User entity behavior analysis method based on density peak value adaptive clustering

Abstract

The invention discloses a user entity behavior analysis method based on density peak value adaptive clustering, which comprises the following steps of: 1, extracting access user data of an important data server within a certain time period, and constructing a data graph according to access times and access behaviors; 2, calculating the local density of the user data points in the step 1 and the distance between the user data points; 3, taking a point before the inflection point as a cluster center point; 4, analyzing user behavior types in each data point cluster; 5, analyzing abnormal behavior information of the user according to the user behavior baseline constructed in the step 4; and step 6, screening a suspicious personnel list according to the information. According to the user entity behavior analysis method based on density peak value adaptive clustering, the user entity behaviors can be effectively analyzed through setting of the steps 1-6, and suspicious users can be found in time.

Description

technical field [0001] The present invention relates to an analysis method, in particular to a user entity behavior analysis method based on density peak adaptive clustering. Background technique [0002] With the rapid development of digital information technology, the phenomenon of using mobile devices to work in non-office places is becoming more and more common, which greatly increases the convenience and convenience of office, which also increases work efficiency and accelerates social development. . [0003] The above methods also increase the value of digital assets accordingly, so they are also coveted by cybercriminal organizations to obtain economic benefits through various viruses and ransomware, and the above methods will greatly infringe on the interests of ordinary people, so network security It is the top priority of the current digital age. The main defense method of the existing network security is to isolate criminal organizations by setting identity permi...

AI Technical Summary

Problems solved by technology

[0003] The above methods also increase the value of digital assets accordingly, so they are also coveted by cybercriminal organizations to obtain economic benefits through various viruses and ransomware, and the above methods will greatly infringe on the interests of ordinary people, so network security It is the top priority of the current digital age. The main defense method of the existing network security is to isolate criminal organizations by setting identity permissions, such as account passwords, etc. However, identity permissions will be stolen in actual situations, so The security performance of the existing network security methods is far from enough to meet the needs of the current network environment