Network user behavior risk assessment method based on AHP

Abstract

The invention discloses a network user behavior risk assessment method based on AHP. The method comprises the steps that an integral user behavior risk is decomposed layer by layer through analytic hierarchy process (AHP) according to the practical application requirements and the functional characteristics, the comprehensive and general user behavior risk is decomposed into a plurality of behavior risk attributes, then the behavior risk attributes continue to be refined into behavior risk evidence which can be directly measured by software and hardware, and a comprehensive risk value is obtained finally. According to the method, for intrusion routes of APT attacks, risk assessment is conducted on network user behaviors by starting with personal online behavior data analyzing and mining, intrusion of APT attack initiators is monitored from the source, and the APT attack monitoring and defending purposes are achieved.

Description

technical field [0001] The invention relates to the field of network user behavior risk assessment, in particular to an AHP-based network user behavior risk assessment method. Background technique [0002] 1. The danger of APT attacks [0003] APT attacks are generally professional or even organized and national-backed hackers, an attack method launched against important targets and systems. The main features are: [0004] 1) Terminal nature: Although the attacker's attack target is for important assets, the starting point is the terminal, and the terminal must be accessed by people. However, in a large organization, it is difficult to guarantee everyone's security capabilities and security awareness All are of a high standard. Therefore, it is much more difficult to do a good job of terminal protection for everyone than server-side protection. If you attack the WEB server through SQL injection, you generally hope to use it to attack the end users who use these WEB servers...

AI Technical Summary

Problems solved by technology

[0007] 4) Unknownness: The attacker constructs a special code to trigger the attack based on the targeted security vulnerability found, according to the application itself, and writes a special Trojan horse that meets his own attack target but can bypass the existing defender detection system. These 0DAY vulnerabilities and special Trojans are unknown to defenders or protection systems

Especially for our country, which is in a period of rapid development, once a hostile force or organization spends a high cost to carry out a targeted APT attack against our country's important information system and succeeds, the harm caused will be incalculable

Images