation time, system, operation instruction, sensitivity level, and instruction category label. For multiple target operation logs, multiple operation times of a single user executing any type of operation instruction on any system can be obtained.

For multiple target operation logs, the operation frequency may be determined according to the number of target operation logs in which the single user executes the type of operation instruction on the system.

The sensitivity level is related to the system and the category of operation instructions. Executing different categories of operation instructions on the same system or executing the same category of operation instructions on different systems may cause changes in the sensitivity level. However, when executing the same category of operation instructions on the same system, the sensitivity level is the only constant.

In step 202 and step 203, by performing dimensionless conversion on the operation time and the operation frequency, the operation time and the operation frequency can be converted into dimensionless expressions so that the two are converted into the same order of magnitude, which is convenient for subsequent calculation and analysis.

In step 204, since the sensitivity level is usually expressed as a dimensionless number, it can be calculated together with the converted operation time and operation frequency. Specifically, the operation activity A of any user executing any type of operation instruction on any system can be calculated according to the following formula:

A＝α*T+β*F+θ*S；

Among them, T is the maximum value of the moment conversion value, F is the frequency conversion value, S is the sensitivity level, α, β and θ are weight coefficients, and θ>α>β, α+β+θ=1. In this embodiment, α, β and θ can be set to 0.3, 0.2 and 0.5 respectively.

In step 205, the target operation activity of all users may be calculated according to the same method, and all users may be classified according to the target operation activity.

In practical applications, there is no strict timing relationship between step 202 and step 203; that is, they can be executed simultaneously, or any one of the steps can be executed first, depending on actual needs and is not limited here.

This embodiment makes the operation time, operation frequency and sensitivity level comparable by converting them to the same order of magnitude, so that the calculated operation activity of a user executing any type of operation instruction on any system is more accurate. At the same time, the target operation activity of the user is obtained by using the average value of the operation activity of the user executing various types of operation instructions on various systems, which balances the impact of the user executing all types of operation instructions on all systems, and can obtain a more accurate target operation activity.

FIG3 is a flowchart of the method for constructing a user portrait according to an embodiment of the present application. Referring to FIG3 , in one embodiment, calculating the target weight of the instruction category label of each type of operation instruction executed by the user on each system may include:

301. Calculate the ratio of the number of occurrences of any instruction category label corresponding to a user to the total number of occurrences of each instruction category label corresponding to the user in multiple target operation logs to obtain a first ratio;

302. Calculate the ratio of the total number of occurrences of each instruction category label corresponding to each user in the plurality of target operation logs to the total number of occurrences of the instruction category label corresponding to each user to obtain a second ratio;

303. Calculate the product of the first ratio and the second ratio to obtain an initial weight of the instruction category label;

304. Obtain a target weight of the instruction category label according to the initial weight of the instruction category label and the instruction category to which it belongs.

In step 301, each target operation log corresponds to an instruction category label, which is used to indicate the category of the operation instruction recorded in the target operation log. Specifically, the first ratio TF(p, L) can be calculated according to the following formula:

Among them, n(p,L) is the number of occurrences of the instruction category label L corresponding to user p, is the total number of occurrences of each instruction category label corresponding to user p, _Li is any instruction category label corresponding to user p, and _Lp is the set of instruction category labels corresponding to user p. The larger the value of TF(p,L), the closer the relationship between instruction category label L and user p.

In step 302, the second ratio IDF(p,L) can be calculated according to the following formula:

Among them, _pj is any user, is the total number of occurrences of each instruction category label corresponding to each user, It is the sum of the occurrence times of the instruction category label L corresponding to each user. The larger IDF(p,L) is, the more scarce the instruction category label L is.

In step 303, the initial weight W(p,L) of the instruction category label L can be calculated according to the following formula:

W(p,L)＝TF(p,L)*IDF(p,L);

In step 304, the specific method of obtaining the target weight of the instruction category label L is as follows:

1. If the instruction category to which the instruction category label L belongs is the operation and maintenance deployment category, the target weight of the instruction category label L is obtained according to the initial weight and the target time difference;

The target time difference is the time difference between the current time and the time when the instruction category label L appears in the latest target operation log.

The instruction category is operation and maintenance deployment, which means that the corresponding operation instruction is a necessary behavior within a certain period of time. Such operations will decay over time, that is, such operations will cool down with the target time difference. The target weight W _f (p, L) can be calculated according to the following formula:

W _f (p,L)=W(p,L)*exp(-μ*Δt);

Wherein, μ is the time attenuation coefficient, and 0<μ<1, which can be set according to actual conditions. In this embodiment, μ can be set to 0.5, and Δt is the target time difference.

It should be noted that as time goes by, the latest target operation log will be continuously updated, and Δt will also change. The target weight can be continuously updated accordingly to obtain a more accurate user portrait.

2. If the instruction category to which the instruction category label L belongs is non-sensitive query, export and login, the initial weight is determined as the target weight of the instruction category label L.

Non-sensitive query, export and login operations do not decay over time, so they do not need to be updated. The initial weight can be directly determined as the target weight of the instruction category label L.

3. If the instruction category label L belongs to the sensitive query, export and modification category, then the target weight of the instruction category label L is obtained according to the initial weight and the target number;

The target number is the number of occurrences of the instruction category label L in the period between the initial time and the operation time in the latest target operation log.

The instruction categories are sensitive query, export and modification, indicating that the sensitivity level of this type of operation is relatively high. Therefore, it is necessary to further analyze whether there are multiple such sensitive operations. If so, the target weight of the instruction category label L corresponding to this type of operation will increase with the number of times the user performs this type of sensitive operation. At this time, the target weight W _f (p, L) can be calculated according to the following formula:

W _f (p,L)=W(p,L)*(1+δ*Δd);

Wherein, δ is the thermal expansion coefficient, and 0<δ<1, which can be set according to actual conditions. In this embodiment, δ can be set to 0.5, and Δd is the target number.

It should be noted that as time goes by, the latest target operation log will be continuously updated, and Δd will also change. The target weight can be continuously updated accordingly to obtain a more accurate user portrait.

In practical applications, there is no strict timing relationship between step 301 and step 302; that is, they can be executed simultaneously, or any one of the steps can be executed first, depending on actual needs and is not limited here.

This embodiment utilizes the closeness between instruction category labels and users and the scarcity of the instruction category labels, combines the impact of time factors on various user operations and the sensitive nature of instruction categories, to obtain the target weights of each instruction category label, which can greatly improve the accuracy of the target weights, thereby improving the accuracy of subsequent user portrait construction.

FIG4 is a fourth flow chart of the method for constructing a user portrait provided in an embodiment of the present application. Referring to FIG4 , in one embodiment, the target operation log can be obtained based on the following method:

401. If there is a sensitivity level in the operation log, the operation log is determined as a pending operation log;

402. If the sensitivity level does not exist in the operation log, input the operation log into the sensitivity level recognition model to obtain the sensitivity level output by the sensitivity level recognition model;

403. Add the sensitivity level to the operation log to obtain the operation log to be processed;

404. Normalize the operation log to be processed to obtain a target operation log.

The sensitivity level recognition model is trained on the basis of any classification model through historical operation logs and their corresponding sensitivity level labels.

Operation logs normally contain sensitivity levels, but sometimes they are missing. In traditional data preprocessing, such operation logs may be filtered out as dirty data, and the log feature learning based on the filtered operation logs is incomplete.

In actual applications, there is no strict timing relationship between step 401 and step 402; that is, they can be executed simultaneously, or any one step can be executed first, depending on actual needs and is not limited here, but step 403 and step 404 must be executed sequentially after step 402.

In the case where the sensitivity level of the operation log is missing, this embodiment uses a sensitivity level identification model to identify the sensitivity level of such operation log, completes the log, and then normalizes it, so that the data in the operation log is at the same comparable order of magnitude. Ultimately, based on the complete log data, the user's target operation activity can be easily calculated to achieve user classification and better mine the user's operation behavior characteristics.

In one embodiment, the sensitivity level identification model is determined based on the following method:

The system data, operation instruction data and sensitivity level data in the first historical operation log set are input into any classification model to obtain the predicted sensitivity level corresponding to each first historical operation log output by the classification model, a second historical operation log set is added, the second historical operation log set is added to the first historical operation log set, and the step of inputting the system data, operation instruction data and sensitivity level data in the first historical operation log set into any classification model is returned until the overall accuracy of each predicted sensitivity level obtained by two consecutive trainings is greater than or equal to the accuracy threshold, and the any classification model at this time is determined as a sensitivity level recognition model.

Assume that the first historical operation log set is C ₁ ={log 1, log 2, …, log m}, its corresponding set of actual sensitivity levels is S ₁ ={S1, S2, …, Sm}, and its corresponding set of predicted sensitivity levels is X ₁ ={X1, X2, …, Xm}, then the similarity comparison between S ₁ and X ₁ is:

According to the above formula, the overall accuracy σ of each predicted sensitivity level obtained by first training the classification model using the first historical operation log set is:

After adding the second historical operation log set to the first historical operation log set, the classification model is trained for the second time, and the overall accuracy of each predicted sensitivity level obtained from the second training is calculated. If both are greater than or equal to the accuracy threshold, it means that the recognition effect of the classification model is good and the training can be stopped. If the overall accuracy of each predicted sensitivity level obtained from any training is less than the accuracy threshold, then in the next training, a new historical operation log set is added to the training set and then training is performed again until the overall accuracy of each predicted sensitivity level obtained from two consecutive trainings is greater than or equal to the accuracy threshold, and a sensitivity level recognition model is obtained.

It should be noted that the accuracy threshold can be set according to actual conditions and is not limited here. In this embodiment, it can be set to 90%.

This embodiment trains the classification model through the system data and operation instruction data with a high degree of correlation with the sensitivity level in the historical operation log set, and the corresponding sensitivity level data, and obtains the sensitivity level recognition model when the overall accuracy of the predicted sensitivity level obtained from two consecutive trainings is high. While ensuring the training efficiency, the sensitivity level recognition model has a strong recognition ability and can accurately identify the sensitivity level in the missing operation log.

In one embodiment, performing dimensionless conversion on the operation time to obtain the time conversion value may include:

If the operation time is within the preset working period of the working day, the operation time is converted to the first time conversion value;

If the operation time is within a non-preset working period of a working day, the operation time is converted into a second time conversion value;

If the operation time is on the weekend, the operation time is converted to the third time conversion value;

If the operation time is a holiday, the operation time is converted to the fourth time conversion value;

The conversion value at the first moment is smaller than the conversion value at the second moment, the conversion value at the second moment is smaller than the conversion value at the third moment, and the conversion value at the third moment is smaller than the conversion value at the fourth moment.

Among them, the first moment conversion value, the second moment conversion value, the third moment conversion value and the fourth moment conversion value can be set according to actual conditions and are not limited here. In this embodiment, the first moment conversion value can be set to 1, the second moment conversion value can be set to 2, the third moment conversion value can be set to 3, and the fourth moment conversion value can be set to 4.

In addition, it should be noted that if the time periods of a certain operation moment overlap, the larger conversion value is used as the conversion value of the operation moment. For example, if a certain operation moment is both on a weekend and on a holiday, since the conversion value corresponding to the holiday is higher, the operation moment is converted to the conversion value of the fourth moment.

Furthermore, dimensionless conversion is performed on the operation frequency to obtain a frequency conversion value, which may include:

If the operation frequency is less than or equal to the first frequency threshold, converting the operation frequency to the first frequency conversion value;

If the operation frequency is greater than the first frequency threshold and less than the second frequency threshold, the operation frequency is converted to the second frequency conversion value;

If the operation frequency is greater than or equal to the second frequency threshold, converting the operation frequency to a third frequency conversion value;

The first frequency threshold is smaller than the second frequency threshold, the first frequency conversion value is smaller than the second frequency conversion value, and the second frequency conversion value is smaller than the third frequency conversion value.

Among them, the first frequency threshold, the second frequency threshold, the first frequency conversion value, the second frequency conversion value and the third frequency conversion value can be set according to actual conditions and are not limited here. In this embodiment, the first frequency threshold can be 10, the second frequency threshold can be 50, the first frequency conversion value can be set to 1, the second frequency conversion value can be set to 2, and the third frequency conversion value can be set to 3.

Furthermore, the sensitivity level can be set according to actual conditions and is not limited here. In this embodiment, the sensitivity level can be set to four levels, 1, 2, 3 and 4, from non-sensitive to extremely sensitive.

This embodiment performs dimensionless conversion on the operation moment according to the time period in which it is located, and performs dimensionless conversion on the operation frequency according to the threshold division, and can reasonably convert the operation moment and the operation frequency to the same order of magnitude as the sensitivity level, so that the three have good comparability, which is helpful for subsequent calculation and analysis.

The user portrait construction device provided in an embodiment of the present application is described below. The user portrait construction device described below and the user portrait construction method described above can be referenced to each other.

FIG5 is a schematic diagram of the structure of a user portrait construction device provided in an embodiment of the present application. Referring to FIG5 , an embodiment of the present application provides a user portrait construction device, which may include:

The target operation activity calculation module 501 is used to obtain the target operation activity of the user according to the operation time, operation frequency and sensitivity level of the user executing various operation instructions on each system;

The target weight calculation module 502 is used to calculate the target weight of the instruction category label of each type of operation instruction executed by the user on each system;

The user portrait building module 503 is used to build a portrait of the user according to the target operation activity and the target weight.

The user portrait construction device provided in this embodiment obtains the target operation activity of the user according to the operation time, operation frequency and sensitivity level of the user's execution of various operation instructions on various systems, calculates the target weight of the instruction category label of the user's execution of various operation instructions on various systems, and constructs the user's portrait according to the target operation activity and the target weight. On the one hand, this embodiment constructs the user portrait from two dimensions: the user's target operation activity and the target weight of various operation instructions, which can more comprehensively reflect the user's operation behavior and improve the accuracy of user portrait construction; on the other hand, the user's target operation activity is obtained through the user's operation time, operation frequency and the sensitivity level of the operation instruction, and the sensitivity level of the operation instruction is also taken into account in the process of user portrait construction, which is suitable for user operation behavior analysis scenarios involving data security, and further improves the accuracy of user portrait construction.

In one embodiment, the target operation activity calculation module 501 is specifically used to:

According to multiple target operation logs, obtain the operation time, operation frequency and sensitivity level of the user performing any type of operation instruction on any system;

Performing dimensionless conversion on the operation time to obtain a time conversion value;

Performing dimensionless conversion on the operation frequency to obtain a frequency conversion value;

Performing a weighted summation on the maximum value of the moment conversion value, the frequency conversion value, and the sensitivity level to obtain the operation activity of the user executing any type of operation instruction on any system;

The average value of the operation activity of the user executing various types of operation instructions on each system is calculated to obtain the target operation activity of the user.

In one embodiment, the target weight calculation module 502 is specifically used to:

Calculating a ratio of the number of occurrences of any instruction category label corresponding to the user to the total number of occurrences of each instruction category label corresponding to the user in multiple target operation logs to obtain a first ratio;

Calculating a ratio of a total number of occurrences of each instruction category label corresponding to each user in the plurality of target operation logs to a total number of occurrences of any instruction category label corresponding to each user to obtain a second ratio;

Calculating the product of the first ratio and the second ratio to obtain an initial weight of any instruction category label;

According to the initial weight of any instruction category label and the instruction category to which it belongs, a target weight of any instruction category label is obtained.

In one embodiment, the target weight calculation module 502 is specifically used to:

If the instruction category to which any instruction category label belongs is the operation and maintenance deployment category, then the target weight of any instruction category label is obtained according to the initial weight and the target time difference; the target time difference is the time difference between the current time and the time when any instruction category label appears in the latest target operation log;

If the instruction category to which any instruction category label belongs is non-sensitive query, export and login, the initial weight is determined as the target weight of any instruction category label;

If the instruction category to which any instruction category label belongs is sensitive query, export and modification, then the target weight of any instruction category label is obtained based on the initial weight and the target number of times; the target number of times is the number of occurrences of any instruction category label in the period between the initial moment and the operation moment in the latest target operation log.

In one embodiment, a target operation log acquisition module (not shown in the figure) is further included, which is used to:

If there is a sensitivity level in the operation log, the operation log is determined as an operation log to be processed;

If there is no sensitivity level in the operation log, inputting the operation log into a sensitivity level identification model to obtain a sensitivity level output by the sensitivity level identification model;

Adding the sensitivity level to the operation log to obtain an operation log to be processed;

Normalizing the operation log to be processed to obtain the target operation log;

The sensitivity level recognition model is obtained by training historical operation logs and their corresponding sensitivity level labels based on any classification model.

In one embodiment, a sensitivity level identification model building module (not shown in the figure) is further included, which is used to:

Inputting the system data, operation instruction data and sensitivity level data in the first historical operation log set into any classification model, and obtaining the predicted sensitivity level corresponding to each first historical operation log output by any classification model;

A second historical operation log set is added, and the second historical operation log set is added to the first historical operation log set. The step of inputting the system data, operation instruction data and sensitivity level data in the first historical operation log set into any classification model is returned, until the overall accuracy of each predicted sensitivity level obtained from two consecutive trainings is greater than or equal to the accuracy threshold, and any classification model at this time is determined as a sensitivity level recognition model.

In one embodiment, the target operation activity calculation module 501 is specifically used to:

If the operation time is within the preset working period of the working day, converting the operation time into a first time conversion value;

If the operation time is within a non-preset working period of a working day, converting the operation time into a second time conversion value;

If the operation time is on the weekend, converting the operation time into a third time conversion value;

If the operation time is a holiday, converting the operation time into a fourth time conversion value;

The conversion value at the first moment is smaller than the conversion value at the second moment, the conversion value at the second moment is smaller than the conversion value at the third moment, and the conversion value at the third moment is smaller than the conversion value at the fourth moment.

In one embodiment, the target operation activity calculation module 501 is specifically used to:

If the operation frequency is less than or equal to a first frequency threshold, converting the operation frequency into a first frequency conversion value;

If the operation frequency is greater than the first frequency threshold and less than a second frequency threshold, converting the operation frequency into a second frequency conversion value;

If the operation frequency is greater than or equal to the second frequency threshold, converting the operation frequency into a third frequency conversion value;

The first frequency threshold is smaller than the second frequency threshold, the first frequency conversion value is smaller than the second frequency conversion value, and the second frequency conversion value is smaller than the third frequency conversion value.

FIG6 illustrates a schematic diagram of the structure of an electronic device. As shown in FIG6 , the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call a computer program in the memory 630 to execute the steps of the user portrait construction method, for example, including:

According to the operation time, operation frequency and sensitivity level of the user's execution of various operation instructions on each system, the target operation activity of the user is obtained;

Calculate the target weight of the instruction category label of each type of operation instruction executed by the user on each system;

A profile of the user is constructed according to the target operation activity and the target weight.

In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

On the other hand, an embodiment of the present application further provides a computer program product, the computer program product including a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can perform the steps of the user portrait construction method provided in the above embodiments, for example, including:

According to the operation time, operation frequency and sensitivity level of the user's execution of various operation instructions on each system, the target operation activity of the user is obtained;

Calculate the target weight of the instruction category label of each type of operation instruction executed by the user on each system;

A profile of the user is constructed according to the target operation activity and the target weight.

On the other hand, an embodiment of the present application further provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, wherein the computer program is used to enable the processor to execute the steps of the user portrait construction method provided in the above embodiments, for example, including:

According to the operation time, operation frequency and sensitivity level of the user's execution of various operation instructions on each system, the target operation activity of the user is obtained;

Calculate the target weight of the instruction category label of each type of operation instruction executed by the user on each system;

A profile of the user is constructed according to the target operation activity and the target weight.

The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims (12)

1.A user portrait construction method is characterized by comprising the following steps:

obtaining target operation activity of a user according to operation time, operation frequency and sensitivity level of the user for executing various operation instructions on each system;

calculating target weight of instruction class labels of various operation instructions executed by the user on each system;

and constructing the portrait of the user according to the target operation activity and the target weight.

2. The user portrait construction method according to claim 1, wherein the obtaining the target operation activity of the user according to the operation time, the operation frequency and the sensitivity level of the user to execute various operation instructions on each system includes:

According to the multi-item mark operation log, the operation time, the operation frequency and the sensitivity level of the user for executing any type of operation instruction to any system are obtained;

Performing dimensionless conversion on the operation time to obtain a time conversion value;

dimensionless conversion is carried out on the operation frequency to obtain a frequency conversion value;

The maximum value of the moment conversion value, the frequency conversion value and the sensitivity level are weighted and summed to obtain the operation activity of the user for executing any type of operation instruction on any system;

And calculating the average value of the operation liveness of the user for executing various operation instructions on each system to obtain the target operation liveness of the user.

3. The user portrait construction method according to claim 1, wherein calculating the target weights of instruction class labels of various operation instructions performed by the user on respective systems includes:

Calculating the ratio of the occurrence times of any instruction type label corresponding to the user to the sum of the occurrence times of all instruction type labels corresponding to the user in a multi-item label operation log to obtain a first ratio;

Calculating the ratio of the sum of the occurrence times of the instruction class labels corresponding to the users to the sum of the occurrence times of any instruction class label corresponding to the users in the multi-item label operation log to obtain a second ratio;

calculating the product of the first ratio and the second ratio to obtain the initial weight of the label of any instruction category;

And obtaining the target weight of any instruction category label according to the initial weight of any instruction category label and the belonging instruction category.

4. The user portrait construction method according to claim 3, wherein the obtaining the target weight of the arbitrary instruction class label according to the initial weight of the arbitrary instruction class label and the instruction class to which the arbitrary instruction class label belongs includes:

If the instruction category to which any instruction category label belongs is an operation and maintenance deployment category, obtaining a target weight of any instruction category label according to the initial weight and the target time difference; the target time difference is the time difference between the current time and the occurrence time of any instruction type label in the latest target operation log;

If the instruction category to which the arbitrary instruction category label belongs is a non-sensitive inquiry, export and login category, determining the initial weight as the target weight of the arbitrary instruction category label;

If the instruction category to which any instruction category label belongs is the class of the sensitive inquiry, the export and the modification, the target weight of any instruction category label is obtained according to the initial weight and the target times; the target number of times is the number of occurrences of the arbitrary instruction class label in a period between an initial time and an operation time in a latest target operation log.

5. A user portrayal construction method according to claim 2 or 3, characterized in that the target operation log is obtained on the basis of:

If the operation log has a sensitive level, determining the operation log as an operation log to be processed;

if the operation log does not have the sensitive level, inputting the operation log into a sensitive level identification model to obtain the sensitive level output by the sensitive level identification model;

adding the sensitivity level into the operation log to obtain an operation log to be processed;

normalizing the operation log to be processed to obtain the target operation log;

the sensitivity level identification model is obtained through training a historical operation log and a corresponding sensitivity level label on the basis of any classification model.

6. The user portrayal construction method according to claim 5, wherein the sensitivity level recognition model is determined based on:

inputting system data, operation instruction data and sensitivity level data in the first historical operation log set into any classification model to obtain a prediction sensitivity level corresponding to each first historical operation log output by any classification model;

Adding a second historical operation log set, adding the second historical operation log set to the first historical operation log set, returning to the step of inputting the system data, the operation instruction data and the sensitivity level data in the first historical operation log set into any classification model until the overall accuracy of each predicted sensitivity level obtained by continuous training is greater than or equal to an accuracy threshold value, and determining any classification model at the moment as a sensitivity level identification model.

7. The user portrait construction method according to claim 2, wherein the performing dimensionless transformation on the operation time to obtain a time transformation value includes:

If the operation time is in a preset working period of a working day, converting the operation time into a first time conversion value;

If the operation time is in a non-preset working period of a working day, converting the operation time into a second time conversion value;

If the operation time is on the weekend, converting the operation time into a third time conversion value;

If the operation time is in holidays, converting the operation time into a fourth time conversion value;

The first time instant conversion value is smaller than the second time instant conversion value, the second time instant conversion value is smaller than the third time instant conversion value, and the third time instant conversion value is smaller than the fourth time instant conversion value.

8. The user portrait construction method according to claim 2, wherein said dimensionless converting the operation frequency to obtain a frequency conversion value includes:

If the operation frequency is smaller than or equal to a first frequency threshold value, converting the operation frequency into a first frequency conversion value;

if the operation frequency is greater than the first frequency threshold and less than the second frequency threshold, converting the operation frequency into a second frequency conversion value;

If the operation frequency is greater than or equal to the second frequency threshold value, converting the operation frequency into a third frequency conversion value;

the first frequency threshold is smaller than the second frequency threshold, the first frequency conversion value is smaller than the second frequency conversion value, and the second frequency conversion value is smaller than the third frequency conversion value.

9. A user portrayal construction device comprising:

a target operation activity calculating module, configured to: obtaining target operation activity of a user according to operation time, operation frequency and sensitivity level of the user for executing various operation instructions on each system;

The target weight calculation module is used for: calculating target weight of instruction class labels of various operation instructions executed by the user on each system;

The user portrait construction module is used for: and constructing the portrait of the user according to the target operation activity and the target weight.

10. An electronic device comprising a processor and a memory storing a computer program, characterized in that the processor implements the steps of the user portrayal construction method according to any one of claims 1 to 8 when executing the computer program.

11. A computer program product comprising a computer program, characterized in that the computer program when executed by a processor implements the steps of the user portrayal construction method according to any one of claims 1 to 8.

12. A non-transitory computer readable storage medium having stored thereon a computer program, characterized in that the computer program when executed by a processor implements the steps of the user portrayal construction method according to any one of claims 1 to 8.