A Multi-Angle Semantic Feature Fusion Method for Web User Behavior Anomaly Detection

To address the increasing complexity of web user behavior anomaly detection and the issue of missing semantic information caused by relying solely on features like request semantics or request sequences, this study proposes a multi-angle semantic feature fusion approach for user behavior anomaly detection. The research is based on user sessions. Firstly, by analyzing the access sequence behavior within user sessions and utilizing an improved SimHash algorithm, sequence features are extracted to model browsing patterns. Secondly, combining the semantic content contained in user sessions, a multi-attention Transformer model is employed to extract semantic features, representing user visit semantics. Finally, an end-to-end model is constructed to fuse sequence and semantic features, enabling effective detection of user behavior anomalies. Experimental results demonstrate that the proposed model exhibits excellent performance and stability in detection accuracy, with significant effects in real-world anomaly user identification. As the proportion of anomalous sessions increases, precision, recall, and F1-score also improve, all reaching 99%. Even when anomalous sessions are scarce in the dataset, the model still achieves satisfactory detection results.