Internal threat detection system based on mining of business process model and detection method thereof

Abstract

The invention relates to an internal threat detection system based on mining of a business process model and a detection method thereof. The detection system comprises a model mining module, an abnormality detection module and an abnormality analysis model, wherein the model mining module implements model mining according to an event log of each business event in a business system, and thus acquires a business control flow model, a business performance model and an executor behavior model; the abnormality detection module detects logic abnormality, performance abnormality and behavior abnormality of the event log generated during a real-time operation process of a business activity according to the model mining module; and the abnormality analysis model parses a detection result of the abnormality detection module, recognizes execution information about implementation of an internal threat and outputs the information. According to the internal threat detection system based on mining of the business process model established in the invention, the internal threat behavior existing in the business execution process is effectively detected, a powerful support is provided for enterprises and various organizations to prevent the internal threat, and information security of enterprises and organizations is effectively ensured.

Description

technical field [0001] The invention belongs to the technical field of business process mining and network security, and in particular relates to an internal threat detection system and a detection method based on business process model mining. Background technique [0002] The rapid development of information technology has promoted the wide application of information systems in various enterprises and organizations. However, while information systems have improved work efficiency for these organizations, they have also introduced a large number of security loopholes, including both technical loopholes in software and hardware, and loopholes in internal personnel management. Compared with external network attacks caused by software and hardware vulnerabilities, internal threats caused by internal personnel management vulnerabilities are often more harmful and harder to detect. The main reasons for internal threats are as follows: first, some employees who lack security awa...

AI Technical Summary

Problems solved by technology

However, most business systems usually only consider how to ensure the normal realization of business functions at the beginning of design, and seldom consider the security of business activities, so they are very vulnerable to intentional or unintentional threats from insiders, making the business system abnormal , business activities cannot be carried out normally, and even lead to the destruction and leakage of key business data in serious cases

Traditional insider threat detection methods usually only consider the audit records of personnel behavior, and fail to combine personnel behavior and business activities for modeling, so the threat detection rate of existing methods needs to be improved

Images