User action monitoring system and method based on IP address attribute

Abstract

The invention discloses user action monitoring system and method based on an IP address attribute. The monitoring of the user action is completed by coordinating four parts of an off-line basic data acquiring data, an on-line data real-time analysis module, a data centre and an analysis module. The method comprises the following steps of: firstly proposing a concept of a significant IP address and acquiring the significant IP address by using a combined method of active and passive monitoring; and then proposing to use a service type and a geographic position as attributes of the IP address, and building an IP address attribute information library by combining the screened significant IP address. In order to comprehensively reflect the characteristic of a network user action, the characteristics of user action on the time and the space can be described by using multiple action maps, and the analysis of characteristics, such as aggregation, association, similarity, periodicity, migration, and the like, of the user action can be realized on the basis of building the action maps to further know demands and access characteristics of the network users, and the monitoring to network access is effectively enhanced.

Description

technical field [0001] The invention relates to the fields of network communication security and user behavior monitoring, in particular to a user behavior monitoring system and method based on IP address attributes. Background technique [0002] Internet applications have become an important way of people's daily life, and many foreign studies have been conducted on users' network behavior. As early as January 1994, an organization in the United States conducted preliminary statistical analysis on World Wide Web users and their usage behavior. Using a variety of methods such as sound thinking, experimentation, and system log analysis, it explores the performance, strategies, and influencing factors of various network user behaviors, and builds a special network behavior model. A large part of the research on network user behavior is carried out for specific user groups, and the research user groups are mainly teachers and students in the education field. Tillotson and oth...

AI Technical Summary

Problems solved by technology

This classification method is only classified through the connection relationship, and its information source has no actual physical meaning

[0008] 4) Classification method based on network measurement: This type of method mainly divides users into users who use the network for more than 8 hours a day on average, and users who use the network for 8-4 hours a day on average by measuring the amount of traffic generated when users use the network. Users who use the Internet for an average of 4-1 hours a day and users who use the Internet for an average of less than an hour a day, this classification method can only distinguish the frequency of users using the Internet, but does not involve specific service types

[0011] Classification Information Source Classification purpose Evaluation Application Layer Based Approach various statistics Predict the direction of network development Classification workload is huge port based address address, port information intrusion detection Only for abnormal users Based on network layer IP correspondence Detect similar users The data source has no actual physical meaning Web-based measurement Network traffic user monitoring Classification is too simple

Images