An internal threat behavior detection method and system fusing multi-dimensional features of users

Abstract

The present application relates to the technical field of data processing, in particular to a kind of internal threat behavior detection method and system fusing user multidimensional characteristics, including user portrait and association analysis subsystem, user behavior detection subsystem, user identity identification subsystem and information comprehensive subsystem, user portrait and association analysis subsystem are based on user attribute feature Construction user attribute portrait and set abnormal threshold after grouping;User identity identification subsystem is based on user biological characteristics and carries out identity identification to user and obtains identity abnormal confidence;User behavior detection subsystem is based on user behavior feature and constructs threat behavior detection model and is combined with the above two results and carries out training to model and obtains threat behavior;Information comprehensive subsystem is based on abnormal threshold and identity abnormal confidence and feeds back abnormal threshold increment to user portrait and association analysis subsystem and feeds back biological feature increment to user identity identification subsystem, again comprehensively the output of three subsystems, obtains early warning result.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for detecting internal threat behaviors that integrates multi-dimensional user characteristics. Background Technology

[0002] Insider threats refer to actions taken by employees (current or former employees), contractors, and business partners of an organization who have access to the organization's systems, networks, and data, and who use their legally obtained access rights to negatively impact the confidentiality, integrity, and availability of information in the organization's information systems.

[0003] Insider threat behaviors are becoming increasingly complex, covert, and sparse, and behavior detection information based on single-type data features can no longer meet performance requirements. Insider threat behavior detection often models user activity data, i.e., user behavior characteristics, as behavior sequences. However, other user information, such as users' personality traits, workplace attitudes, life experiences, and other intrinsic attributes, as well as biometric features formed by users using keyboards and mice, are also crucial.

[0004] Therefore, internal user behavior detection suffers from problems such as insufficient user behavior data and uneven sample distribution, resulting in low accuracy and high false alarm rate of existing user behavior detection methods. Summary of the Invention

[0005] The purpose of this invention is to provide an internal threat behavior detection method and system that integrates multi-dimensional user characteristics, aiming to solve the problems of low accuracy and high false alarm rate of existing user behavior detection methods.

[0006] To achieve the above objectives, in a first aspect, the present invention provides an internal threat behavior detection system that integrates multi-dimensional user characteristics, including a user profiling and correlation analysis subsystem, a user behavior detection subsystem, a user identity recognition subsystem, and an information integration subsystem. The user profiling and correlation analysis subsystem, the user behavior detection subsystem, and the user identity recognition subsystem are connected sequentially, and the information integration subsystem is connected to the user profiling and correlation analysis subsystem, the user behavior detection subsystem, and the user identity recognition subsystem.

[0007] The user profiling and correlation analysis subsystem constructs user attribute profiles based on user attribute features and groups them to obtain user groups, and sets an anomaly threshold for the user groups.

[0008] The user identity recognition subsystem identifies users based on their biometric characteristics and obtains an identity anomaly confidence level.

[0009] The user behavior detection subsystem constructs a threat behavior detection model based on user behavior characteristics, and trains the threat behavior detection model by combining the anomaly threshold and the identity anomaly confidence level to obtain threat behaviors;

[0010] The information integration subsystem is used to integrate the abnormal threshold and the identity abnormality confidence level and then feed back an abnormal threshold increment to the user profiling and correlation analysis subsystem, and feed back a biometric feature increment to the user identity recognition subsystem. Then, it integrates the outputs of the user profiling and correlation analysis subsystem, the user behavior detection subsystem and the user identity recognition subsystem again to obtain the warning result.

[0011] The user profiling and correlation analysis subsystem includes a data collection module, a first preprocessing module, a profile building module, a grouping module, and a setting module, which are connected in sequence.

[0012] The data collection module is used to collect user attribute characteristics;

[0013] The first preprocessing module is used to preprocess the user attribute features to obtain preprocessed features;

[0014] The profile building module is used to extract the feature vector of a single user from the preprocessed features to build a user attribute profile;

[0015] The grouping module uses the K-means clustering method to group the user attribute profiles to obtain user groups;

[0016] The setting module is used to set the abnormal threshold for the user group.

[0017] The user behavior detection subsystem includes a data processing module, a model building module, and a behavior detection module, which are connected in sequence.

[0018] The data processing module is used to acquire user behavior features, aggregate and parse the user behavior features, and filter out the normal behavior dataset and the dataset to be detected.

[0019] The model building module constructs a BiGAN model and trains the BiGAN model using the normal behavior dataset to obtain a threat behavior detection model.

[0020] The behavior detection module trains the threat behavior detection model using the dataset to be detected, the anomaly threshold, and the identity anomaly confidence level to obtain threat behaviors.

[0021] The user identification subsystem includes a data acquisition module, a second preprocessing module, a feature extraction module, and an identification module, which are connected in sequence.

[0022] The acquisition module is used to acquire mouse dynamics data from the device user;

[0023] The second preprocessing module is used to preprocess the mouse dynamics data to obtain biometric data;

[0024] The feature extraction module is used to extract features from the biometric data using TCN to obtain the user's biometric features;

[0025] The identity recognition module is used to classify and recognize the user's biometric features to obtain the user's identity anomaly confidence level.

[0026] Secondly, this invention provides a method for detecting internal threat behaviors that integrates multi-dimensional user features, comprising the following steps:

[0027] S1 constructs user attribute profiles based on user attribute features and groups them to obtain user groups, and sets an anomaly threshold for the user groups;

[0028] S2 identifies users based on their biometrics and obtains an identity anomaly confidence level.

[0029] S3 constructs a threat behavior detection model based on user behavior characteristics, and trains the threat behavior detection model by combining the abnormal threshold and the identity anomaly confidence level to obtain threat behaviors;

[0030] S4 integrates the threat behavior, the anomaly threshold, and the identity anomaly confidence level, and feeds back an anomaly threshold increment to the user profiling and association analysis subsystem, and feeds back a biometric feature increment to the user identity recognition subsystem. Then, steps S1 to S3 are repeated, and the outputs of the user profiling and association analysis subsystem, the user behavior detection subsystem, and the user identity recognition subsystem are integrated again.

[0031] S5 repeats step S4 up to the preset number of times to obtain the warning result.

[0032] This invention discloses an internal threat behavior detection system that integrates multi-dimensional user features. The system comprises: a user profiling and correlation analysis subsystem that constructs user attribute profiles based on user attribute features and groups users into groups, setting an anomaly threshold for each group; a user identity recognition subsystem that identifies users based on their biometric features and obtains an anomaly confidence level; a user behavior detection subsystem that constructs a threat behavior detection model based on user behavior features and trains the model using the anomaly threshold and the anomaly confidence level to obtain threat behaviors; and an information synthesis subsystem that integrates the threat behaviors, the anomaly threshold, and the anomaly confidence level and feeds back an anomaly threshold increment to the user profiling and correlation analysis subsystem and a biometric feature increment to the user identity recognition subsystem. The system then synthesizes the outputs of the user profiling and correlation analysis subsystem, the user behavior detection subsystem, and the user identity recognition subsystem again. This process is repeated a preset number of times to obtain a warning result. This invention comprehensively considers multi-dimensional user features (including attribute features, biometric features, and behavioral features) to construct an internal threat behavior detection model that integrates these features. By employing user profiling and correlation analysis techniques based on user attribute features, biometric-based identity recognition techniques, and sample data-augmented internal threat behavior detection techniques, a collaborative mechanism among these technologies is designed and applied within a deep learning network. This addresses the issues of low accuracy and high false alarm rates in existing user behavior detection methods. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart of an internal threat behavior detection system that integrates multi-dimensional user characteristics, provided by the present invention.

[0035] Figure 2 This is a detection framework diagram of the user behavior detection subsystem.

[0036] Figure 3 This is a diagram of the BiGAN structure.

[0037] Figure 4 This is a flowchart of the behavior detection module.

[0038] Figure 5 This is a schematic diagram of the internal threat behavior detection system that integrates multi-dimensional user features provided by the present invention.

[0039] Figure 6 This is a schematic diagram of the user profiling and correlation analysis subsystem.

[0040] Figure 7 This is a schematic diagram of the user behavior detection subsystem.

[0041] Figure 8 This is a schematic diagram of the user identification subsystem.

[0042] Figure 9 This is a flowchart of an internal threat behavior detection method that integrates multi-dimensional user features provided by the present invention.

[0043] 1-User profiling and correlation analysis subsystem, 2-User behavior detection subsystem, 3-User identity recognition subsystem, 4-Information integration subsystem, 5-Data collection module, 6-First preprocessing module, 7-Profiling construction module, 8-Grouping module, 9-Settings module, 10-Data processing module, 11-Model construction module, 12-Behavior detection module, 13-Collection module, 14-Second preprocessing module, 15-Feature extraction module, 16-Identity recognition module. Detailed Implementation

[0044] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0045] Please see Figures 1 to 8 In a first aspect, the present invention provides an internal threat behavior detection system that integrates multi-dimensional user characteristics, including a user profiling and correlation analysis subsystem 1, a user behavior detection subsystem 2, a user identity recognition subsystem 3, and an information integration subsystem 4. The user profiling and correlation analysis subsystem 1, the user behavior detection subsystem 2, and the user identity recognition subsystem 3 are connected in sequence, and the information integration subsystem 4 is connected to the user profiling and correlation analysis subsystem 1, the user behavior detection subsystem 2, and the user identity recognition subsystem 3.

[0046] The user profiling and correlation analysis subsystem 1 constructs user attribute profiles based on user attribute features and groups them to obtain user groups, and sets an anomaly threshold for the user groups.

[0047] The user identity recognition subsystem 3 identifies users based on their biometric characteristics and obtains an identity anomaly confidence level.

[0048] The user behavior detection subsystem 2 constructs a threat behavior detection model based on user behavior characteristics, and trains the threat behavior detection model by combining the abnormal threshold and the identity anomaly confidence level to obtain threat behaviors;

[0049] The information integration subsystem 4 is used to integrate the abnormal threshold and the identity abnormality confidence level and then feed back an abnormal threshold increment to the user profile and association analysis subsystem 1, and feed back a biometric feature increment to the user identity recognition subsystem 3. Then, it integrates the outputs of the user profile and association analysis subsystem 1, the user behavior detection subsystem 2 and the user identity recognition subsystem 3 again to obtain the warning result.

[0050] Specifically, the user profiling and correlation analysis subsystem 1 constructs user attribute profiles based on user attribute features and groups them to obtain user groups, and sets an anomaly threshold for the user groups; the user identity recognition subsystem 3 performs user identity recognition based on user biometrics to obtain an identity anomaly confidence level; the user behavior detection subsystem 2 constructs a threat behavior detection model based on user behavior features, and trains the threat behavior detection model in combination with the anomaly threshold and the identity anomaly confidence level to obtain threat behaviors; the information integration subsystem 4 integrates the threat behaviors, the anomaly threshold, and the identity anomaly confidence level and feeds back an anomaly threshold increment to the user profiling and correlation analysis subsystem 1, and feeds back a biometric feature increment to the user identity recognition subsystem 3, and then integrates the outputs of the user profiling and correlation analysis subsystem 1, the user behavior detection subsystem 2, and the user identity recognition subsystem 3 again; this process is repeated a preset number of times to obtain a warning result. This solves the problems of low accuracy and high false alarm rate of existing user behavior detection methods.

[0051] Furthermore, the user profiling and association analysis subsystem 1 includes a data collection module 5, a first preprocessing module 6, a profile construction module 7, a grouping module 8, and a setting module 9, which are connected in sequence.

[0052] The data collection module 5 is used to collect user attribute features;

[0053] The first preprocessing module 6 is used to preprocess the user attribute features to obtain preprocessed features;

[0054] The profile building module 7 is used to extract the feature vector of a single user from the preprocessed features to build a user attribute profile;

[0055] The grouping module 8 uses the K-means clustering method to group the user attribute profiles to obtain user groups;

[0056] The setting module 9 is used to set the abnormal threshold of the user group.

[0057] Specifically, the data collection module 5 collects user attribute features, specifically, it collects Q1 attribute feature information of P1 users, such as name, age, marital status, etc., collects user psychological state information (through questionnaires, psychological assessments, etc.), and collects information such as user job position and criminal record. The first preprocessing module 6 preprocesses the user attribute features, specifically, it processes the collected data into a matrix of P1 rows and Q1 columns to obtain preprocessed features. The profile construction module 7 is used to extract feature vectors of individual users from the preprocessed features to construct user attribute profiles. The grouping module 8 uses the K-means clustering method to group the user attribute profiles to obtain user groups. The setting module 9 is used to set the anomaly threshold N for the user groups.

[0058] Furthermore, the user behavior detection subsystem 2 includes a data processing module 10, a model building module 11, and a behavior detection module 12, which are connected in sequence.

[0059] The data processing module 10 is used to acquire user behavior features, aggregate and parse the user behavior features, and filter out the normal behavior dataset and the dataset to be detected.

[0060] The model building module 11 builds a BiGAN model and trains the BiGAN model using the normal behavior dataset to obtain a threat behavior detection model.

[0061] The behavior detection module 12 uses the dataset to be detected, the anomaly threshold, and the identity anomaly confidence level to train the threat behavior detection model to obtain threat behaviors.

[0062] Specifically, the data processing module 10 acquires user behavior features, aggregates and parses these features, and filters out the normal behavior dataset and the dataset to be detected. Specifically, it acquires the original dataset (user behavior features) through host operation logs, network traffic statistics, and internal employee personal information, such as login / logout, web browsing, resumes, and psychological test data. The collected raw data needs to be processed by a log aggregator and then a log parser to filter out the feature data required for the research task, forming a P2*Q2 matrix to obtain the normal behavior dataset and the dataset to be detected. The model building module 11 constructs a BiGAN model and trains it using the normal behavior dataset to obtain a threat behavior detection model. Specifically, because user behavior data is characterized by small data volume and uneven sample distribution (few abnormal data), traditional neural networks usually require a large amount of data for training. Therefore, the BiGAN network, which has excellent performance in generating small sample data, is selected as the model for constructing normal user behavior patterns. The structure diagram of BiGAN is shown below. Figure 3 As shown.

[0063] BiGAN consists of an Encoder network (E), a Generator (G), and a Discriminator (D).

[0064] Encoder E: Extracts the latent variables from the real data as E(x).

[0065] Generator G: Generates random noise into generated data G(z).

[0066] Compared to the original GAN ​​network, which only distinguishes between true and false data from the data space (x, G(z)), BiGAN makes distinctions from both the data space and the latent spaces (x, E(x)) and (G(z), z). E(x) is the encoder output, and G(z) is the generator output.

[0067] The objective optimization function of the BiGAN network is shown in Equation 1.

[0068] min G,E max D V(D,G,E)=

[0069] E x～px [E z～pE(·|x) [logD(x,z)]]+E z～pz [E x～PG(·|z) [log(1-D(x,z))]](1)

[0070] By selecting only normal user behavior data as training input for the BiGAN network, the generator G part of the trained BiGAN network can generate data that is similar to normal behavior data, while the discriminator D part can effectively distinguish whether the input data is normal behavior data. Therefore, by training the BiGAN model with normal data, when encountering anomalous data not seen during training in the detection phase, the generator G part of the BiGAN cannot generate data similar to the anomalous data, which can be used to determine whether the input data is anomalous behavior data, thus achieving unsupervised detection. Therefore, after using BiGAN to build a normal user behavior model, the subsequent detection phase can use the reconstruction error of the input data as anomaly judgment.

[0071] The behavior detection module 12 uses the dataset to be detected, the anomaly threshold, and the identity anomaly confidence score to train the threat behavior detection model to obtain threat behaviors;

[0072] Based on the characteristics that the generator of the trained BiGAN network can only generate normal behavior data similar to the input during training, and the discriminator can effectively distinguish between real and fake data with significant differences, the main process of user behavior detection is as follows: Figure 4 As shown.

[0073] A well-trained BiGAN model can only generate normal behavioral data, so it cannot generate data well when encountering abnormal data. Therefore, the abnormal score A can be used as the basis for anomaly judgment, and finally the OTSU algorithm can be applied to automatically select the anomaly threshold to achieve the effect of anomaly detection.

[0074] Let the current detected data be x, and its anomaly score be A(x). The formula for calculating A(x) is shown in Equation 2.

[0075] A(x)=aL(D)+(1-a)L(G) (2)

[0076] 1) L(G): Represents the reconstruction error. It uses the generative model to determine the difference between x and the real data. It is an error calculation at the data space level. The calculation formula is shown in Equation 3.

[0077] L(G)=||xG(E(x))||1 (3)

[0078] E(x) represents the output of data x after passing through encoder E, G(E(x)) represents the data generated by the generator based on E(x), and L(G) represents the error between these two sets of data. Since the difference between normal user behavior data and abnormal behavior data is small, the error is calculated here using cosine similarity, which is more sensitive to data changes.

[0079] 2) L(D): The difference between x and the real sample is determined from the perspective of the discriminator. The error is calculated by selecting the representation of the intermediate layer of the discriminator. The error is calculated at the latent space level. The calculation formula is shown in Equation 4.

[0080] L(D) = ||f D (x,E(x))-f D (G(E(x)),E(x))||1 (4)

[0081] f D L(D) represents the intermediate layer output of the discriminator, and L(D) represents the error between (x,E(x)) and (G(E(x)),E(x))). Here, cosine similarity is also used as the error calculation method.

[0082] 3) A(x): Abnormal score, which is calculated by weighted summation of L(G) and L(D), where α represents the weight.

[0083] Otsu: Otsu's method is an adaptive thresholding approach. Its main idea is to segment an image into target and background based on its grayscale properties. When the difference between the background and target is large, the inter-class variance between the two parts is large. Misclassification of either the background or the target leads to a smaller difference. Therefore, the optimal threshold is the one where the inter-class variance is maximized, representing the best target-background segmentation.

[0084] Furthermore, the user identification subsystem 3 includes a data acquisition module 13, a second preprocessing module 14, a feature extraction module 15, and an identification module 16, which are connected in sequence.

[0085] The acquisition module 13 is used to acquire mouse dynamics data of the device user;

[0086] The second preprocessing module 14 is used to preprocess the mouse dynamics data to obtain biometric data;

[0087] The feature extraction module 15 is used to extract features from the biometric data using TCN to obtain the user's biometric features;

[0088] The identity recognition module 16 is used to classify and recognize the user's biometric features to obtain the user's identity anomaly confidence level.

[0089] Specifically, the acquisition module 13 acquires mouse dynamics data of the device user. This data includes the mouse's XY coordinates, button information (left, middle, and right buttons), operation information (movement, dragging, clicking, etc.), and time information. The second preprocessing module 14 preprocesses the mouse dynamics data, including removing outliers, standardization, and smoothing, to obtain a P3*Q3 matrix for accurate modeling and analysis in subsequent steps, thus obtaining biometric data. The feature extraction module 15 uses a TCN to extract features from the biometric data, obtaining the user's biometric features. The identity recognition module 16 adds a softmax layer to classify and recognize the user's biometric features, obtaining the user's identity anomaly confidence level.

[0090] The information integration subsystem 4 combines the user anomaly threshold N set by the user profiling and association analysis subsystem 1 with the user identity anomaly confidence M obtained by the user identity recognition subsystem 3 to perform information integration and output the detection result.

[0091] Let the output vector obtained by the above detector be Y. Inspired by the risk assessment calculation, the comprehensive calculation of design information is shown in formula (5).

[0092]

[0093] Where H is the threat coefficient, N is the user anomaly threshold, and is set and dynamically updated by the user group generated by the user profiling and correlation analysis subsystem 1. When H is greater than N, the system's alarm function is triggered. K is the confidence level of the threat vector, M is the user identity anomaly confidence level obtained by the user identity recognition subsystem 3, J is the threat level corresponding to the user behavior, I is the frequency of a certain type of threat, OTU(i) (OSTU(i)≥0) is the increment of I corresponding to a certain type of threat (which can be automatically updated through hyperparameter tuning), and n (n<0) is the increment of the user anomaly threshold, which is dynamically updated through the analysis of detection results. In the information integration part, an anomaly threshold increment is fed back to the user profiling subsystem, and a biometric feature increment is fed back to the user identity recognition subsystem 3. Then, the outputs of the first three systems are integrated again, and repeated feedback training is performed to finally obtain the warning result, which can effectively improve the detection accuracy of the model.

[0094] The user profiling and association analysis subsystem 1 based on user attribute features, the internal user behavior detection subsystem 2 based on BiGAN and OTSU, and the user identity recognition subsystem 3 based on user biometrics, through information integration, achieve organic combination and synergy among them, which is the key to realizing intelligent, efficient and accurate internal threat behavior detection.

[0095] Please see Figure 9Secondly, the present invention provides a method for detecting internal threat behaviors by integrating multi-dimensional user features, comprising the following steps:

[0096] S1 constructs user attribute profiles based on user attribute features and groups them to obtain user groups, and sets an anomaly threshold for the user groups;

[0097] S2 identifies users based on their biometrics and obtains an identity anomaly confidence level.

[0098] S3 constructs a threat behavior detection model based on user behavior characteristics, and trains the threat behavior detection model by combining the abnormal threshold and the identity anomaly confidence level to obtain threat behaviors;

[0099] S4 integrates the threat behavior, the anomaly threshold, and the identity anomaly confidence level, and feeds back an anomaly threshold increment to the user profiling and association analysis subsystem 1, and feeds back a biometric feature increment to the user identity recognition subsystem 3. Then, steps S1 to S3 are repeated, and the outputs of the user profiling and association analysis subsystem 1, the user behavior detection subsystem 2, and the user identity recognition subsystem 3 are integrated again.

[0100] S5 repeats step S4 up to the preset number of times to obtain the warning result.

[0101] The above-disclosed embodiments are merely preferred embodiments of the internal threat behavior detection method and system that integrates multi-dimensional user characteristics according to the present invention. Of course, they should not be construed as limiting the scope of the present invention. Those skilled in the art can understand that implementing all or part of the above embodiments and making equivalent changes in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. An internal threat behavior detection system that integrates multi-dimensional user characteristics, characterized in that, It includes a user profiling and correlation analysis subsystem, a user behavior detection subsystem, a user identity recognition subsystem, and an information integration subsystem. The user profiling and correlation analysis subsystem, the user behavior detection subsystem, and the user identity recognition subsystem are connected in sequence, and the information integration subsystem is connected to the user profiling and correlation analysis subsystem, the user behavior detection subsystem, and the user identity recognition subsystem. The user profiling and correlation analysis subsystem constructs user attribute profiles based on user attribute features and groups them to obtain user groups, and sets an anomaly threshold for the user groups. The user identity recognition subsystem identifies users based on their biometric characteristics and obtains an identity anomaly confidence level. The user behavior detection subsystem constructs a threat behavior detection model based on user behavior characteristics, and trains the threat behavior detection model by combining the anomaly threshold and the identity anomaly confidence level to obtain threat behaviors; The information integration subsystem is used to integrate the anomaly threshold and the identity anomaly confidence level and then feed back an anomaly threshold increment to the user profiling and correlation analysis subsystem, and a biometric feature increment to the user identity recognition subsystem. Then, it integrates the outputs of the user profiling and correlation analysis subsystem, the user behavior detection subsystem, and the user identity recognition subsystem again to obtain the warning result. Let the output vector obtained by the threat behavior detection model be Y. Inspired by risk assessment calculations, the information integration calculation is designed as shown in the formula: Where H is the threat coefficient, N is the user anomaly threshold, and is set and dynamically updated by the user group generated by the user profiling and correlation analysis subsystem. When H is greater than N, the system's alarm function will be triggered. K is the confidence level of the threat vector, M is the confidence level of user identity anomaly obtained by the user identity recognition subsystem, J is the threat level corresponding to the user behavior, I is the frequency of a certain type of threat, OTU(i) is the increment of I corresponding to a certain type of threat, and n is the increment of the user anomaly threshold, which is dynamically updated through the analysis of the detection results. In the information integration part, an anomaly threshold increment is fed back to the user profiling subsystem, and a biometric feature increment is fed back to the user identity recognition subsystem. Then, the outputs of the first three systems are integrated again, and repeated feedback training is performed to finally obtain the warning result.

2. The internal threat behavior detection system that integrates multi-dimensional user features as described in claim 1, characterized in that, The user profiling and correlation analysis subsystem includes a data collection module, a first preprocessing module, a profile construction module, a grouping module, and a setting module, wherein the data collection module, the first preprocessing module, the profile construction module, the grouping module, and the setting module are connected in sequence. The data collection module is used to collect user attribute characteristics; The first preprocessing module is used to preprocess the user attribute features to obtain preprocessed features; The profile building module is used to extract the feature vector of a single user from the preprocessed features to build a user attribute profile; The grouping module uses the K-means clustering method to group the user attribute profiles to obtain user groups; The setting module is used to set the abnormal threshold for the user group.

3. The internal threat behavior detection system that integrates multi-dimensional user features as described in claim 2, characterized in that, The user behavior detection subsystem includes a data processing module, a model building module, and a behavior detection module, which are connected in sequence. The data processing module is used to acquire user behavior features, aggregate and parse the user behavior features, and filter out the normal behavior dataset and the dataset to be detected. The model building module constructs a BiGAN model and trains the BiGAN model using the normal behavior dataset to obtain a threat behavior detection model. The behavior detection module trains the threat behavior detection model using the dataset to be detected, the anomaly threshold, and the identity anomaly confidence level to obtain threat behaviors.

4. The internal threat behavior detection system that integrates multi-dimensional user features as described in claim 3, characterized in that, The user identification subsystem includes a data acquisition module, a second preprocessing module, a feature extraction module, and an identification module, which are connected in sequence. The acquisition module is used to acquire mouse dynamics data from the device user; The second preprocessing module is used to preprocess the mouse dynamics data to obtain biometric data; The feature extraction module is used to extract features from the biometric data using TCN to obtain the user's biometric features; The identity recognition module is used to classify and recognize the user's biometric features to obtain the user's identity anomaly confidence level.

5. A method for detecting internal threat behavior by integrating multi-dimensional user features, applied to the internal threat behavior detection system by integrating multi-dimensional user features as described in claim 4, characterized in that, Includes the following steps: S1 constructs user attribute profiles based on user attribute features and groups them to obtain user groups, and sets an anomaly threshold for the user groups; S2 identifies users based on their biometrics and obtains an identity anomaly confidence level. S3 constructs a threat behavior detection model based on user behavior characteristics, and trains the threat behavior detection model by combining the abnormal threshold and the identity anomaly confidence level to obtain threat behaviors; S4 integrates the threat behavior, the anomaly threshold, and the identity anomaly confidence level, and feeds back an anomaly threshold increment to the user profiling and correlation analysis subsystem, and a biometric feature increment to the user identity recognition subsystem. Steps S1 to S3 are repeated, and the outputs of the user profiling and correlation analysis subsystem, the user behavior detection subsystem, and the user identity recognition subsystem are integrated again. Let the output vector obtained from the threat behavior detection model be Y. Inspired by risk assessment calculations, the integrated information calculation is shown in the formula: Where H is the threat coefficient, N is the user anomaly threshold, and is set and dynamically updated by the user group generated by the user profiling and correlation analysis subsystem; when H is greater than N, the system's alarm function will be triggered, K is the confidence level of the threat vector, M is the user identity anomaly confidence level obtained by the user identity recognition subsystem, J is the threat level corresponding to the user behavior, I is the frequency of a certain type of threat, OTU(i) is the increment of I corresponding to a certain type of threat, and n is the increment of the user anomaly threshold, which is dynamically updated through the analysis of the detection results; in the information integration part, an anomaly threshold increment is fed back to the user profiling subsystem, and a biometric feature increment is fed back to the user identity recognition subsystem; then the outputs of the first three systems are integrated again for repeated feedback training; S5 repeats step S4 up to the preset number of times to obtain the warning result.

Images