Unlock instant, AI-driven research and patent intelligence for your innovation.

Abnormal behavior prediction method and system based on user feature tags

A feature label and user feature technology, applied in the field of network security, can solve the problems of large error, low efficiency of feature sequence construction process, low feature sequence support, etc., and achieve the effect of improving efficiency

Pending Publication Date: 2022-02-11
SHANDONG ZHONGFU INFORMATION IND
View PDF0 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0005] Using a feature set for prediction often only constitutes a correlation with abnormal behavior, not a causal relationship. The elements of the feature set are a necessary condition for abnormal behavior, but not a sufficient condition. Directly using the feature set for prediction has a large error
[0006] The use of feature sequences for prediction is often due to the large feature set in the learning sample, the efficiency of the feature sequence construction process is low, and too many features will also lead to low support of the feature sequence

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Abnormal behavior prediction method and system based on user feature tags
  • Abnormal behavior prediction method and system based on user feature tags

Examples

Experimental program
Comparison scheme
Effect test

Embodiment 1

[0039] This embodiment provides a method for predicting abnormal behavior based on user feature tags;

[0040] Such as figure 1 As shown, an abnormal behavior prediction method based on user feature labels, including:

[0041] S101: Obtain the network behavior to be predicted, and construct a sample set of user feature label sequences of the network behavior to be predicted;

[0042] S102: According to the feature label set, perform feature label elimination on the sample set of the user feature label sequence of the network behavior to be predicted, and obtain the remaining feature label sequence to be predicted and the sample set of the remaining feature label sequence to be predicted; wherein, the eliminated The feature labels of are all feature labels with high support;

[0043] S103: Calculate the similarity between all the remaining feature label sequences to be predicted in the sample set of the remaining feature label sequences to be predicted and the set feature lab...

Embodiment 2

[0084] This embodiment provides a system for predicting abnormal behavior based on user feature tags;

[0085] Such as figure 2 As shown, an abnormal behavior prediction system based on user feature labels, including:

[0086] A building module, which is configured to: acquire the network behavior to be predicted, and construct a sample set of user feature label sequences of the network behavior to be predicted;

[0087] The elimination module is configured to: perform feature label elimination on the sample set of the user feature label sequence of the network behavior to be predicted according to the feature label set, and obtain the remaining feature label sequence to be predicted and samples of the remaining feature label sequence to be predicted set; wherein, the feature labels eliminated are all feature labels with high support;

[0088] The output module is configured to: calculate the similarity between all the remaining feature label sequences to be predicted in th...

Embodiment 3

[0099] This embodiment also provides an electronic device, including: one or more processors, one or more memories, and one or more computer programs; wherein, the processor is connected to the memory, and the one or more computer programs are programmed Stored in the memory, when the electronic device is running, the processor executes one or more computer programs stored in the memory, so that the electronic device executes the method described in Embodiment 1 above.

[0100] It should be understood that in this embodiment, the processor can be a central processing unit CPU, and the processor can also be other general-purpose processors, digital signal processors DSP, application specific integrated circuits ASIC, off-the-shelf programmable gate array FPGA or other programmable logic devices , discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, o...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention discloses an abnormal behavior prediction method and system based on user feature tags, wherein the method comprises the steps: obtaining a to-be-predicted network behavior, and constructing a sample set of user feature tag sequences of the to-be-predicted network behavior; according to the feature tag set, performing feature tag elimination on the sample set of the user feature tag sequences of the to-be-predicted network behavior to obtain to-be-predicted residual feature tag sequences and a sample set of the to-be-predicted residual feature tag sequences, wherein the eliminated feature tags are all feature tags with high support degree; and carrying out similarity calculation on all the to-be-predicted residual feature tag sequences in the sample set of the to-be-predicted residual feature tag sequences and the set feature tag sequences, wherein the higher the similarity of the to-be-predicted residual feature tag sequences is, the higher the probability of the abnormal behavior event of the corresponding user is. According to the invention, abnormal network behavior detection can be realized.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and system for predicting abnormal behavior based on user feature tags. Background technique [0002] The statements in this section merely mention the background technology related to the present invention and do not necessarily constitute the prior art. [0003] With the continuous advancement of network security technology, the evaluation and prediction system for various security abnormal behaviors on the intranet has begun to be applied. In intranet security, the analysis system often adopts the method of assigning labels to users to describe the typical status characteristics or behavior characteristics of users. How to make more accurate and rapid predictions before abnormal user behaviors occur through the changing trends of these user feature labels has become the focus of various prediction system research. [0004] It is generally believed that the ...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(China)
IPC IPC(8): H04L9/40H04L41/147G06F16/2458
CPCH04L63/1425H04L41/147G06F16/2465G06F2216/03
Inventor 郑传义苗功勋高峰田金星
Owner SHANDONG ZHONGFU INFORMATION IND