Research On Key Technologies For Behavior Analysis Of Network Users

The Internet is profoundly influencing and changing people's daily life with the advent of the "Internet".The number of Internet users also shows a surging trend.In particular,"WeChat","Weibo" and other social media tools have become very popular.Internet users are not only consumers of network information,but also creators of network information.Therefore,how to better serve network users and effectively manage and supervise network users' behaviors has become a hot issue that the government,enterprises,and academia focus on.Network user behavior analysis refers to the statistics and analysis of users' online data,and discovers the regularity of network user behavior.Through user behavior analysis,operators can improve network service quality and prevent network attacks;content providers can provide personalized services and provide public opinion detection and analysis for user preferences.Now network user behavior analysis has attracted more and more attention.A great number of scholars have carried out a large number of related research work by means of statistical methods,data mining,machine learning and deep learning,and achieved fruitful results.However,with the expanding of network application environment and the evolution,the demand of the network user behavior analysis also presents the diversified characteristics,using isolated and static properties of traditional method to discribe,network user behavior often leads to user behavior data split and unable to effectively adapt to the increasingly complex network application environment.Therefore,from the characteristics of network users' behaviors,this paper deeply explores the internal relations,laws and statistical characteristics between network users' behaviors and network application scenarios,and carries out the following work:(1)A clustering method with automatic tagging for user behavior analysis is proposed.The current user behavior clustering methods are analyzed,and pointed out that they are not universal and cannot support large-scale dynamic data.Most clustering algorithms need to determine the size of user behavior data in advance,and focus more on the clustering effect,but less on the meaning of clusters generated after clustering.In order to solve these problems,this paper combines the relevant features of user behavior data with the clustering analysis process,and applies the Latent Factor Model(LFM)and matrix decomposition methods to propose a clustering label scheme,which can automatically generate the cluster label while clustering user behavior data,that is,clustering user behavior data.The resulting clusters give more explicit semantics.AP clustering algorithm and DP-means clustering algorithm are used to test the scheme.The results show that the scheme can generate cluster labels simultaneously in the process of clustering under the condition of uncertain size of user behavior data,and the effect of clustering and the accuracy of label semantics can meet the needs of practical application.The validity and universality of the scheme are proved.(2)The prediction model of web user browsing behavior based on statistical method is proposed.The traditional user browsing behavior prediction method less considers the multidimensional relationship between mathematical model,user browsing behavior,website hierarchical structure,prediction accuracy and system efficiency,resulting in complex modeling process,low system efficiency and poor support for large-scale dataset and other issues.In order to solve such problems and analyze the hierarchical structure characteristics of websites,the Inverted Index Structure based on Hash Table(IIS-HT)was designed,and the Index Structure was used to improve the data preprocessing speed.Based on IIS-HT,the prediction model of web user browsing behavior based on the Markov model and the Bayesian theorem is designed in combination with hierarchical thinking.Finally,the experimental analysis of the model is carried out through the actual data.The results show that the model can effectively reduce the number of candidate web pages required in the prediction and improve the prediction efficiency under the premise of appropriate prediction accuracy.Therefore,the model has the characteristics of simple modeling process,high system processing efficiency and support for large-scale data sets.(3)Database user behavior anomaly detection model based on Principal Component Analysis(PCA)was proposed.At present,there are few detection methods for internal attacks and threats in database systems,and the existing methods have low detection accuracy and cannot support the problem of dynamic database update.For this reason,the existing database user behavior anomaly detection methods are analyzed and studied in depth,and the existing problems and shortcomings are pointed out.Therefore,considering the detection accuracy and the dynamic update of the database in terms of generality,the existing "grammar-based"method and the "context-based" method in database user behavior anomaly detection are combined to design a more a versatile PCA-based database user behavior anomaly detection model.For PCA in the database user behavior anomaly detection problems existing in the application process,using the LOO(Leave-One-Out)method to improve PCA,then using the improved PCA method to extract data the user's behavior characteristic,thus constructing a database user behavior anomaly detection model based on PCA,the examination process of the model and model framework,and the price of the model are analyzed.Finally,the performance of the model is tested using the relevant data.The results show that the model can detect the abnormal behavior of database users with high accuracy.(4)The Distributed Denial of Service(DDoS)attack behavior detection method based on user behavior is proposed.For HTTP DDoS attacks,existing methods have high detection model complexity and do not support user dynamic behavior patterns when detecting HTTP abnormal requests.For this reason,the Discrete-time Markov Chain with states of variable-length sequences(DTMC-SVLS)was used to analyze the user behavior during the HTTP DDoS attack.The HTTP request sequence of users was analyzed as behavior characteristics and the behavior characteristics of normal users and detecting users were extracted using DTMC-SVLS,and the two kinds of users were compared.If the deviation degree of the two exceeded the specified threshold,the behavior was judged abnormal.In order to verify the validity of this method,the HTTP DDoS attack data was simulated and tested experimentally.The test results show that the modeling complexity is controllable,and the high detection accuracy is guaranteed under the premise of supporting the user's dynamic behavior mode requirements.