Abnormal user identification method and device, electronic equipment and storage medium

Abstract

The invention discloses an abnormal user identification method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining first access data of a user for accessing a target platform in a preset time period, and determining a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users according to the first access data; obtaining second access data of the candidate user for accessing the target platform in a historical time period before the preset time period, and determining a second access behavior evaluation score of the candidate user according to the first access data and the second access data; determining a target access behavior evaluation score of the candidate user according to the first access behavior evaluation score and the second access behavior evaluation score; and when the target access behavior evaluation score is greater than an abnormal score threshold, determining the candidate user corresponding to the target access behavior evaluation score as an abnormal user and generating an abnormal user prompt. According to the method, the accuracy and efficiency of identifying the behavior of malicious downloading of the target platform data by the user can be improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to computer technology, and in particular to a method, device, electronic device and storage medium for identifying abnormal users. Background Art

[0002] At present, the internal big data platform of an enterprise is a "necessity" for the enterprise's business operations. Internal employees have a relatively convenient way to download data from the platform, but data leakage may occur during the data download process.

[0003] Currently, the main means of preventing data leakage is for managers to review the data download requests and business needs submitted by users and obtain approval results. When the approval result is to allow downloading, users can download data from the platform. However, in general, data download requests initiated by users will be supported by managers, and most of the users' business needs are reasonable needs, so the approval result is mostly to allow downloading. There is a lack of better identification methods for users' malicious data downloading behavior. Summary of the Invention

[0004] The embodiments of the present invention provide a method, device, electronic device and storage medium for identifying abnormal users, which can reduce the possibility of abnormal users accessing the target platform multiple times, resulting in the theft or leakage of platform data, improve the accuracy and efficiency of identifying users' malicious downloading of target platform data, and provide a more effective method for identifying abnormal users who maliciously download target platform data; the abnormal score threshold can be adjusted in real time according to the actual situation of security operations of different enterprises, so as to better adapt to the actual situation of security operations of different enterprises.

[0005] In a first aspect, an embodiment of the present invention provides a method for identifying abnormal users, the method comprising:

[0006] Acquire first access data of users accessing a target platform during a preset time period, and determine a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users based on the first access data;

[0007] Obtaining second access data of the candidate user accessing the target platform in a historical time period before a preset time period, and determining a second access behavior evaluation score of the candidate user based on the first access data and the second access data;

[0008] Determine a target access behavior evaluation score for the candidate user according to the first access behavior evaluation score and the second access behavior evaluation score;

[0009] When the target access behavior evaluation score is greater than the abnormal score threshold, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated.

[0010] In a second aspect, an embodiment of the present invention provides an abnormal user identification device, the device comprising:

[0011] a first determining module, configured to obtain first access data of users accessing a target platform during a preset time period, and determine a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users based on the first access data;

[0012] a second determining module, configured to obtain second access data of the candidate user accessing the target platform in a historical time period before a preset time period, and determine a second access behavior evaluation score of the candidate user based on the first access data and the second access data;

[0013] a third determining module, configured to determine a target access behavior evaluation score of the candidate user according to the first access behavior evaluation score and the second access behavior evaluation score;

[0014] The fourth determination module is configured to determine, when the target access behavior evaluation score is greater than an abnormal score threshold, a candidate user corresponding to the target access behavior evaluation score as an abnormal user and generate an abnormal user prompt.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the abnormal user identification method as described in any one of the embodiments of the present invention is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the abnormal user identification method as described in any one of the embodiments of the present invention.

[0017] In an embodiment of the present invention, first access data of a user accessing a target platform during a preset time period can be obtained, and a preset number of candidate users who may have malicious data downloading behavior and first access behavior evaluation scores of the candidate users can be determined from the users based on the first access data; then, second access data of the candidate users accessing the target platform during a historical time period before the preset time period can be obtained, and the second access behavior evaluation score of the candidate users can be determined based on the first access data and the second access data; a target access behavior evaluation score of the candidate user can be determined based on the first access behavior evaluation score and the second access behavior evaluation score; when the target access behavior evaluation score is greater than an abnormal score threshold, that is, when the candidate user is determined to be a user who maliciously downloads target platform data, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated, so that the administrator can adjust the target platform access rights of the abnormal user based on the abnormal user prompt, reduce the possibility of platform data being stolen or leaked due to abnormal users accessing the target platform multiple times, improve the accuracy and efficiency of identifying users' malicious downloading of target platform data, and provide a more effective method for identifying abnormal users who maliciously download target platform data; in addition, the abnormal score threshold can be adjusted in real time according to the actual security operation conditions of different enterprises to better adapt to the actual security operations of different enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 A schematic diagram of a flow chart of a method for identifying abnormal users provided by an embodiment of the present invention;

[0020] Figure 2 Another flowchart of the abnormal user identification method provided by an embodiment of the present invention;

[0021] Figure 3 A schematic diagram of a method for identifying abnormal users provided by an embodiment of the present invention;

[0022] Figure 4 A schematic diagram of the structure of an abnormal user identification device provided by an embodiment of the present invention;

[0023] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It will be understood that the specific embodiments described herein are intended only to illustrate the present invention and are not intended to limit the present invention. It should also be noted that, for ease of description, the accompanying drawings only illustrate portions relevant to the present invention, not all structures.

[0025] Figure 1 A flow chart of an abnormal user identification method provided by an embodiment of the present invention is provided. The method can be executed by an abnormal user identification device provided by an embodiment of the present invention, and the device can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated into an electronic device, such as a computer or a server. The following embodiments will be described using the device integrated into an electronic device as an example. Figure 1 , the method may specifically include the following steps:

[0026] Step 101: obtain first access data of users accessing a target platform in a preset time period, and determine a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users based on the first access data.

[0027] Among them, the first access data can be understood as the data generated by the user accessing the target platform during a preset time period. The first access data can include the number of platform data downloads, sensitive data downloads and user account type of the user within the preset time period.

[0028] In an optional embodiment, the initial access data generated by the user accessing the target platform can be stored in the log platform; the log platform can format and standardize the initial access data to obtain the first access data, and store the access data in a preset storage format. For example, the log platform can format and store the access data by day partition; in this way, the first access data of the user accessing the target platform in the preset time period can be obtained from the log platform, and then the number of platform data downloads, the number of sensitive data downloads and the user account type are input into the first user access behavior evaluation model for user behavior evaluation, to obtain a preset number of first initial access behavior evaluation scores and a user identifier corresponding to the first initial access behavior evaluation score; the user corresponding to the user identifier is determined as a candidate user; based on the first initial access behavior evaluation score and the first weight, the first access behavior evaluation score of the candidate user is determined. Among them, the first user access behavior evaluation model can be understood as an algorithm model for detecting abnormal access data in the first access data; the first initial access behavior evaluation score can be understood as the evaluation score obtained by inputting the first access data into the first user access behavior evaluation model for user behavior evaluation; the first weight can be understood as a preset ratio threshold of the first initial access behavior evaluation score. The preset number can be used to pre-set the number of first initial access behavior evaluation scores output by the first user access behavior evaluation model based on the requirements for identifying abnormal users. For example, the preset number is pre-set to 10, and the number of platform data downloads, the number of sensitive data downloads, and the user account type are input into the first user access behavior evaluation model for user behavior evaluation. 10 first initial access behavior evaluation scores and 10 user identifiers corresponding to the 10 first initial access behavior evaluation scores can be obtained, and then 10 candidate users and the first initial access behavior evaluation scores of the 10 candidate users are determined based on the 10 user identifiers.

[0029] Specifically, the first initial access behavior evaluation score and the first weight are multiplied to obtain the first access behavior evaluation score of the candidate user.

[0030] For example, the first weight is 0.7, and the preset number is 10; the number of platform data downloads, sensitive data downloads and user account type of the user accessing the target platform can be input into the first user access behavior evaluation model to perform user behavior evaluation to obtain 10 first initial access behavior evaluation scores, and user identifiers corresponding to the 10 first initial access behavior evaluation scores; the users corresponding to the user identifiers are determined as candidate users, that is, 10 candidate users are determined. Here, taking 3 candidate users among the 10 candidate users as an example, how to determine the first access behavior evaluation scores of the candidate users based on the first initial access behavior evaluation scores and the first weights of the candidate users is explained in detail. For example, the 3 candidate users among the candidate users are: candidate users A, candidate user B and candidate user C, the first initial access behavior evaluation score of candidate user A is b1, the first initial access behavior evaluation score of candidate user B is b2, and the first initial access behavior evaluation score of candidate user C is b3; multiply the first initial access behavior evaluation score b1 of candidate user A and the first weight 0.7 to obtain the first access behavior evaluation score of candidate user A, 0.7b1; multiply the first initial access behavior evaluation score b2 of candidate user B and the first weight 0.7 to obtain the first access behavior evaluation score of candidate user B, 0.7b2; multiply the first initial access behavior evaluation score b3 of candidate user C and the first weight 0.7 to obtain the first access behavior evaluation score of candidate user C, 0.7b3.

[0031] Step 102 : obtaining second access data of the candidate user accessing the target platform in a historical time period before a preset time period, and determining a second access behavior evaluation score of the candidate user based on the first access data and the second access data.

[0032] Among them, the historical time period can be understood as the time period before the preset time period; the second access data may include the number of platform data downloads and sensitive data downloads by the user within the historical time period; the second access behavior evaluation score can be understood as the user access behavior evaluation score determined based on the second access data and the second weight.

[0033] In an optional embodiment, second access data of the candidate user accessing the target platform in a historical time period before a preset time period is obtained from the log platform, and the number of platform data downloads and sensitive data downloads in the preset time period and the number of platform data downloads and sensitive data downloads in the historical time period are input into a second user access behavior evaluation model to perform user behavior evaluation to obtain a second candidate access behavior evaluation score; the second candidate access behavior evaluation score is multiplied by the second weight to obtain the second access behavior evaluation score of the candidate user.

[0034] For example, the 10 candidate users include candidate user A, candidate user B, and candidate user C. The historical time period is the time period of the candidate users in the 15 days before the current day, and the second weight is 0.3. Taking candidate users A, candidate user B, and candidate user C as examples, the number of platform data downloads and sensitive data downloads generated when the candidate users visit the target platform on the current day and the number of platform data downloads and sensitive data downloads generated when they visit the target platform in the previous 15 days are input into the second user access behavior evaluation model for user behavior evaluation, and the second candidate access behavior evaluation score c1 for candidate user A and the second candidate access behavior evaluation score c for candidate user B are obtained. 2. The second candidate access behavior evaluation score c3 of candidate user C; multiply the second candidate access behavior evaluation score c1 of candidate user A and the second weight 0.3 to obtain the second access behavior evaluation score 0.3c1 of candidate user A, multiply the second candidate access behavior evaluation score c2 of candidate user B and the second weight 0.3 to obtain the second access behavior evaluation score 0.3c2 of candidate user B, multiply the second candidate access behavior evaluation score c3 of candidate user C and the second weight 0.3 to obtain the second access behavior evaluation score 0.3c3 of candidate user C. The method for determining the first access behavior evaluation scores of the remaining 7 candidate users is the same as above and will not be repeated here.

[0035] Step 103 : Determine a target access behavior evaluation score of the candidate user according to the first access behavior evaluation score and the second access behavior evaluation score.

[0036] The target access behavior evaluation score may be understood as an evaluation score determined based on the first access behavior evaluation score and the second access behavior evaluation score.

[0037] In an optional implementation, the first access behavior evaluation score and the second access behavior evaluation score are added together to obtain the target access behavior evaluation score of the candidate user.

[0038] For example, the first access behavior evaluation score of candidate user A is 0.7b1, and the second access behavior evaluation score of candidate user A is 0.3c1. The first access behavior evaluation score 0.7b1 and the second access behavior evaluation score 0.3c1 are added to obtain the target access behavior evaluation score of candidate user A, which is 0.7b1+0.3c1; the first access behavior evaluation score of candidate user B is 0.7b2, and the second access behavior evaluation score of candidate user B is 0.3c2. The first access behavior evaluation score 0.7b2 and the second access behavior evaluation score 0.3c2 are added to obtain the target access behavior evaluation score of candidate user B, which is 0.7b2+0.3c2; the first access behavior evaluation score of candidate user C is 0.7b3, and the second access behavior evaluation score of candidate user C is 0.3c3. The first access behavior evaluation score 0.7b3 and the second access behavior evaluation score 0.3c3 are added to obtain the target access behavior evaluation score of candidate user C, which is 0.7b3+0.3c3.

[0039] Step 104: When the target access behavior evaluation score is greater than the abnormal score threshold, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated.

[0040] The abnormal score threshold can be understood as the critical value of the preset target access behavior evaluation score.

[0041] In an optional embodiment, when the target access behavior evaluation score exceeds the abnormal score threshold, it indicates that the candidate user has abnormal access behavior when accessing the target platform (for example, maliciously downloading sensitive data), and the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user; when the target access behavior evaluation score is not greater than the abnormal score threshold, it indicates that the candidate user has no abnormal access behavior when accessing the target platform, and the candidate user corresponding to the target access behavior evaluation score is determined as a normal user.

[0042] For example, the target access behavior evaluation score of candidate user A is 0.7b1+0.3c1, the target access behavior evaluation score of candidate user B is 0.7b2+0.3c2, the target access behavior evaluation score of candidate user C is 0.7b3+0.3c3, and the abnormal score threshold is y; if 0.7b1+0.3c1>y, it is determined that the target access behavior evaluation score is greater than the abnormal score threshold, and the candidate user A corresponding to the target access behavior evaluation score 0.7b1+0.3c1 is determined as abnormal user A; if 0.7b2+0.3c2<y, it is determined that the target access behavior evaluation score is not greater than the abnormal score threshold, and the target access behavior evaluation score 0.7 The candidate user B corresponding to b2+0.3c2 is determined to be the normal user B; if 0.7b3+0.3c3<y, it is determined that the target access behavior evaluation score is not greater than the abnormal score threshold, and the candidate user C corresponding to the target access behavior evaluation score 0.7b3+0.3c3 is determined to be the normal user C; an abnormal user prompt is generated according to the abnormal user A, so that the administrator can adjust the target platform access rights of the abnormal user to: allow a preset number of accesses within a preset time when the abnormal user maliciously downloads sensitive data from the target platform or steals platform data, thereby reducing the possibility of the abnormal user accessing the target platform multiple times and causing the platform data to be stolen or leaked.

[0043] In an embodiment of the present invention, first access data of a user accessing a target platform during a preset time period is obtained, and a preset number of candidate users who may have malicious data downloading behavior and first access behavior evaluation scores of the candidate users are determined from the users based on the first access data; then, second access data of the candidate users accessing the target platform during a historical time period before the preset time period is obtained, and the second access behavior evaluation score of the candidate users is determined based on the first access data and the second access data; a target access behavior evaluation score of the candidate user is determined based on the first access behavior evaluation score and the second access behavior evaluation score; when the target access behavior evaluation score is greater than an abnormal score threshold, that is, when the candidate user is determined to be a user who maliciously downloads target platform data, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated, so that the administrator can adjust the target platform access rights of the abnormal user based on the abnormal user prompt, reduce the possibility of platform data being stolen or leaked due to abnormal users accessing the target platform multiple times, improve the accuracy and efficiency of identifying users' malicious downloading of target platform data behavior, and provide a more effective method for identifying abnormal users who maliciously download target platform data behavior; in addition, the abnormal score threshold can be adjusted in real time according to the actual security operation conditions of different enterprises to better adapt to the actual security operations of different enterprises.

[0044] The abnormal user identification method provided by the embodiment of the present invention is further described below. Figure 2 As shown, Figure 2Another flowchart of the abnormal user identification method provided by an embodiment of the present invention may include the following steps:

[0045] Step 201: Acquire first access data of a user accessing a target platform within a preset time period.

[0046] In step 202, the platform data download times, sensitive data download times and user account type are input into the first user access behavior evaluation model to perform user behavior evaluation, and obtain a preset number of first initial access behavior evaluation scores and a user identifier corresponding to the first initial access behavior evaluation scores.

[0047] Among them, the first user access behavior evaluation model can be a local outlier factor (LOF) algorithm model. LOF can be understood as a density-based anomaly detection algorithm. The first access data is input into the LOF algorithm model for user behavior evaluation, and an evaluation score for each user's access behavior to the target platform can be obtained. The LOF algorithm model will output the top 10 evaluation scores from large to small.

[0048] For example, the first access data (number of platform data downloads, number of sensitive data downloads and user account type) generated by 20 users accessing the target platform during a preset time period are obtained, and the number of platform data downloads, number of sensitive data downloads and user account type are input into the LOF algorithm model for user behavior evaluation, and the first initial access behavior evaluation scores of 10 users and the user identifiers corresponding to the first initial access behavior evaluation scores are obtained. In this way, the number of platform data downloads, number of sensitive data downloads and user account type can be combined to perform differentiation and clustering, thereby improving the accuracy and rationality of determining the first initial access behavior evaluation scores, and then improving the accuracy and rationality of determining the first access behavior evaluation scores of candidate users, thereby making the identification of abnormal users more accurate.

[0049] Step 203: Determine the user corresponding to the user identifier as a candidate user.

[0050] Step 204 : Determine a first access behavior evaluation score of the candidate user according to the first initial access behavior evaluation score and the first weight.

[0051] In an embodiment of the present invention, the first weight can be adjusted according to the actual security operation conditions of different enterprises, so that the abnormal user identification method provided by the embodiment of the present invention can better adapt to the actual security operation conditions of different enterprises and enhance the adaptability of the abnormal user identification method.

[0052] Step 205 : Acquire second access data of the candidate user accessing the target platform in a historical time period before the preset time period.

[0053] Step 206 , input the platform data download times, sensitive data download times, and platform data download times and sensitive data download times in a historical time period into a second user access behavior evaluation model to perform user behavior evaluation to obtain a second candidate access behavior evaluation score for the candidate user.

[0054] The second user access behavior evaluation model may be a K-Nearest Neighbor (KNN) classification algorithm model.

[0055] In an optional implementation, after the user behavior evaluation is performed through the LOF algorithm model to determine the candidate user, in order to more accurately determine whether the access data of the candidate user to the target platform is abnormal, the KNN classification algorithm model can be used to determine the second access behavior evaluation score of the user behavior evaluation of each candidate user in the historical time period based on the second access data generated by the access to the target platform during the historical time period of each candidate user; that is, the number of platform data downloads, the number of sensitive data downloads, and the number of platform data downloads and sensitive data downloads in the historical time period can be input into the KNN classification algorithm model to perform user behavior evaluation, and the second candidate access behavior evaluation score of each candidate user can be obtained. In this way, the candidate user can be determined through the user behavior evaluation through the LOF algorithm model. After selecting the user, the KNN classification algorithm model is further used to more accurately determine the second candidate access behavior evaluation score of the candidate user based on the number of platform data downloads and sensitive data downloads in the first access data within the preset time period of the candidate user, and the number of platform data downloads and sensitive data downloads in the second access data in the historical time period, thereby improving the accuracy and rationality of the second candidate access behavior evaluation score, and then improving the accuracy and rationality of the second access behavior evaluation score, so that the target access behavior evaluation score obtained according to the first access behavior evaluation score and the second access behavior evaluation score has higher accuracy, thereby achieving the purpose of identifying abnormal users more quickly according to the target access behavior evaluation score, and improving the accuracy and speed of identifying abnormal users.

[0056] For example, for example, the 10 candidate users include candidate user A, candidate user B, and candidate user C. The preset time period is the current day, the historical time period is the time period of the candidate users in the 15 days before the current day, and the second weight is 0.3; taking candidate user A, candidate user B, and candidate user C as examples, the number of platform data downloads and sensitive data downloads generated by the candidate users when visiting the target platform on the current day, as well as the number of platform data downloads and sensitive data downloads generated when visiting the target platform within the previous 15 days, are input into the KNN classification algorithm model for user behavior evaluation, and the second candidate access behavior evaluation score c1 of candidate user A, the second candidate access behavior evaluation score c2 of candidate user B, and the second candidate access behavior evaluation score c3 of candidate user C are obtained.

[0057] Step 207: Multiply the second candidate access behavior evaluation score by the second weight to obtain the second access behavior evaluation score of the candidate user.

[0058] In an embodiment of the present invention, the second weight can be adjusted according to the actual security operation conditions of different enterprises, so that the abnormal user identification method provided by the embodiment of the present invention can better adapt to the actual security operation conditions of different enterprises and enhance the adaptability of the abnormal user identification method.

[0059] Step 208: Add the first access behavior evaluation score and the second access behavior evaluation score to obtain the target access behavior evaluation score of the candidate user.

[0060] Step 209: When the target access behavior evaluation score is greater than the abnormal score threshold, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated.

[0061] In an embodiment of the present invention, management personnel can adjust the target platform access rights of abnormal users based on abnormal user prompts, reduce the possibility of abnormal users accessing the target platform multiple times and causing platform data to be stolen or leaked, improve the accuracy and efficiency of identifying users' malicious downloading of target platform data, and provide a more effective method for identifying abnormal users who maliciously download target platform data; in addition, the abnormal score threshold can be adjusted in real time according to the actual security operation conditions of different enterprises, so as to better adapt to the actual security operations of different enterprises.

[0062] In an embodiment of the present invention, when the target access behavior evaluation score is greater than the authority adjustment score threshold and the target access behavior evaluation score is not greater than the alarm score threshold, a permission adjustment prompt is generated based on the target access behavior evaluation score and the abnormal user, so that the administrator adjusts the target platform access rights of the abnormal user according to the permission adjustment prompt, the authority adjustment threshold is greater than the abnormal score threshold, and the alarm score threshold is greater than the prompt score threshold.

[0063] For example, the target access behavior evaluation score of abnormal user A is 7, and the permission adjustment score threshold is 3. The target access behavior evaluation score (7) is greater than the permission adjustment score threshold (3). A permission adjustment prompt is generated based on the target access behavior evaluation score and the abnormal user, so that the administrator can adjust the target platform access rights of the abnormal user to the following when the abnormal user maliciously downloads sensitive data from the target platform or steals platform data based on the permission adjustment score prompt: a preset number of accesses are allowed within a preset time, thereby reducing the possibility of the abnormal user accessing the target platform multiple times and causing the platform data to be stolen or leaked.

[0064] In an embodiment of the present invention, when the target behavior score is greater than the warning score threshold, the abnormal user corresponding to the target access behavior evaluation score is identified as a key focus user, and a key focus user prompt is generated based on the key focus user, so that the administrator can activate the monitoring program to monitor the access data of the key focus user accessing the target platform, and the warning score threshold is greater than the prompt score threshold. The warning score threshold can be understood as a preset critical value of the target access behavior evaluation score for generating an alarm prompt.

[0065] For example, the target access behavior evaluation score of abnormal user A is 7, and the warning score threshold is 5. The target access behavior evaluation score (7) is greater than the prompt score threshold (5). The abnormal user A corresponding to the target access behavior evaluation score is determined as a key focus user, and a key focus user prompt is generated based on the key focus user A, so that the administrator can start the monitoring program to monitor the access data of the key focus user A to the target platform. In this way, when the abnormal user is monitored downloading sensitive data from the target platform, the data download operation of the key focus user can be automatically prohibited, thereby timely preventing the platform data from being stolen or leaked by the key focus user.

[0066] The following is a detailed description of the abnormal user identification method provided by the embodiment of the present invention using a specific example. The first access data is the data generated by the user accessing the target platform on the same day, the second access data is the data generated by the user accessing the target platform in the 15 days before the same day, the first user access behavior evaluation model is the LOF algorithm model, the second user access behavior evaluation model is the KNN classification algorithm model, the target access behavior evaluation score is RT, the abnormal score threshold is R1, the authority adjustment score threshold is R2, and the warning score threshold is R3. Figure 3As shown, the first access data of the user visiting the target platform on the same day is obtained from the log platform, and the first access data is input into the LOF algorithm model for user behavior evaluation to obtain a preset number of first initial access behavior evaluation scores and a user identifier corresponding to the first initial access behavior evaluation score; the user corresponding to the user identifier is determined as a candidate user, and the first access behavior evaluation score of the candidate user is determined based on the first initial access behavior evaluation score and the first weight; then the second access data generated by the candidate user visiting the target platform in the previous 15 days is obtained from the log platform, and the first access data and the second access data are input into the KNN classification algorithm model for user behavior evaluation to obtain the second candidate access behavior evaluation score of the candidate user, and the second candidate access behavior evaluation score and the second weight are multiplied to obtain the second access behavior evaluation score of the candidate user; the first access behavior evaluation score and the second access behavior evaluation score are added to obtain the target access behavior evaluation score RT of the candidate user.

[0067] When the target access behavior evaluation score RT exceeds the abnormal score threshold R1, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated; when the target access behavior evaluation score RT is greater than the authority adjustment score threshold R2 and the target access behavior evaluation score RT is not greater than the alarm score threshold R3, a permission adjustment prompt is generated based on the target access behavior evaluation score and the abnormal user, so that the administrator can adjust the target platform access rights of the abnormal user according to the permission adjustment prompt; when the target behavior score is greater than the alarm score threshold R3, the abnormal user corresponding to the target access behavior evaluation score is determined as a key focus user, and a key focus user prompt is generated based on the key focus user, so that the administrator can start the monitoring program to monitor the access data of the key focus user to the target platform.

[0068] In an embodiment of the present invention, when the target access behavior evaluation score is greater than the anomaly score threshold, that is, when the candidate user is determined to be a user who maliciously downloads target platform data, the candidate user corresponding to the target access behavior evaluation score is determined to be an abnormal user, and an abnormal user prompt is generated. In this way, the management personnel can adjust the target platform access rights of the abnormal user according to the abnormal user prompt, reduce the possibility of the abnormal user accessing the target platform multiple times and causing the platform data to be stolen or leaked, improve the accuracy and efficiency of identifying the user's malicious downloading behavior of the target platform data, and provide a more effective method for identifying abnormal users with malicious downloading behavior of the target platform data; in addition, the anomaly score threshold can be adjusted in real time according to the actual situation of security operations of different enterprises, so as to better adapt to the actual situation of security operations of different enterprises.

[0069] Figure 4 This is a schematic diagram of the structure of an abnormal user identification device provided by an embodiment of the present invention, which is suitable for executing the abnormal user identification method provided by an embodiment of the present invention. Figure 4 As shown, the device may specifically include:

[0070] A first determining module 401 is configured to obtain first access data of users accessing a target platform during a preset time period, and determine a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users based on the first access data;

[0071] A second determining module 402 is configured to obtain second access data of the candidate user accessing the target platform in a historical time period before a preset time period, and determine a second access behavior evaluation score of the candidate user based on the first access data and the second access data;

[0072] A third determining module 403 is configured to determine a target access behavior evaluation score for the candidate user based on the first access behavior evaluation score and the second access behavior evaluation score;

[0073] The fourth determining module 404 is configured to determine the candidate user corresponding to the target access behavior evaluation score as an abnormal user and generate an abnormal user prompt when the target access behavior evaluation score is greater than the abnormal score threshold.

[0074] Optionally, the first access data includes the number of platform data downloads, the number of sensitive data downloads, and the user account type by the user within a preset time period. The first determination module 401 determines a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users based on the first access data, including:

[0075] Inputting the platform data download count, the sensitive data download count, and the user account type into a first user access behavior evaluation model to perform user behavior evaluation, and obtaining a preset number of first initial access behavior evaluation scores and a user identifier corresponding to the first initial access behavior evaluation scores;

[0076] The user corresponding to the user identifier is determined as the candidate user, and a first access behavior evaluation score of the candidate user is determined according to the first initial access behavior evaluation score and a first weight.

[0077] Optionally, the first determining module 401 determines the first access behavior evaluation score of the candidate user according to the first initial access behavior evaluation score and the first weight, including:

[0078] The first initial access behavior evaluation score and the first weight are multiplied to obtain the first access behavior evaluation score of the candidate user.

[0079] Optionally, the second access data includes the number of platform data downloads and the number of sensitive data downloads by the user within the historical time period. The second determination module 402 determines the second access behavior evaluation score of the candidate user based on the first access data and the second access data, including:

[0080] Input the platform data download times, the sensitive data download times, and the platform data download times and sensitive data download times in the historical time period into a second user access behavior evaluation model to perform user behavior evaluation to obtain a second candidate access behavior evaluation score for the candidate user;

[0081] The second candidate access behavior evaluation score is multiplied by the second weight to obtain the second access behavior evaluation score of the candidate user.

[0082] Optionally, the third determining module 403 is specifically configured to:

[0083] The first access behavior evaluation score and the second access behavior evaluation score are added together to obtain a target access behavior evaluation score for the candidate user.

[0084] Furthermore, the device also includes:

[0085] The permission adjustment module is used to generate a permission adjustment prompt based on the target access behavior evaluation score and the abnormal user when the target access behavior evaluation score is greater than the permission adjustment score threshold and the target access behavior evaluation score is not greater than the warning score threshold, so that the administrator can adjust the target platform access rights of the abnormal user according to the permission adjustment prompt, the permission adjustment threshold is greater than the abnormal score threshold, and the warning score threshold is greater than the prompt score threshold.

[0086] Optionally, the device further comprises:

[0087] A monitoring module is used to determine the abnormal user corresponding to the target access behavior evaluation score as a key focus user when the target behavior score is greater than the alarm score threshold, and generate a key focus user prompt based on the key focus user, so that the administrator starts a monitoring program to monitor the access data of the key focus user accessing the target platform, and the alarm score threshold is greater than the prompt score threshold.

[0088] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0089] The device of an embodiment of the present invention can obtain first access data of a user accessing a target platform during a preset time period, and determine a preset number of candidate users who may have malicious data downloading behavior and the first access behavior evaluation scores of the candidate users from the users based on the first access data; then obtain second access data of the candidate users accessing the target platform during a historical time period before the preset time period, and determine the second access behavior evaluation score of the candidate users based on the first access data and the second access data; determine the target access behavior evaluation score of the candidate user based on the first access behavior evaluation score and the second access behavior evaluation score; when the target access behavior evaluation score is greater than the abnormal score threshold, that is, when the candidate user is determined to be a user who maliciously downloads target platform data, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated, so that the administrator can adjust the target platform access rights of the abnormal user based on the abnormal user prompt, reduce the possibility of platform data being stolen or leaked due to abnormal users accessing the target platform multiple times, improve the accuracy and efficiency of identifying users' malicious downloading behavior of the target platform, and provide a more effective method for identifying abnormal users who maliciously download target platform data; in addition, the abnormal score threshold can be adjusted in real time according to the actual security operations of different enterprises to better adapt to the actual security operations of different enterprises.

[0090] An embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the abnormal user identification method provided in any of the above embodiments is implemented.

[0091] An embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the abnormal user identification method provided in any of the above embodiments.

[0092] Reference below Figure 5 , which shows a schematic structural diagram of a computer system 500 of an electronic device suitable for implementing an embodiment of the present invention. Figure 5 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0093] like Figure 5 As shown, computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage unit 508 into a random access memory (RAM) 503. Various programs and data required for the operation of computer system 500 are also stored in RAM 503. CPU 501, ROM 502, and RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to bus 504.

[0094] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, and the like; an output section 507 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 508 including devices such as a hard disk; and a communication section 509 including a network interface card such as a LAN card or a modem. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. Removable media 511, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 510 as needed, so that computer programs read therefrom can be installed into the storage section 508 as needed.

[0095] In particular, according to the embodiments disclosed in the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 509, and / or installed from a removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present invention are performed.

[0096] It should be noted that the computer-readable medium described in the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0097] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0098] The modules and / or units described in the embodiments of the present invention may be implemented in software or hardware. The modules and / or units described may also be provided in a processor. For example, a processor may be described as including a first determination module, a second determination module, a third determination module, and a fourth determination module. The names of these modules do not, in some cases, limit the modules themselves.

[0099] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiments, or may exist independently without being incorporated into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the device, the device includes:

[0100] Obtain first access data of users accessing the target platform during a preset time period, and determine a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users based on the first access data; obtain second access data of the candidate users accessing the target platform during a historical time period before the preset time period, and determine the second access behavior evaluation score of the candidate users based on the first access data and the second access data; determine the target access behavior evaluation score of the candidate users based on the first access behavior evaluation score and the second access behavior evaluation score; when the target access behavior evaluation score is greater than the abnormal score threshold, determine the candidate user corresponding to the target access behavior evaluation score as an abnormal user, and generate an abnormal user prompt.

[0101] According to the technical solution of the embodiment of the present invention, first access data of users accessing the target platform in a preset time period can be obtained, and a preset number of candidate users who may have malicious data downloading behavior and first access behavior evaluation scores of the candidate users can be determined from the users based on the first access data; then second access data of the candidate users accessing the target platform in a historical time period before the preset time period is obtained, and the second access behavior evaluation score of the candidate users can be determined based on the first access data and the second access data; the target access behavior evaluation score of the candidate user can be determined based on the first access behavior evaluation score and the second access behavior evaluation score; when the target access behavior evaluation score is greater than the abnormal score threshold, that is, when the candidate user is determined to be a user who maliciously downloads target platform data, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated, so that the administrator can adjust the target platform access rights of the abnormal user based on the abnormal user prompt, reduce the possibility of platform data being stolen or leaked due to abnormal users accessing the target platform multiple times, improve the accuracy and efficiency of identifying users' malicious downloading behavior of the target platform data, and provide a more effective method for identifying abnormal users with malicious downloading behavior of the target platform data; in addition, the abnormal score threshold can be adjusted in real time according to the actual security operation conditions of different enterprises, so as to better adapt to the actual security operations of different enterprises.

[0102] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal users, characterized in that: The method comprises: Acquire first access data of users accessing the target platform in a preset time period, and determine a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users according to the first access data; Acquire second access data of the candidate user accessing the target platform in a historical time period before a preset time period, and determine a second access behavior evaluation score of the candidate user based on the first access data and the second access data; Determine a target access behavior evaluation score for the candidate user according to the first access behavior evaluation score and the second access behavior evaluation score; When the target access behavior evaluation score is greater than the abnormal score threshold, the candidate user corresponding to the target access behavior evaluation score is determined as an abnormal user, and an abnormal user prompt is generated.

2. The method according to claim 1, characterized in that The first access data includes the number of platform data downloads, the number of sensitive data downloads, and the user account type of the user within a preset time period, and determining a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users according to the first access data includes: Input the platform data download times, the sensitive data download times and the user account type into a first user access behavior evaluation model to perform user behavior evaluation, and obtain the preset number of first initial access behavior evaluation scores and the user identifier corresponding to the first initial access behavior evaluation scores; The user corresponding to the user identifier is determined as the candidate user, and a first access behavior evaluation score of the candidate user is determined according to the first initial access behavior evaluation score and a first weight.

3. The method according to claim 2, characterized in that The step of determining the first access behavior evaluation score of the candidate user according to the first initial access behavior evaluation score and the first weight includes: The first initial access behavior evaluation score and the first weight are multiplied to obtain the first access behavior evaluation score of the candidate user.

4. The method according to claim 2, characterized in that: The second access data includes the number of platform data downloads and the number of sensitive data downloads by the user in the historical time period, and determining the second access behavior evaluation score of the candidate user according to the first access data and the second access data includes: The platform data download times, the sensitive data download times, and the platform data download times and the sensitive data download times in the historical time period are input into a second user access behavior evaluation model to perform user behavior evaluation to obtain a second candidate access behavior evaluation score for the candidate user; The second candidate access behavior evaluation score is multiplied by the second weight to obtain the second access behavior evaluation score of the candidate user.

5. The method according to claim 1, characterized in that The step of determining the target access behavior evaluation score of the candidate user according to the first access behavior evaluation score and the second access behavior evaluation score includes: The first access behavior evaluation score and the second access behavior evaluation score are added together to obtain a target access behavior evaluation score for the candidate user.

6. The method according to claim 1, characterized in that The method further comprises: When the target access behavior evaluation score is greater than the authority adjustment score threshold and the target access behavior evaluation score is not greater than the warning score threshold, a permission adjustment prompt is generated based on the target access behavior evaluation score and the abnormal user, so that the administrator adjusts the target platform access rights of the abnormal user according to the permission adjustment prompt, the authority adjustment threshold is greater than the abnormal score threshold, and the warning score threshold is greater than the prompt score threshold.

7. The method according to claim 6, characterized in that The method further comprises: When the target behavior score is greater than the alarm score threshold, the abnormal user corresponding to the target access behavior evaluation score is determined as a key focus user, and a key focus user prompt is generated based on the key focus user, so that the administrator starts a monitoring program to monitor the access data of the key focus user accessing the target platform.

8. An abnormal user identification device, characterized in that: The device comprises: A first determination module is used to obtain first access data of users accessing the target platform in a preset time period, and determine a preset number of candidate users and first access behavior evaluation scores of the candidate users from the users according to the first access data; A second determination module is used to obtain second access data of the candidate user accessing the target platform in a historical time period before a preset time period, and determine a second access behavior evaluation score of the candidate user based on the first access data and the second access data; A third determination module, configured to determine a target access behavior evaluation score of the candidate user according to the first access behavior evaluation score and the second access behavior evaluation score; The fourth determination module is used to determine the candidate user corresponding to the target access behavior evaluation score as an abnormal user and generate an abnormal user prompt when the target access behavior evaluation score is greater than the abnormal score threshold.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the abnormal user identification method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the abnormal user identification method according to any one of claims 1 to 7 is implemented.

Images