User portrait grouping and behavior analysis method and system based on log data of network security equipment

Abstract

The invention discloses a user portrait grouping and behavior analysis method and system based on log data of network security equipment. The method mainly comprises the following steps: 1) extractingfeatures from data such as user logs of the network security equipment; 2) carrying out preprocessing and data analysis on the features to obtain relationships between the features and relationshipsbetween the features and user behaviors; 3) constructing a clustering model of the user groups according to the user characteristics; 4) establishing a user portrait according to the clustering model,and determining whether the user has abnormal behaviors or not according to a matching result of the user characteristics and the user portrait; the method is simple to implement and low in calculation complexity; the computing resource overhead of behavior analysis in the user log can be effectively reduced. Compared with the prior art, the invention does not need any additional mark, only needsthe data automatically recorded by the network security equipment, has the advantages of practical application, provides a user grouping method and a portrait matching method with different behaviormodes, and carries out decision-making judgment on whether the user behavior is abnormal or not.

Description

technical field [0001] The invention belongs to the technical field of data mining, and in particular relates to a user portrait grouping and behavior analysis method and system based on network security device log data. Background technique [0002] Due to the importance of the enterprise cloud platform, each enterprise will choose to deploy it behind a security device when building a cloud platform to protect it from attacks from the external network. However, security devices cannot detect the abnormal access behaviors of internal users who have been allowed to enter, such as user account abuse, user unauthorized access, and users' unauthorized access to and modification of important data. These abnormal behaviors have extremely high risks for the enterprise cloud platform, and once they occur, they will bring immeasurable serious consequences and economic losses to the enterprise. [0003] Although network security devices cannot detect abnormal behaviors of internal us...

AI Technical Summary

Problems solved by technology

However, the security device cannot detect abnormal access behaviors of internal users who have been allowed to enter, such as user account abuse, user unauthorized access, and users' unauthorized access to and modification of important data.

These abnormal behaviors have extremely high risks for the enterprise cloud platform, and once they occur, they will bring immeasurable serious consequences and economic losses to the enterprise

Images