Detection method, system and device for detecting abnormal behaviors of user and storage medium

Abstract

The invention provides a detection method, system and device for detecting abnormal behaviors of a user and a storage medium, and the method comprises the steps: converting a user behavior log into adiscrete symbol sequence; abstracting the user behavior log into a user behavior sub-graph according to the symbol sequence; and performing sub-graph mining on the user behavior sub-graph to obtain anabnormal behavior coefficient, and judging whether the user behavior log is abnormal or not according to the abnormal behavior coefficient. According to the detection method provided by the invention, consistency description is carried out on a large number of heterogeneous user behavior logs existing in an enterprise, fusion of heterogeneous information is achieved, and then a graph mining algorithm is utilized to detect abnormal behaviors of internal users. The complementarity among the user behavior logs can be effectively found and utilized, so that the behavior of the user is reflected from different sides, and the anomaly detection and identification are more accurate and effective. Meanwhile, the automatic detection method reduces the manual detection cost, and greatly improves thedetection efficiency.

Description

Technical field [0001] The present invention relates to the field of computer technology, and more specifically, relates to a method, system, device, and storage medium detecting user abnormal behavior. Background technique [0002] As the infrastructure of social operation, the Internet has now touched all corners of the world, making it an indispensable part of social exchange, learning, enterprise development, national security. With the rapid development of network technology, the network size is increasing, and network security issues are increasing. Existing network security measures are mainly concerned about external attacks, and the abnormal behavior of internal users within the enterprise is relatively small. Especially for the banking industry, internal employees have the opportunity to contact customers, funds, etc., once internal employees lead to sensitive information leakage, data loss, etc., will cause huge economies to customers, enterprises. Loss and harsh socia...

AI Technical Summary

Problems solved by technology

Existing network security protection measures mainly focus on external attacks, but pay less attention to abnormal behaviors of internal users

Especially for the banking industry, internal employees have the opportunity to access core information such as customers and funds. Once internal employees operate maliciously or negligently and cause sensitive information leakage, data loss, etc., it will cause huge economic losses to customers and enterprises. loss and adverse social impact

[0003] At present, the existing abnormal user behavior detection methods are mainly based on statistical methods, focusing on providing evidence for post-event auditing, lacking real-time detection and blocking of user abnormal behavior

And most of the data comes from a single source. However, in the actual network environment, user behaviors are complex and diverse. It is not enough to judge whether there is an abnormality in user behavior based on a single data, and there are a lot of false positives and negative negatives.

Images