计算机科学与探索 ›› 2021, Vol. 15 ›› Issue (5): 838-847.DOI: 10.3778/j.issn.1673-9418.2005018

• 学术研究 • 上一篇    下一篇

使用GNN与RNN实现用户行为分析

王晓东,赵一宁,肖海力,王小宁,迟学斌   

  1. 1. 中国科学院 计算机网络信息中心,北京 100190
    2. 中国科学院大学,北京 100049
  • 出版日期:2021-05-01 发布日期:2021-04-30

User Behavior Analysis with RNN and Graph Neural Networks

WANG Xiaodong, ZHAO Yining, XIAO Haili, WANG Xiaoning, CHI Xuebin   

  1. 1. Computer Network Information Center, Chinese Academy of Sciences, Beijing 100190, China
    2. University of Chinese Academy of Sciences, Beijing 100049, China
  • Online:2021-05-01 Published:2021-04-30

摘要:

随着国家高性能计算环境(CNGrid)各个节点产生日志数量不断增加,采用传统的人工方式进行用户行为分析已不能满足日常的分析需求。近年来,深度学习在入侵检测、图像识别、自然语言处理和恶意软件检测等与计算机科学相关的关键任务中取得了良好的效果。演示了如何将深度学习模型应用于用户行为分析。为此,在CNGrid中对用户行为进行分类,提取大量绑定到会话的用户操作序列,然后将这些序列放入抽象的深度学习模型中。提出了一种基于图神经网络(GNN)和循环神经网络(RNN)的深度学习模型来预测用户行为。图神经网络能够捕捉用户局部行为的隐藏状态,可以作为预处理步骤。循环神经网络能够捕捉时间序列的信息。因此,通过将GNN和RNN相结合的方式来构建该模型,以获得两者的优点。为了验证模型的有效性,在CNGrid的真实用户行为数据集上进行了实验,并在实验中与多种不同的其他方法进行对比。实验结果证明了这种新的深度学习模型的有效性。

关键词: 用户行为分析, 图神经网络(GNN), 循环神经网络(RNN)

Abstract:

With the increasing amount of logs produced by nodes in CNGrid (China National Grid), traditional manual methods for user behavior analysis can no longer meet the need of daily analysis. In recent years, deep learning has shown good results in key tasks related to computer sciences, such as intrusion detection, image recognition, natural language processing and malware detection. This paper demonstrates how to apply deep learning models to user behavior analysis. To this end, this paper classifies user behavior in CNGrid and extracts a large number of user operation sequences bounded to sessions. These sequences are put into deep learning models.  This paper proposes a deep learning model that combines recurrent neural network (RNN) with graph neural network (GNN) to predict the user behavior. Graph neural network can catch the hidden state of the user’s local behavior, so it can be used as preprocessing. Recurrent neural network can catch the message of time sequence. The model is built by combining GNN and RNN to acquire both advantages. In order to verify the effectiveness of the model, this paper conducts experiments of the real user behavior datasets on CNGrid and compares them with a variety of other methods. Experimental results demonstrate the effectiveness of this novel deep learning model.

Key words: user behavior analysis, graph neural network (GNN), recurrent neural network (RNN)