Deep learning is applied in abnormal behavior recognition for data security protection

Abstract

In the context of the widespread deployment of cloud computing and the Internet of Things, enterprise business systems are constantly exposed to the open network environment. Abnormal behavior identification has become a crucial link in the data security protection chain. Based on multi-source security logs and behavior sequence data, a deep learning anomaly identification model integrating embedded representation, bidirectional recurrent networks/Transformer encoding, attention weighting, and adaptive threshold control was constructed. An adversarial perturbation constraint and security interval loss were introduced to form a robust training framework. At the same time, an anomaly behavior interpretation and rule extraction mechanism based on attention weights and gradient contributions was designed to achieve a closed loop from model output to security policy generation. Experiments were conducted using approximately 3.2 million real business log data covering over 8,000 accounts and 1,200 hosts. Compared with rule detection, Isolation Forest, and ordinary sequence models, the proposed method achieved better performance in terms of F1 value (0.90) and AUC (0.94), with a false alarm rate reduced to 0.05. This validates the effectiveness of deep learning technology in improving the accuracy and stability of abnormal behavior identification in data security protection scenarios, providing a method reference for building interpretable and scalable intelligent security protection systems in complex business environments.