Abnormal access behavior detection method, device and equipment and readable storage medium

Abstract

The invention provides an abnormal access behavior detection method, device and equipment and a computer readable storage medium. The detection method comprises the following steps: acquiring access data of a user, including an access behavior, an access path and a group where the user is located; determining a membership degree value according to historical access paths of all users in the group; and detecting whether the access behavior of the user is abnormal or not according to the membership degree value of the group where the user is located corresponding to the access path. According to the detection method, the membership degree values of the group to different access paths are determined through the historical access paths formed by all the users in the group where the users are located based on the work business requirements, and then whether the access behaviors of the users are abnormal or not is detected according to the membership degree values, so that the abnormal access behavior detection efficiency can be improved; the misjudgment rate of access behavior auditing is reduced, the accuracy of abnormal access behavior detection and judgment is improved, and leakage of confidential or sensitive files is avoided.

Description

technical field [0001] The present application relates to the technical field of data processing, and more specifically, to an abnormal access behavior detection method, an abnormal access behavior detection device, an abnormal access behavior detection device, and a computer-readable storage medium. Background technique [0002] Network behavior analysis is an important branch in the field of information security. However, since the current research cannot effectively give a clear definition of abnormal rules, in the process of mining abnormal access behaviors, it often occurs when detecting what kind of operation behavior is abnormal access. Too high a false positive rate. Further, the above-mentioned detection with an excessively high false positive rate may also increase the possibility of leaking sensitive or confidential documents. [0003] Conventional abnormal access behavior detection methods are mainly based on the number of operations, file types, and file name k...

AI Technical Summary

Problems solved by technology

However, there are many directories (access paths) and users in the server, it is difficult for the server administrator to accurately and correctly set the user permissions of each directory, and because the user's personal needs and personal behavior are volatile, the scope of their work is vague and difficult. Clearly defined, so it is not accurate and efficient to detect whether the current user's access behavior is abnormal based on some discrete feature points of historical users

Images