Operation behavior recording method and system applied to operation behavior auditing system

Abstract

The invention provides an operation behavior recording method and system applied to an operation behavior auditing system. The system comprises a violation rule definition module, a violation rule account binding module, an account auditing policy definition module, an operation behavior content data acquisition module, an account violation rule acquisition module, a violation judgment module and an auditing data recording module. The operation behavior recording method and system have the advantages that (1) an operation behavior is judged from the fine grit to whether the content of a behavior is violated or not, and it is defined that different auditing policies are adopted when a violation behavior and a non violation behavior occur, so that compared with a conventional auditing operation system, on the premise of meeting auditing requirements, the recording quantity of auditing data can be remarkably reduced and the occupation of storage space is reduced; and (2) violation data and non violation data are stored by partitioning, so that the retrieval can be carried out more efficiently and the data retrieval efficiency can be improved.

Description

technical field [0001] The invention belongs to the technical field of operational behavior auditing, and in particular relates to an operational behavior recording method and system applied to an operational behavior auditing system. Background technique [0002] The operational behavior audit system is a system that protects the internal information security of the enterprise and prevents the leakage of the internal information of the enterprise. It brings security guarantees for banks, securities fund companies, telecommunications companies, secret-related units and other industries that require high security levels. [0003] In the traditional operational behavior auditing system, the recording strategy adopted is: record all captured operational behavior data, including application name, title metadata, application window content, and video frames when the operational behavior occurs. [0004] There are following deficiencies in the above-mentioned operation behavior da...

AI Technical Summary

Problems solved by technology

[0005] (1) When it is necessary to perform data search on the recorded operational behavior data, for example, when the system administrator searches the data for the purpose of locating the problem through the audit system, it needs to use a large number of retrieval operations, which occupies a large amount of time for the system administrator. time, has the problem of low search efficiency;

[0006] (2) Since the audit policy can only go to the application level for targeted storage settings, after specifying the audit policy of the application, a large amount of invalid data that the user does not want will also be recorded, occupying a large amount of storage space

Images