Intranet user abnormal behavior identification method and device, computer equipment and readable storage medium

Abstract

The embodiment of the invention provides an intranet user abnormal behavior recognition method and device based on density clustering, computer equipment and a computer readable storage medium. The embodiment of the invention belongs to the technical field of safety monitoring. The method includes: obtaining user data of an intranet user, wherein the user data comprises a network access log and attendance data; according to the user data, describing behavior portraits of the intranet users by taking a preset time period as a time slice; obtaining a plurality of feature data sets of the time sequence; clustering the feature data set through a preset density clustering model; obtaining clustering results, judging whether outliers exist in a clustering result or not; if the outliers exist inthe clustering result, determining that the outliers exist. Compared with safety monitoring of daily behaviors of the intranet users through entity monitoring rules in the prior art, the method and device have the advantages that the recognition efficiency, accuracy and comprehensiveness of the abnormal behaviors of the intranet users can be improved, and risk behaviors of the intranet users in enterprises are avoided.

Description

technical field [0001] The present application relates to the technical field of security monitoring, and in particular to a method, device, computer equipment, and computer-readable storage medium for identifying abnormal behaviors of intranet users based on density clustering. Background technique [0002] In the business operations of enterprises, such as production, sales, and research and development, various enterprise data will be generated. For enterprise data, it is generally necessary to take security protection measures to prevent enterprise data from being lost or leaked. Data security incidents cause losses to the enterprise. [0003] For enterprise data security, there are two risks. On the one hand, there are external risks. External personnel enter the enterprise through various means, obtain enterprise data or destroy enterprise data, cause enterprise data loss or leakage, and lead to enterprise data security incidents. The other is the internal risk of th...

AI Technical Summary

Problems solved by technology

[0005] The embodiment of the present application provides a method, device, computer equipment, and computer-readable storage medium for identifying abnormal behaviors of intranet users based on density clustering, which can solve the abnormalities of intranet users that pose security risks to enterprise data in traditional technologies The problem of low behavior recognition rate

Images