Abnormal behavior detection method, electronic device and non-transient computer-readable storage medium

An electronic device, comprising:

• at least one memory configured to store computer-executable instructions;
• and
• at least one processor configured to execute the computer-executable instructions stored in the memory,
• wherein the computer-executable instructions, when executed by the at least one processor, causes the at least one processor to perform a method, which comprises:
• collecting a set of behaviors to be detected that belong to a same session within a preset time window;
• labeling each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and acquiring label features of the set of behaviors to be detected according to labels of all behaviors in the set of behaviors to be detected;
• mapping, according to a preset embedded feature extracting model, the label features of the set of behaviors to be detected into embedded features;
• and
• determining, based on the embedded features of the set of behaviors to be detected and embedded features of a pre-acquired set of historical behaviors, whether there is abnormality in the set of behaviors to be detected.

A non-transient computer-readable storage medium, having stored therein computer-executable instructions which, when executed by a processor, cause the processor to perform a method, wherein the method comprises:

• collecting a set of behaviors to be detected that belong to a same session within a preset time window;
• labeling each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and acquiring label features of the set of behaviors to be detected according to labels of all behaviors in the set of behaviors to be detected;
• mapping, according to a preset embedded feature extracting model, the label features of the set of behaviors to be detected into embedded features;
• and
• determining, based on the embedded features of the set of behaviors to be detected and embedded features of a pre-acquired set of historical behaviors, whether there is abnormality in the set of behaviors to be detected.