User risk assessment method and system based on network security device log data

Abstract

The invention discloses a user risk degree evaluation method and system based on log data of network security equipment. The method comprises steps of extracting a user dangerous behavior list from the user behaviors and the enterprise specifications; extracting dangerous behavior characteristics of the user from data such as a network security equipment user log according to the dangerous behavior list; training a Gaussian mixture model on each dangerous behavior of the user according to the dangerous behavior characteristics of the user, obtaining a user risk grading probability set, designing a user risk grading probability fusion method based on an evidence fusion theory, and determining whether the user has a behavior abnormal risk or not according to a risk probability fusion resultof the user. The method is simple to implement and low in calculation complexity, can effectively reduce the calculation resource overhead of behavior analysis in the user log, does not need any additional mark, only needs the data automatically recorded by the network security equipment, has the advantages of practical application, provides a risk degree evaluation method for unifying different user standards, and carries out decision-making judgment on high-risk users needing early warning at the same time.

Description

technical field [0001] The invention belongs to the technical field of data mining, and in particular relates to a user risk evaluation method and system based on network security device log data. Background technique [0002] Due to the importance of the enterprise cloud platform, each enterprise will choose to deploy it behind a security device when building a cloud platform to protect it from attacks from the external network. However, security devices cannot detect the abnormal access behaviors of internal users who have been allowed to enter, such as user account abuse, user unauthorized access, and users' unauthorized access to and modification of important data. These abnormal behaviors have extremely high risks for the enterprise cloud platform, and once they occur, they will bring immeasurable serious consequences and economic losses to the enterprise. [0003] Although network security devices cannot detect abnormal behaviors of internal users, they can comprehens...

AI Technical Summary

Problems solved by technology

However, the security device cannot detect abnormal access behaviors of internal users who have been allowed to enter, such as user account abuse, user unauthorized access, and users' unauthorized access to and modification of important data.

These abnormal behaviors have extremely high risks for the enterprise cloud platform, and once they occur, they will bring immeasurable serious consequences and economic losses to the enterprise

Images