User behavior detection method and device
A detection method and behavior technology, applied in the field of information security, can solve the problems of low false positive rate, high false negative rate, lack of flexibility and initiative, etc., to reduce the false positive rate and false negative rate, and improve the recognition efficiency Effect
Active Publication Date: 2020-09-22
BEIJING QIANXIN TECH
View PDF4 Cites 0 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
[0005] In actual operation, the "whitelist strategy" and "blacklist strategy" have their own advantages and disadvantages. The "whitelist strategy" has a low false negative rate, but a high false positive rate; the blacklist strategy has a low false positive rate, but malicious behaviors Variety, most of them are not collected in the behavior pattern library, so the false negative rate is correspondingly high
However, no matter adopting "white list policy" or "black list policy", a large amount of manual participation is required in the process of policy formulation and management, and with the increase of malicious behavior types, the burden on network administrators will also become heavier , the false positive rate of the "white list policy" will gradually increase, and the false negative rate of the "black list policy" will gradually increase. Therefore, the management method based on security policies lacks flexibility and initiative in actual operation
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0055]Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0056] refer to figure 1 , which shows a flow chart of the steps of an embodiment of a method for detecting user behavior according to an embodiment of the present application, which may specifically include the following steps:
[0057] Step 101, obtaining the behavior similarity between the current user and other users;
[0058] In the embodiment of the present application, the behavior similarity is a measure of the similarity b...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
Embodiments of the invention provide a user behavior detection method and device. The method comprises the steps of obtaining behavior similarity between a current user and other users; determining one or more target users according to the behavior similarity; calculating a probability value of a current behavior of the current user by adopting the behavior similarity between the current user andthe one or more target users; and detecting the current behavior according to the probability value. According to the embodiment of the invention, the behavior of the target user having high similarity with the current user is analyzed; the current behavior of the current user is detected without depending on manual analysis and other behavior feature libraries, the user behavior can be automatically analyzed, internal threats and abnormal behaviors can be found, the abnormal behavior recognition efficiency is improved, and the false alarm rate and missing report rate of the abnormal behaviorsare reduced.
Description
[0001] This application is a divisional application of the patent application with the application number 201710668128.9, the application date is 2017.08.07, and the invention title is "a method and device for detecting user behavior". technical field [0002] The present application relates to the technical field of information security, in particular to a method for detecting user behavior, a device for detecting user behavior, a method for generating a user similarity data table, and a device for generating a user similarity data table. Background technique [0003] With the rapid development of Internet technology, anomaly detection has become an important and urgent problem in the field of network security. In the past few decades, due to the rampant and flooding of DDoS (Distributed Denial of Service, distributed denial of service attacks), viruses, Trojan horses, crawlers and other attacks, detection technologies for these intrusions have become more and more abundant....
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More Patent Type & Authority Applications(China)
IPC IPC(8): G06F21/55G06F21/56G06F16/903
CPCG06F21/55G06F21/56G06F16/90335Y02D10/00
Inventor 王占一韩琳谢军平
Owner BEIJING QIANXIN TECH