User portrait method applied to field of network security

Abstract

The invention discloses a user portrait drawing method applied to the field of network security, which is used for drawing a user portrait in combination with natural attributes, operation behavior characteristics and data use habits of a user. On the basis of a traditional user portrait method based on statistics and rules, a machine learning method, such as semantic mining, time sequence fitting, clustering and correlation analysis, is added, a user behavior model is deeply mined and analyzed, and more accurate and effective anomaly detection capability is provided.

Description

technical field

[0001] The invention relates to the technical field of information security, in particular to a user portrait method applied in the field of network security. Background technique

[0002] The difficulty of user portraits lies in the modeling and analysis of large-scale historical data. There are two main difficulties, one is the collation and analysis of a large amount of semi-structured and unstructured data, and the other is the lack of in-depth insight into user operation behavior. A traditional user portrait method, mainly through simple statistics, counts some user attributes such as frequency, frequency, occurrence time period, etc., based on the assumption of normal distribution (although there is no proof that these attributes obey the normal distribution) , using the 3Sigma principle to identify samples that deviate significantly from the sample mean as anomalies. In addition, the traditional user portrait method focuses on the extraction and anal...

Images