Insider threat detection method and system based on user subjective and objective data fusion

Abstract

The invention discloses an internal threat detection method and system based on user subjective and objective data fusion. The invention provides the subjective element data reflecting the individualcharacteristics such as the working attitude and the life pressure on the basis of only auditing a user system and network behavior data originally, then provides two data fusion modes of fusion modeand prediction mode starting from the user subjective and objective element data, and then analyzes and detects the internal threat comprehensively through the fusion of the subjective element data reflecting the intensity of the user attack motivation and the objective element data reflecting the user system and the network behavior, therefore, the high false reports and missing reports of simpleanomaly detection is reduced effectively; meanwhile, the invention provides a method to establish the abnormal internal threat characteristics of each attack links based on the characteristics of theinternal threat attack chain, therefore, the real-time update ability of the internal threat detection system is improved.

Description

technical field [0001] The invention belongs to the technical field of network information security management and control, and relates to an internal threat detection method and system based on fusion of user subjective and objective data. Background technique [0002] With the development of the network, the security of network information has attracted more and more attention from the society, and various anti-virus software, firewalls, intrusion detection and other security products have been widely used. However, these information security products are only to defend against external intrusion and theft. With the development of people's awareness of network security and technology, it is found that leaks and intrusions caused by insiders account for a large proportion, such as Snow in 2013. The "Prism Gate" incident is a typical security case of insiders leaking secrets. Therefore, dealing with internal threats should be given the same attention as defending against ex...

AI Technical Summary

Problems solved by technology

High false positives lead to low alarm quality. On the one hand, analysts cannot fully analyze, and on the other hand, system availability is reduced, and the detection system is useless; high false negatives directly make security defenses invalid, causing enterprises or organizational assets to fall into high risks.

High false positives and high false negatives are the main key factors restricting the practicability of insider threat detection systems

Images