基于深度神经网络的企业信息系统用户异常行为预测

Research on User Abnormal Behavior Prediction of Enterprise Information System Based on Deep Neural Networks

随着企业信息化水平的不断提高,企业核心业务越来越依赖于信息系统的可靠运行,任何信息系统用户进行的异常操作都可能给企业带来不可估量的损失。企业更加重视用户异常行为可能对企业造成的负面影响,如何有效预测企业信息系统的异常行为成为当前的研究问题。设计企业信息系统用户异常行为的预测框架,明确企业信息系统用户异常行为的界定标准,基于用户日志数据,在已有研究基础上加入业务维度构建特征模型,采用深度神经网络方法进行用户异常行为预测。通过与经典统计方法和传统机器学习方法对比进行模型评估,以某船舶企业为例进行实验分析,初步验证该预测框架的有效性。研究结果表明,加入业务特征后的特征模型整体表现更好,召回率、查准率和AUC分别提高3. 52%、2. 16%和3. 36。基于数据驱动的深度神经网络模型可以层层抽取用户异常行为的抽象特征,提高各个特征对异常行为预测的效率。与多重线性回归方法相比,深度神经网络的召回率和查准率分别提高16. 49%和7. 46%;与支持向量机算法相比,召回率、查准率和AUC分别提高3. 09%、5. 09%和0. 08。进一步比较3个部门的模型发现,在与企业业务直接相关的业务部门和职能部门,用户异常行为能被更好地识别出来,而信息部门的分类效果欠佳。研究结果为企业提供了一种可能适用于企业信息系统用户异常行为的预测框架,有助于企业对用户异常行为进行预测,从而及时采取措施以降低用户异常行为可能对企业造成的负面影响。

With the continuous improvement of enterprise informatization,its core business is increasingly dependent on the reliable operation of information system. For enterprises,any abnormal operation performed by information system users may bring inestimable losses to them. The enterprise pays more and more attention to the negative impact that the user’s abnormal behavior may have on the enterprise. How to effectively predict the abnormal behavior of enterprise information system is our research question.To address this need,the study designs a prediction framework for the abnormal behavior of enterprise information system users: firstly,the definition standard of abnormal behavior of enterprise information system users is defined;then,with the user log data,we add the business dimension to build the feature model based on previous research,and use the deep neural network method to predict the abnormal behavior of users;finally,the model is evaluated by comparing with classic statistical method and traditional machine learning method. Taking a shipbuilding enterprise as an example,the effectiveness of our prediction framework is preliminarily verified.The research results show that the overall performance of the feature model becomes better after adding business features. In addition,the data-driven deep neural network model can extract abstract features of users’ abnormal behaviors layer by layer,improving the efficiency of each feature in predicting abnormal behavior. Compared with multiple linear regression,the recall rate and precision rate of deep neural networks increased by 16. 49% and 7. 46% respectively;compared with support vector machine,the recall rate,precision rate and AUC increased by 3. 09%,5. 09% and 0. 08,respectively. A further comparison of the models of the three departments found that in the business departments and functional departments directly related to the business of the enterprise,the abnormal behavior of users can be better identified,while the classification effect of the information department is not good.The research results provide a prediction framework that may be applicable to the abnormal behavior of enterprise information system users. The feature model is built by integrating the extant research and business-oriented features of enterprise information system,and the deep neural network method is selected for model training,which improves the accuracy of prediction. This also helps enterprises to predict the abnormal behavior of users,so that timely measures can be taken to reduce the negative impact of abnormal user behavior on the enterprise.