Abnormal computer user behavior detection method

Abstract

The invention discloses an abnormal computer user behavior detection method comprising the steps of 1, preprocessing original data to remove repeated information and error information, and generate formative user identity information, object information, time information and behavior information; 2, performing normal user behavior modeling based on the user identity information, the object information, the time information and the behavior information to build a user behavior base line; 3, based on the user behavior base lien, matching user behaviors generated in real time, and detecting the abnormal user behavior; and 4, further adjusting the user behavior base line for the normal user behaviors generated in real time. According to the abnormal computer user behavior detection method provided by the invention, detection on the abnormal computer user behaviors is achieved.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a method for detecting abnormal behavior of computer users. Background technique [0002] An important means of data theft is that internal personnel leak secrets or steal intelligence by controlling internal assets. This is a malicious behavior hidden under "normal behavior", which is difficult to detect by traditional security protection and detection methods. [0003] The abnormal computer user behavior detection technology extracts user behavior models based on various user logs, and then conducts a comprehensive analysis of user behavior in the network to determine whether the user behavior is malicious, and finally forms an abnormal user behavior alarm, and technically blocks malicious behavior. . [0004] At present, the abnormal detection of computer user behavior mainly adopts the method based on rule matching. However, from the application point of view, the ...

AI Technical Summary

Problems solved by technology

[0005] The rule definition is difficult: the user needs to have very rich experience in rule configuration, and needs to be deeply integrated with the actual application of the user, and the operability is poor;

[0006] There are many false positives and false positives: the rules need to be updated in time, otherwise they will not be able to adapt to the latest user behavior situation, resulting in more false negatives and false negatives, which are difficult for administrators to handle

Images