A system and method for insider threat detection based on embedded learning of heterogeneous temporal events

Abstract

The invention relates to an internal threat detection system and method based on heterogeneous time sequence event embedded learning. The internal threat detection system comprises a user heterogeneous time sequence event acquisition module, a data preprocessing module, a heterogeneous time sequence event embedded learning module and a user heterogeneous time sequence event sequence anomaly evaluation and internal threat output module. The internal threat detection system and method are realized through four processes of collecting heterogeneous time sequence events of users in organizations or enterprises, filtering and denoising data, embedding entities contained in the heterogeneous time sequence events, estimating the probability of heterogeneous time sequence event sequences and outputting internal threats. According to the internal threat detection method, a plurality of entities of five heterogeneous time sequence events including a user host login event, a file access event, amail communication event, a web browsing event and a mobile device connection event are comprehensively analyzed, so that user behaviors are comprehensively described, and the accuracy of system detection is improved, and the false alarm rate of system detection is reduced; besides, the internal threat detection system calculates the probability of the heterogeneous time sequence event sequence through interaction of the embedded vector and the context vector of the entity, so that the detection process does not depend on priori knowledge of domain experts, and the intelligence of the system is improved.

Description

technical field [0001] The invention relates to an internal threat detection system and method based on embedded learning of heterogeneous time series events, belonging to the technical field of information security. Background technique [0002] Insider threats are malicious internal users who take advantage of their own privileges to access an organization's network, systems, and data, and compromise the confidentiality, integrity, and availability of organizational information [1]. Detecting insider threats is a top priority in achieving comprehensive protection for your organization. [0003] Since internal users understand the organization's network structure and security defense mechanisms, malicious activities of internal users may be very hidden, making it difficult to detect. Some insider threat detection methods model the normal user behavior model by analyzing a separate event type, such as detection methods based on system calls [2], detection methods based on k...

AI Technical Summary

Problems solved by technology

However, feature engineering-based methods rely on expert prior knowledge and can only detect known types of insider threats

Images