A method and device for identifying abnormal user behavior

An identification method and abnormal technology, which is applied in the field of computer security, can solve problems such as inability to accurately monitor user abnormal behaviors and fail to meet actual needs, and achieve the effect of fast recognition speed and high recognition accuracy

Active Publication Date: 2021-12-24
华青融天(北京)软件股份有限公司
View PDF6 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

However, due to the variability and complexity of user behavior, that is, user behavior will change with changes in job content, user interests, working hours, and other uncertain factors.
Therefore, the traditional method based on the hard rule table cannot accurately monitor the user's abnormal behavior and cannot meet the actual needs

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • A method and device for identifying abnormal user behavior
  • A method and device for identifying abnormal user behavior
  • A method and device for identifying abnormal user behavior

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0051]In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only It is a part of the embodiments of this application, not all of them. The components of the embodiments of the application generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations. Accordingly, the following detailed description of the embodiments of the application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without ...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The present application provides a method and device for identifying abnormal user behavior, which relate to the technical field of computer security. The method includes: obtaining multiple different historical command records of users with the same behavior; any historical command record includes multiple commands; According to the user's corresponding behavior characteristics, extract the keyword commands in multiple historical command records; determine the keyword according to the word frequency of the keyword command in the corresponding historical command records and the inverse document word frequency of the keyword command in all historical command records The word frequency feature of the command; determine the abnormal historical command record according to the word frequency feature of the keyword command. The user's abnormal behavior can be identified through the keyword commands that characterize the user's behavior characteristics in the user's historical command records, and the identification of the user's abnormal behavior with variability and complexity can be realized. Moreover, the method of dimensionality reduction and clustering processing is adopted for the word frequency features of keyword commands, so the recognition speed is fast and the recognition accuracy is high.

Description

technical field [0001] The present application relates to the technical field of computer security, in particular, to a method and device for identifying abnormal user behavior. Background technique [0002] In an actual computer network system, generally there are multiple legal users, and the legal users can perform business operations in the computer network system based on their own operation rights. Usually, it is necessary to monitor the behavior of legitimate users in the computer network system to detect whether there are abnormal behaviors, so as to prevent other users from using the accounts of these legitimate users to perform illegal operations. [0003] At present, the method of detecting whether there is abnormal behavior in the computer network system is as follows: usually first formulate a rule table containing many illegal and sensitive words, and identify the abnormality in user behavior by matching the user behavior with the rules of the rule table Behav...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & AuthorityPatents(China)
IPC IPC(8): H04L29/06G06F16/35
CPCH04L63/101H04L63/1416
Inventor张佳苏禹磨
Owner华青融天(北京)软件股份有限公司