Method and device for identifying abnormal behavior of user

An identification method and abnormal technology, which is applied in the field of computer security, can solve problems such as inability to accurately monitor user abnormal behaviors and fail to meet actual needs, and achieve the effect of fast recognition speed and high recognition accuracy

Active Publication Date: 2019-03-19
华青融天(北京)软件股份有限公司
View PDF6 Cites 9 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

However, due to the variability and complexity of user behavior, that is, user behavior will change with changes in job content, user interests, working hours, and other uncertain factors.
Therefore, the traditional method based on the hard rule table cannot accurately monitor the user's abnormal behavior and cannot meet the actual needs

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method and device for identifying abnormal behavior of user
  • Method and device for identifying abnormal behavior of user
  • Method and device for identifying abnormal behavior of user

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0051]In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only It is a part of the embodiments of this application, not all of them. The components of the embodiments of the application generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations. Accordingly, the following detailed description of the embodiments of the application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without ...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The application provides a method and a device for identifying an abnormal behavior of a user, which relate to the technical field of computer security. The method comprises the following steps: acquiring a plurality of different history command records of users with the same behavior; wherein any one of the history command records comprises a plurality of commands; deriving keyword commands in aplurality of history command records according to behavior characteristics corresponding to the users; determining the word frequency characteristics of the keyword commands according to the word frequency in the history command records of the keyword commands and the inverse document word frequency of the keyword command in all history command records; determining abnormal history command recordsaccording to the word frequency characteristics of the keyword commands. The abnormal behavior of the user is identified by the keyword command that characterizes the user behavior in the history command records of the user, so that the abnormal behavior of the user with variability and complexity can be identified. Moreover, the method of performing dimension reduction and clustering process onthe word frequency characteristics of the keyword commands is adopted, so that the identification speed is fast and the identification accuracy is high.

Description

technical field [0001] The present application relates to the technical field of computer security, in particular, to a method and device for identifying abnormal user behavior. Background technique [0002] In an actual computer network system, generally there are multiple legal users, and the legal users can perform business operations in the computer network system based on their own operation rights. Usually, it is necessary to monitor the behavior of legitimate users in the computer network system to detect whether there are abnormal behaviors, so as to prevent other users from using the accounts of these legitimate users to perform illegal operations. [0003] At present, the method of detecting whether there is abnormal behavior in the computer network system is as follows: usually first formulate a rule table containing many illegal and sensitive words, and identify the abnormality in user behavior by matching the user behavior with the rules of the rule table Behav...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & AuthorityApplications(China)
IPC IPC(8): H04L29/06G06F16/35
CPCH04L63/101H04L63/1416
Inventor张佳苏禹磨
Owner华青融天(北京)软件股份有限公司