Abnormal detection method and system for application access behavior

Abstract

The embodiment of the invention provides an application access behavior anomaly detection method and system. The method comprises the following steps of obtaining the access data of a first user to each application in a period to be detected; according to the history data of the first user, correlating the access data of the user in the period to be detected and the access data of the first user to each application in the period to be detected, and respectively calculating the access deviation degree of the first user to each application ; calculating an application access outlier value of thefirst user according to an access deviation degree of the first user to each application and an importance degree of each application; if the application access outlier value of the first user is greater than the preset threshold value, determining that the application access behavior of the first user is abnormal in the period to be detected. Deviation degree calculation and weighted outlier calculation can successfully detect whether users apply abnormal access behavior, and the detected data source does not rely on too much access behavior factors and complex exception detection mechanism,thereby being simple and fast to reduce the data leakage.

Description

technical field [0001] The present invention implements the technical field of data security, and in particular relates to a method and system for detecting abnormal application access behaviors. Background technique [0002] With the deepening of information production in various industries, various information resources are stored, managed and analyzed and displayed in different application systems, such as office automation OA system, customer relationship management CRM system, enterprise resource planning ERP system, etc. It greatly improves the working efficiency of the staff. At the same time, these systems store a wealth of unit production materials and personal confidential information, and behaviors such as abnormal access related to application systems occur from time to time, especially internal personnel of the unit may use their legitimate application access rights to implement illegal Operations, such as leaking production materials, employee or customer info...

AI Technical Summary

Problems solved by technology

[0004] However, the management mode of the existing technology can only be implemented in the application system with the authority distribution module on the one hand, and on the other hand, it cannot prevent the personnel with the access authority from performing illegal operations, or the account of the personnel with the access authority is maliciously stolen Used for malicious access to application resources

Moreover, the application access-related factors that can be collected by the existing technology are incomplete, or it is difficult to form a reasonable and complete security management threshold, so it is also difficult to find out the abnormal personnel with application access behavior by setting a complex security model

Images