# US 2021/0240822 A1 · Abnormal User Identification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240822 A1
- Document ID: US20210240822A1
- Status: Published application
- Kind: A1
- Application number: 17/049,563
- Filed: 2019-05-09
- Published: 2021-08-05
- Earliest claimed: 2018-05-14
- Assignees: New H3C Security Technologies Co., Ltd.
- Applicants: New H3C Security Technologies Co., Ltd.
- Inventors: Chengjie Gu
- Web page: https://patentgrep.com/patent/US20210240822A1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 18/23213: with fixed number of clusters, e.g. K-means clustering
- G06F 18/24137: {Distances to cluster centroïds}
- G06F 18/2433: Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/101: {Access control lists [ACL]}
- G06F 2221/034: Test or assess a computer or a system
- H04L 63/102: {Entity profiles}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04W 12/68: Gesture-dependent or behaviour-dependent
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

User behavior data of multiple users is acquired, and multiple user eigenvalues of user behavior data of each user under preset multiple user behavior dimensions are extracted. A user eigenvector of each user is determined based on the multiple eigenvalues of this user. Multiple user classes are obtained by clustering the user eigenvectors of multiple users are clustered through a preset clustering algorithm. A central vector of each user class is determined based on the user eigenvectors included in this user class. A difference eigenvector of each user class is determined, wherein a distance between the difference eigenvector and a central vector of an aggregation class to which the difference eigenvector belongs is not within a preset distance range. A user characterized by the difference eigenvector is determined as an abnormal user.

## Claims

### Claim 1

An abnormal user identification method, comprising:
acquiring user behavior data of a user;
extracting multiple eigenvalues of the user behavior data under preset multiple behavior dimensions;
determining eigenvectors for the user behavior data based on the multiple eigenvalues;
obtaining multiple aggregation classes by clustering the eigenvectors through a preset clustering algorithm, and acquiring a central vector of each aggregation class;
determining a difference eigenvector, wherein a distance between the difference eigenvector and a central vector of an aggregation class to which the difference eigenvector belongs is not within a preset distance range; and
determining a user characterized by the difference eigenvector as an abnormal user.

### Claim 2 (depends on 1)

The method of claim 1, wherein when the user includes multiple users,
extracting multiple eigenvalues of the user behavior data under preset multiple behavior dimensions comprises:
extracting multiple user eigenvalues of user behavior data of each user under multiple user behavior dimensions;
determining eigenvectors for the user behavior data based on the multiple eigenvalues comprises:
determining a user eigenvector of each of the multiple users based on multiple user eigenvalues of this user;
obtaining multiple aggregation classes by clustering the eigenvectors through a preset clustering algorithm, and acquiring a central vector of each aggregation class, comprises:
obtaining multiple user classes by clustering the user eigenvectors of the multiple users through a preset clustering algorithm; and
determining a central vector of each of the multiple user classes based on a user eigenvector contained in this user class.

### Claim 3 (depends on 2)

The method of claim 2, wherein, obtaining multiple user classes by clustering the user eigenvectors of the multiple users through a preset clustering algorithm, comprises:
obtaining K initial user classes by clustering the user eigenvectors of the multiple users through a K-means clustering algorithm, wherein K is a positive integer;
acquiring a first initial user class and a second initial user class in the K initial user classes;
obtain a combined initial user class by combining the first initial user class and the second initial user class;
obtaining multiple user classes by taking the combined initial user class and other initial user classes that are not combined in the K initial user classes respectively as clustered user classes;
wherein, the first initial user class is an initial user class, in the K initial user classes, in which the number of user eigenvectors is less than a preset number threshold;
the second initial user class is an initial user class in the K initial user classes, wherein the distance between a central vector of this initial user class and a central vector of the first initial user class is minimum.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
obtaining multiple distances by calculating a distance between central vectors of any two user classes in the multiple user classes;
determining a first user class and a second user class characterized by a minimum distance of the multiple distances;
acquiring a first aggregate value of a user eigenvector contained in each of the multiple user classes;
when the first user class and the second user class are taken as a combined user class, acquiring second aggregate values of user eigenvectors contained in the combined user class, and acquiring a second aggregate value of a user eigenvector contained in each user class in the multiple user classes except the combined user class;
obtaining a first sum value by performing a summation operation on the multiple first aggregate values;
obtaining a second sum value by performing a summation operation on the multiple second aggregate values;
when the second sum value is less than the first sum value, combining the first user class and the second user class;
wherein the aggregate value represents a reasonable degree that a user eigenvector belongs to a user class.

### Claim 5 (depends on 1)

The method of claim 1, when the user includes one user, the user behavior data contains at least one piece of historical user behavior data and one piece of current user behavior data;
extracting multiple eigenvalues of the user behavior data under preset multiple user behavior dimensions comprises:
extracting multiple first data eigenvalues of each piece of historical user behavior data under the multiple user behavior dimensions, and multiple second data eigenvalues of the current user behavior data under the multiple user behavior dimensions;
determining eigenvectors for the user behavior data based on the multiple eigenvalues comprises:
determining a first data eigenvector of each piece of historical user behavior data based on the multiple first data eigenvalues, and a second data eigenvector of the current user behavior data based on the multiple second data eigenvalues;
obtaining multiple aggregation classes by clustering the eigenvectors through a preset clustering algorithm, and acquiring a central vector of each aggregation class, comprises:
obtaining multiple data classes by clustering the multiple first data eigenvectors and the second data eigenvector through a preset clustering algorithm; and
determining a central vector of a first data class to which the second data eigenvector belongs;
determining a difference eigenvector, comprises:
determining whether a distance between the second data eigenvector and the central vector of the first data class is within a preset distance range; and
if the distance is not within a preset distance range, determining the second data eigenvector as a difference eigenvector.

### Claim 6 (depends on 5)

The method of claim 5, wherein, obtaining multiple data classes by clustering the multiple first data eigenvectors and the second data eigenvector through a preset clustering algorithm, comprises:
obtaining K initial data classes by clustering the multiple first data eigenvectors and the second data eigenvector through a K-means clustering algorithm, wherein K is a positive integer;
acquiring a first initial data class in the K initial data classes, wherein, the first initial data class contains N data eigenvectors, and N is a positive integer;
if N is less than a preset number threshold, acquiring a second initial data class in the K initial data classes;
obtaining a combined initial data class by combining the first initial data class and the second initial data class;
obtaining multiple data classes by taking the combined initial data class and other initial data classes that are not combined in the K initial data classes respectively as clustered data classes;
wherein, the first initial data class is an initial data class to which the second data eigenvector belongs;
the second initial data class is an initial data class in the K initial user classes, wherein the distance between a central vector of this initial data class and a central vector of the first initial user class is minimum.

### Claim 7 (depends on 6)

The method of claim 6, wherein the method further comprises:
obtain multiple distances by calculating a distance between a first central vector of the first data class and a second central vector, which is a central vector of any data class in the multiple data classes except the first data class;
determining a second data class characterized by the minimum distance of the multiple distances;
acquiring a third aggregate value of a data eigenvector contained in each of the multiple data classes;
when the first data class and the second data class are taken as a combined data class, acquiring fourth aggregate values of data eigenvectors contained in the combined data class, and acquiring a fourth aggregate value of a data eigenvector contained in each data class in the multiple data classes except the combined data class;
obtaining a third sum value by performing a summation operation on the multiple third aggregate values;
obtaining a fourth sum value by performing a summation operation on the multiple fourth aggregate values;
when the fourth sum value is less than the third sum value, combining the first data class and the second data class;
wherein the aggregate value represents a reasonable degree that a data eigenvector belongs to a data class.

### Claim 8 (depends on 2)

The method of claim 2, determining a user characterized by the difference eigenvector as an abnormal user comprises:
determining whether a data eigenvalue for the difference eigenvector exceeds a preset baseline eigenvalue based on each of the multiple user behavior dimensions; and
if the data eigenvalue exceeds the preset baseline eigenvalue, determining that a user behavior characterized under the user behavior dimension is an abnormal user behavior, and that a user characterized by the difference eigenvector is an abnormal user.

### Claim 9

An electronic device, comprising a processor and a machine readable storage medium which stores machine executable instructions that can be executed by the processor, wherein, the machine executable instructions cause the processor to:
acquire user behavior data of a user;
extract multiple eigenvalues of the user behavior data under preset multiple behavior dimensions;
determine eigenvectors for the user behavior data based on the multiple eigenvalues;
obtain multiple aggregation classes by clustering the eigenvectors through a preset clustering algorithm, and acquire a central vector of each aggregation class;
determine a difference eigenvector, wherein a distance between the difference eigenvector and a central vector of an aggregation class to which the difference eigenvector belongs is not within a preset distance range; and
determine a user characterized by the difference eigenvector as an abnormal user.

### Claim 10 (depends on 9)

The device of claim 9, wherein when the user includes multiple users, the machine executable instructions cause the processor to:
extract multiple user eigenvalues of user behavior data of each of the multiple users under multiple user behavior dimensions;
determine a user eigenvector of each of the multiple users based on multiple user eigenvalues of this user;
obtain multiple user classes by clustering the user eigenvectors of the multiple users through a preset clustering algorithm; and
determine a central vector of each of the multiple user classes based on a user eigenvector contained in this user class.

### Claim 11 (depends on 10)

The electronic device of claim 10, wherein, the machine executable instructions cause the processor to:
obtain K initial user classes by clustering the user eigenvectors of the multiple users through a K-means clustering algorithm, wherein K is a positive integer;
acquire a first initial user class and a second initial user class in the K initial user classes;
obtain a combined initial user class by combining the first initial user class and the second initial user class;
obtain multiple user classes by taking the combined initial user class and other initial user classes that are not combined in the K initial user classes respectively as clustered user classes;
wherein, the first initial user class is an initial user class, in the K initial user classes, in which the number of user eigenvectors is less than a preset number threshold;
the second initial user class is an initial user class in the K initial user classes, wherein the distance between a central vector of this initial user class and a central vector of the first initial user class is minimum.

### Claim 12 (depends on 9)

The electronic device of claim 9, when the user includes one user, the user behavior data contains at least one piece of historical user behavior data and one piece of current user behavior data;
the machine executable instructions cause the processor to:
extract multiple first data eigenvalues of each piece of historical user behavior data under the multiple behavior dimensions, and multiple second data eigenvalues of the current user behavior data under the multiple behavior dimensions;
determine a first data eigenvector of each piece of historical user behavior data based on the multiple first data eigenvalues, and a second data eigenvector of the current user behavior data based on the multiple second data eigenvalues;
obtain multiple data classes by clustering the multiple first data eigenvectors and the second data eigenvector through a preset clustering algorithm;
determine a central vector of a first data class to which the second data eigenvector belongs;
determine whether a distance between the second data eigenvector and the central vector of the first data class is within a preset distance range;
if the distance is not within a preset distance range, determine the second data eigenvector as a difference eigenvector.

### Claim 13 (depends on 12)

The electronic device of claim 12, wherein, the machine executable instructions cause the processor to:
obtain K initial data classes by clustering the multiple first data eigenvectors and the second data eigenvector through a K-means clustering algorithm, wherein K is a positive integer;
acquire a first initial data class in the K initial data classes, wherein, the first initial data class contains N data eigenvectors, and N is a positive integer;
if N is less than a preset number threshold, acquire a second initial data class in the K initial data classes;
obtain a combined initial data class by combining the first initial data class and the second initial data class;
obtain multiple data classes by taking the combined initial data class and other initial data classes that are not combined in the K initial data classes respectively as clustered data classes;
wherein, the first initial data class is an initial data class to which the second data eigenvector belongs;
the second initial data class is an initial data class, in the K initial user classes, whose central vector has a minimum distance from a central vector of the first initial user class.

### Claim 14 (depends on 10)

The electronic device of claim 10, wherein,
the machine executable instructions cause the processor to:
determine whether a data eigenvalue for the difference eigenvector exceeds a preset baseline eigenvalue based on each of the multiple user behavior dimensions; and
if the data eigenvalue exceeds the preset baseline eigenvalue, determine that a user behavior characterized under the user behavior dimension is an abnormal user behavior, and that a user characterized by the difference eigenvector is an abnormal user.

### Claim 15 (depends on 1)

A non-transitory machine readable storage medium,
which stores machine executable instructions that, when called and executed by a processor, cause the processor to perform the method of claim 1.

### Claim 16 (depends on 5)

The method of claim 5, determining a user characterized by the difference eigenvector as an abnormal user comprises:
determining whether a data eigenvalue for the difference eigenvector exceeds a preset baseline eigenvalue based on each of the multiple user behavior dimensions; and
if the data eigenvalue exceeds the preset baseline eigenvalue, determining that a user behavior characterized under the user behavior dimension is an abnormal user behavior, and that a user characterized by the difference eigenvector is an abnormal user.

### Claim 17 (depends on 12)

The electronic device of claim 12, wherein, the machine executable instructions cause the processor to:
determine whether a data eigenvalue for the difference eigenvector exceeds a preset baseline eigenvalue based on each of the multiple user behavior dimensions; and
if the data eigenvalue exceeds the preset baseline eigenvalue, determine that a user behavior characterized under the user behavior dimension is an abnormal user behavior, and that a user characterized by the difference eigenvector is an abnormal user.