An abnormal behavior detection method and device

Abstract

The embodiment of the invention discloses an abnormal behavior detection method and device, relates to the technical field of network security, and can perform association rule analysis and similaritymining on audit data of a user so as to timely discover abnormal behaviors of the user. The method comprises the following steps: carrying out data type conversion on acquired historical audit data to generate first data; Wherein the auditing data comprises at least one operation record of accessing the network by the user through the client, and the operation record comprises but is not limitedto one or more of the following items: a timestamp, a client IP address, a target network IP address and an operation type; Calculating the first data according to an association rule mining algorithmto generate a historical user association sequence; And performing similarity mining on the historical user association sequence and the acquired real-time audit data to generate a similarity score,and comparing the similarity score with a preset threshold value to determine whether the user operation has an abnormal behavior or not. The embodiment of the invention is applied to a network system.

Description

[0001] This application claims the priority of the Chinese patent application with the application number 201811528545.4 and the title of the invention "a method and device for detecting abnormal user behavior" submitted to the China Patent Office on December 13, 2018, the entire contents of which are incorporated herein by reference Applying. technical field [0002] Embodiments of the present invention relate to the field of communication technologies, and in particular, to a method and device for detecting abnormal behavior. Background technique [0003] With the development of network information technology, the network attacks faced by enterprises are also significantly increasing, the rapid development of business, the ever-changing distributed IT environment (on-premise, cloud, mobile) and the increasingly dispersed workforce. Nowadays, the concealment of network threats complicates compliance inspections, especially the changing unknown external attacks and unpredict...

AI Technical Summary

Problems solved by technology

Nowadays, the concealment of network threats complicates compliance inspections, especially the changing unknown external attacks and unpredictable internal threats, such as: saboteurs evade the control of the enterprise and bypass identity access control and various types of threat protection etc.

The existing technology solves this problem by setting thresholds to trigger alerts, but this method may cause enterprise security teams to be drowned in millions of alerts every day, so that alerts with real violations are not prioritized.

Images