Method and system for detecting abnormal service behaviors

Abstract

The invention provides a method for detecting abnormal service behaviors, which comprises the following steps of: establishing a model of normal service system access behaviors of users according to historical audit records prior to a current detection point of safety audit equipment; and analyzing real-time audit records of the safety audit equipment, comparing the real-time audit records with the normal behavior model, and judging whether the service access behaviors of the users are abnormal or not. The invention also provides a system for detecting abnormal service behaviors. The method and the system for detecting abnormal service behaviors can detect attack behaviors, which are legal in terms of service flow, but still bring about destruction to a service system actually, according to audit records of the safety audit equipment.

Description

A method and system for abnormal business behavior detection technical field The invention relates to the field of information security, in particular to a method and system for detecting abnormal business behavior. Background technique With the development of information technology, Internet-oriented business systems with database servers as the core have been increasingly widely used, such as online banking systems and electronic ticket booking systems. Since the key data of the business system is stored in the database server and is closely related to the entire business process, it is particularly important to ensure the information security of the database server. In order to better protect the database server, network security audit equipment has been widely used. It can monitor and record the user's access information to the server in real time, and once any illegal access behavior (such as unauthenticated access and unauthorized access) is found, the violation can...

AI Technical Summary

Problems solved by technology

This solution can detect some abnormal business behaviors, but it has the following deficiencies: First, relying on managers to formulate a complete set of security configuration rules is too cumbersome. Once an attack behavior not included in the rules occurs, it will lead to Secondly, some attack behaviors can

Images