Method and system for detecting threats in network and electronic device

Abstract

The invention provides a method and system for detecting threats in a network and an electronic device. The method comprises: on the basis of different characteristics of user behavior data, multi-dimensionality detection is carried out on the user behavior data based on multi-domain behavior driving and time behavior driving; according to an entropy weight method, an abnormal score value based onmulti-domain behavior driving and an abnormal score value based on time behavior driving in the multi-dimensionality detection result are fused and thus a threat in a network is determined. Therefore, universality of the operation process is improved effectively; the time complexity and space complexity of the operation are reduced; and thus the costs are lowered.

Description

Technical field [0001] The present invention relates to the technical field of network information security, and more specifically, to a method, system and electronic equipment for detecting network internal threats. Background technique [0002] In the field of information security, the losses caused by internal threats are far greater than the losses caused by external threats, and internal threats are more likely to cause data leakage problems. Compared with external threats, internal threats require more time to resolve. [0003] The malicious activities used by insider threats are usually carried out in the following stages: the cracker enters the system or network; the cracker investigates the nature of the system or network in order to understand the vulnerable places and the locations that can cause the most damage with the least effort; establish a work area, Malicious activities are carried out in it; finally, actual destructive actions are carried out. [0004] Existing ...

AI Technical Summary

Problems solved by technology

[0006] However, in the construction of user behavior patterns, most of the existing methods are to find a basic user portrait in the behavior of all users, compare each user with this basic user portrait, and if the difference is large, it will be identified as a threat user

This modeling method is based on multi-domain behavior drivers, and it is difficult to detect malicious users

This type of insider threat agent disguises himself as the same as the surrounding users and hides his threat identity, which is difficult to be detected by this model

[0007] In addition, the time-based behavior-driven model mainly detects whether the current behavior is malicious based on the user's previous historical behavior. Although it can detect the threat actor in disguise, it cannot perform long-term modeling, that is, long-term user In fact, the behavior will also change normally according to the needs of the business or the transfer of positions, which will cause misjudgment of threats

Images