Internal threat real-time detection method based on agent

Abstract

The invention discloses an internal threat real-time detection method based on an agent, belongs to the technical field of information system security and aims at ensuring the internal network data security through adoption of a detection assembly based on an agent technology. The internal threat real-time detection method based on the agents comprises the specific steps that a client agent program is installed, before a user accesses service data on a database server host, the agent program judges an identity and authority of the user, and only the user passing through authentication can access data; in a process of processing licensed service data by the user, the agent program monitors behaviors of the user in real time and records the behaviors of the user in a log file; and after the user finishes processing the licensed service data, the agent program calls a corresponding signing mechanism according to a demand of the user to sign a part processed the user, so the modification of the user for the service data has non-repudiation.

Description

technical field [0001] The invention specifically relates to an Agent-based real-time detection method for internal threats, which belongs to the technical field of information system security. Background technique [0002] Among the various security threats faced by information systems, although the number of internal threats is far less than that of external attacks, the losses and harms caused are greater. In recent years, the WikiLeaks incident has once again aroused widespread attention from all walks of life to the issue of insider threats. The endless incidents of insider threats have made this topic enduring. Because internal employees know better than external personnel which data is worth stealing and which data is not valuable after being stolen. Moreover, internal malicious operations are more likely to be ignored by enterprise organizations. Therefore, the internal threat problem has gradually become the focus of research by security experts at home and abroad...

AI Technical Summary

Problems solved by technology

In these studies, without exception, prior knowledge of malicious internal users is the premise. Only by fully mastering the knowledge of internal attackers can it be possible to detect resource abuse. However, in practical applications, before successful detection Obtaining the attacker's prior knowledge is a difficult problem, so the practicality of these methods is difficult to guarantee

Images