Interpretable internal threat assessment method

Abstract

The invention discloses an interpretable internal threat assessment method. The objective of the invention is to solve the problem that a result cannot be explained when a neural network performs threat assessment on to-be-tested data. Based on the sequence generation model, the heterogeneous data is processed through the simple Cartesian product, frequency statistics and the adjacent matrix, so that the user behavior sequence with high data utilization rate and behavior coverage rate is generated, the data redundancy is greatly reduced, and the data processing speed is increased. Meanwhile, based on an interpretable threat assessment method, an assessment result can be interpreted, so that an internal manager is assisted to perform threat review, and the threat review is used as a data set updated by the assessment model, thereby meeting the adaptability change of the assessment model and improving the detection precision of threat assessment.

Description

Technical field [0001] The present invention relates to the field of anomaly detection, in particular to an internal threat assessment method based on interpretability. Background technique [0002] In recent years, with the rapid development of information technology, more and more government agencies and enterprises are vigorously promoting informatization construction, and the resulting problems such as information leakage, privacy violations and property losses have also become more and more serious. serious. In order to reduce the economic losses caused by network security, enterprises and companies have invested a lot of money to deploy security products such as firewalls, anti-virus software, and intrusion detection systems. However, such measures can only resist external attacks from the Internet, and are difficult to play a role in attacks from within the organization. How to effectively deal with internal threats has become an urgent problem to be solved. [0003] In o...

AI Technical Summary

Problems solved by technology

[0009] In order to better solve the problem of inexplicability and low adaptability of the insider threat detection model when dealing with heterogeneous data, the present invention proposes an explainable-based insider threat assessment method

Images