A method and system for risk assessment of online behavior

Abstract

This invention discloses a network behavior risk assessment method and system that emphasizes both recording behavior and restoring content, enabling real-time control while preserving complete historical evidence. It monitors network behavior and communication content in the network environment in real time, centrally collects, records, analyzes, and processes network access data, and focuses on recording both behavior and content. Furthermore, it uses formulas to correlate the two to calculate risk values, thereby quantifying and assessing various types of IP risks. This provides a foundation for subsequent security measures such as information auditing, ensuring the security of the internal network.

Description

Technical Field

[0001] This invention belongs to the field of network and information security technology, and in particular relates to a risk assessment method and system for statistically analyzing network access data of IP addresses and calculating different types of risk values. Background Technology

[0002] With the rapid development of information technology and the application of network information systems, the information technology revolution, represented by the Internet, is impacting and changing all aspects of social production and life. However, while creating enormous value through high efficiency, it also brings numerous security risks. These include legal risks from the proliferation of vulgar and reactionary content, the risk of leaks due to the arbitrary transmission of technical data and trade secrets, the risk to work efficiency from employees' ineffective activities during working hours, and the risk to business stability from unreasonable bandwidth resource usage. The long-term existence of these problems can affect the normal operation of enterprises or organizations, and may even lead to irreparable losses.

[0003] To protect business systems and network information data from attacks, especially damage, leaks, and theft from internal users, various technical means are used to monitor network behavior in the local network environment in real time. This enables control over network behavior, reduces various risks, and ensures network security.

[0004] However, current network monitoring and risk assessment technologies mainly focus on recording and controlling behavior, and lack comprehensive solutions for reconstructing the content of the behavior involved, as well as risk assessment based on both behavior and content. Summary of the Invention

[0005] In view of the above technical background, the present invention aims to propose a network behavior risk assessment method and system that focuses on both recording behavior and restoring content, that is, it can control in real time and preserve complete historical evidence, in order to solve the above technical problems.

[0006] The technical solution adopted by this invention to solve this technical problem includes two aspects: risk assessment method and risk assessment system.

[0007] On the one hand, a method for risk assessment of network behavior is provided, including: extracting network access data based on IP address, performing behavioral feature matching to identify the type of access behavior; statistically analyzing the behavior and content records of the IP address on a specific website or application within a specific time period; calculating the risk values ​​of the IP address for different types within the specific time period based on the statistical results; and auditing the original network behavior logs of IP addresses with risk values ​​greater than a preset threshold under the same type of risk.

[0008] Preferably, before acquiring network access data, the following are included: a preset behavioral feature library for determining access behavior types; and configurations for behavioral coefficients and content coefficients, risk type weights, content keyword feature library, and keyword weights corresponding to different behavior types.

[0009] Specifically, the behavior feature library pre-defines the correspondence between behavior features and behavior types. The behavior features include transport layer protocols, application layer protocols, message length, port fields, website or application keywords, and specific flag bits and fields.

[0010] Identifying the type of access behavior includes: extracting the content of access data, matching it with the behavior feature database, and obtaining the successfully matched behavior type when preset conditions are met; and determining the name of the accessed website or application based on the title or body keywords.

[0011] Furthermore, the behavior coefficient and content coefficient of the behavior type are positively correlated with the traffic proportion of webpage or application clicks and content interactions in the access behavior; the click behavior includes search operations; the risk type weight of the behavior type is positively correlated with the degree of correlation between the access behavior and different risk types; the risk types include resignation risk, leakage risk, work efficiency risk and illegal risk; the content keyword feature library of the behavior type presets the correspondence between behavior types and keywords; the weight of the keyword in this behavior type is positively correlated with the number of times it appears in historical statistics.

[0012] Calculate various types of risk values ​​for an IP address, including: statistically analyzing the IP's behavior and content records on a specific website or application within a specific time period; the behavior records include the number of visits to the website or application and the access traffic; the content records include the keywords or key words hit in the website or application's title, body, attachments, files, and interactive messages, as well as the content traffic that occurred.

[0013] Extract access behavior records and content records from a specific IP address within a specific time period whose specific risk weight exceeds a preset threshold. Calculate the risk value for that IP address for that type of risk: (Behavior Coefficient * Behavior Traffic) * (Behavior Weight * Behavior Frequency) + (Content Coefficient * Content Keyword Traffic) * (Content Keyword Weight * Content Keyword Frequency), where: the behavior weight is the sum of the weights of all websites or applications under this risk type, and the weight of the website or application is positively correlated with its overall network access ranking; the behavior frequency is the sum of all access frequencies under this risk type; the content keyword frequency is the sum of the keyword and keyword trigger frequencies of all access behaviors under this risk type; and the keyword weight is the sum of the keyword weights triggered by all access behaviors under this risk type.

[0014] On the other hand, a risk assessment system for online behavior is provided, including:

[0015] A network data processing device is used to acquire network access data of an IP address, perform behavioral feature matching, identify the type of behavior, and statistically record the behavior and content of the IP address on a specific website or application within a specific time period.

[0016] Data storage device for storing raw IP network behavior logs, as well as behavior feature database, content keyword feature database and preset configuration;

[0017] A statistical computing device is used to statistically analyze the behavior and content records of an IP address and to calculate various types of risk values ​​for that IP address.

[0018] The log auditing device is used to audit the raw network behavior logs of IPs whose risk values ​​exceed a preset threshold under the same type of risk.

[0019] Based on the above technical solution, this invention has the following beneficial effects: Through analysis of historical data, a behavioral feature database, a content keyword feature database, and a risk type weight configuration are established; the acquired network data is matched with the behavioral feature database to identify the network behavior types of IPs; behavioral and content records within a specific time period are statistically analyzed based on the behavioral types, and the statistical results are input into a risk value calculation formula to obtain a specific type of risk value for the IP; and the original network behavior logs of IPs with risk values ​​greater than a preset threshold under the same type of risk are audited. This allows for real-time monitoring of network behavior and communication content in the network environment, centralized collection, recording, analysis, and processing of network access data, with a focus on recording both behavior and content, and using formulas to correlate the two to calculate risk values, thereby quantifying and assessing various types of IP risks. This provides a foundation for subsequent security measures such as information auditing, ensuring intranet security. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the overall workflow of the network behavior risk assessment method according to an embodiment of the present invention;

[0021] Figure 2 This is a schematic diagram of the component structure of an embodiment of the network behavior risk assessment system of the present invention;

[0022] Figure 3 This is a schematic diagram of data flow relationships for a network behavior risk assessment method according to an embodiment of the present invention. Detailed Implementation

[0023] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0024] like Figure 1 As shown, the online behavior risk assessment method includes the following main steps:

[0025] S1 matches the acquired IP network data with the behavioral feature database to identify the behavioral type.

[0026] The behavior types described in the embodiments of the present invention can include access behaviors of websites or applications (APPs) such as HTTP applications, video websites, P2P downloads, shopping payments, games, instant messaging and social networking, stocks, online banking, network storage, webmail, software updates, and remote control. When the same website or application matches two or more behavior types, it can be classified into the category with more successfully matched features.

[0027] The behavior feature database includes the correspondence between behavior features and behavior types. Behavior features include transport layer protocols, application layer protocols, message length, port fields, website or application keywords, specific flag bits and fields, etc. Identifying the type of access behavior includes: extracting the content of access data and matching it with the behavior feature database. When preset conditions are met, the successfully matched behavior type is obtained. Also, determining the name of the accessed website or application based on the title or body keywords.

[0028] The different behavior types also have corresponding: behavior coefficient and content coefficient configurations, risk type weight configurations, content keyword feature libraries, and keyword weights; wherein:

[0029] The behavior coefficient and content coefficient of the behavior type are positively correlated with the traffic proportion of webpage or application clicks and content interactions in the access behavior; the click behavior includes search operations;

[0030] The risk type weight of the behavior type is positively correlated with the degree of correlation between the access behavior and different risk types; the risk types include turnover risk, leakage risk, work efficiency risk and illegal risk.

[0031] The content keyword feature library for behavior types predetermines the correspondence between behavior types and keywords; the weight of a keyword in a particular behavior type is positively correlated with the number of times it appears in historical statistics.

[0032] S2, based on the behavior type determined in S1, statistically analyze the behavior records and content records within a specific time period.

[0033] This system tracks the behavior and content of IP addresses on specific websites or applications within a specific time period. The behavior records include the number of visits to the website or application and the access traffic. The content records include the keywords or key phrases hit in the website or application's title, body, attachments, files, and interactive messages, along with the number of hits and the content traffic generated.

[0034] S3, based on the statistical results in S2, calculates the risk values ​​of different types of IP using the risk value calculation formula.

[0035] Extract access behavior records and content records from a specific IP address within a specific time period whose specific risk weight exceeds a preset threshold. Calculate the risk value for that IP address for that type of risk: (Behavior Coefficient * Behavior Traffic) * (Behavior Weight * Behavior Frequency) + (Content Coefficient * Content Keyword Traffic) * (Content Keyword Weight * Content Keyword Frequency), where:

[0036] The behavioral weight is the sum of the weights of all websites or applications under this risk type, and the weight of the website or application is positively correlated with its access ranking among similar websites or applications across the entire network.

[0037] The number of actions is the sum of all access counts under this risk type;

[0038] The number of keyword occurrences is the sum of the number of keyword and keyword triggers for all access behaviors under this risk type;

[0039] The content keyword weight is the sum of the keyword weights triggered by all access behaviors under this risk type.

[0040] S4. Determine the type of risk that needs to be audited, extract the original IP logs of the type of risk that is greater than the preset value, and perform security auditing according to the audit policy.

[0041] As a preferred implementation, a risky IP whitelist is configured in advance. If network access data from IPs in the whitelist is obtained, it is filtered out.

[0042] like Figure 2 As shown, the online behavior risk assessment system includes:

[0043] A network data processing device is used to acquire network access data of an IP address, perform behavioral feature matching, identify the corresponding behavioral type, and statistically analyze the behavioral and content records of the IP address on a specific website or application within a specific time period. Identifying the type of access behavior includes: extracting the content of the access data, matching it with the behavioral feature database, and obtaining the successfully matched behavioral type when preset conditions are met; and determining the name of the accessed website or application based on the title or text keywords.

[0044] A data storage device is used to store raw IP network behavior logs, as well as a behavior feature library, a content keyword feature library, and preset configurations. The behavior feature library presets the correspondence between behavior features and behavior types. The behavior features include transport layer protocols, application layer protocols, message length, port fields, website or application keywords, and specific flag bits and fields.

[0045] A statistical calculation device is used to collect behavioral and content records of an IP address and calculate various types of risk values ​​for that IP. The device collects behavioral and content records of an IP address on a specific website or application within a specific time period. Behavioral records include the number of visits and traffic to the website or application. Content records include keywords or key phrases in the website or application's title, body, attachments, files, and interactive messages, along with the number of hits and the resulting content traffic. The device extracts access behavior and content records from the statistical results of a specific IP address within a specific time period whose specific risk weight is greater than a preset threshold, and calculates the risk value for that type of IP address as: (behavior coefficient * behavior traffic) * (behavior weight * number of behaviors) + (content coefficient * content keyword traffic) * (content keyword count * keyword weight).

[0046] The log auditing device is used to audit the raw network behavior logs of IPs whose risk values ​​exceed a preset threshold under the same type of risk.

[0047] The above technical solution will be specifically described below with reference to a preferred embodiment.

[0048] Example 1

[0049] First, set up the relevant configuration tables and feature libraries for risk assessment, including a behavior feature library for identifying access behavior types, a behavior type configuration table with preset behavior coefficients and content coefficients, a content keyword feature library for matching access keywords, a behavior weight table for configuring behavior weights, and a content keyword weight table for configuring content weights.

[0050] It can specify four types of monitored behaviors: recruitment, video, email, and forum, as well as four types of risks: resignation, leakage of information, work efficiency, and legal issues. Through web scraping, statistics, and big data analysis, it can obtain behavior type configuration information as shown in Table 1 and content keyword feature library as shown in Table 2.

[0051] Table 1, Behavior Type Configuration Table

[0052]

[0053] The behavior coefficient and content coefficient are positively correlated with the proportion of webpage or application clicks and content interactions in the overall access behavior. This proportion can be derived from at least one of the following: traffic proportion, frequency proportion, duration proportion, or a combination thereof. In this embodiment, for recruitment and forum websites or applications, the proportions of browsing and content input (i.e., behavioral operations and content interactions) are similar, and therefore assigned equal coefficients. For video websites or applications, a larger amount of data is downloaded after the behavioral operation, so the content coefficient is much larger than the behavior coefficient. Email websites or applications fall between video and recruitment websites / applications.

[0054] The risk weight allocation is positively correlated with the degree of relevance of the access behavior to different risk types. In this embodiment, relatively speaking, recruitment-related risks have the highest turnover risk, video-related risks have the highest work efficiency risk, email-related risks have the highest information leakage risk, and forum-related risks have the highest legal risk. Of course, this does not mean that there are no other risks. The minimum risk weight can be set as needed (such as 0.1 in this embodiment), and the other risk weights can be set between the highest and lowest risk.

[0055] Table 2, Content Keyword Feature Database

[0056]

[0057] The keywords shown in the table are for illustrative purposes only and do not list all possible keywords / words. In practice, web crawler software can be used to crawl relevant websites across the entire internet.

[0058] Based on the content in Table 2, further statistical analysis of the number of times related keywords are triggered for different behavior types can yield the weights of different content keywords. For example, on recruitment websites, "salary" is matched and triggered the most times within a specific time period, thus receiving the highest weight. In practice, the total number of times all keywords trigger for this type of behavior can be counted, and then the weight of each keyword can be determined based on its proportion of trigger times.

[0059] To obtain network access data from an IP address, the behavior type can be determined based on the website or application name, transport layer protocol, application layer protocol, message length, port field, website or application keywords, and specific flags and fields. Common protocols include: internet protocols such as HTTP, HTTPS, SMTP, and POP; database protocols such as Oracle, MS-SQL, MySQL, DB2, and PostgreSQL; file operation protocols such as FTP, NFS, and NetBIOS; and operation and maintenance protocols such as Telenet, Rlogin, X11, and others such as Radius and LDAP.

[0060] For example, if a risk assessment needs to be conducted on IP1, its network access data should be obtained first. If it is identified that the website or application access includes Boss Zhipin and Zhaopin, then the recruitment-related behavior records and content records of IP1 should be collected within a certain period of time (such as three days).

[0061] Among them, the behavior records include: the number of visits to recruitment websites or applications, and the traffic of the visits; the visits include operations such as account login, menu or button clicks, page turning, etc., the number of behaviors is the total number of login, click and other operations, and the traffic of the behaviors is the total traffic consumed after the loading is completed after the operation.

[0062] The content records include: the number of keyword hits in the interaction content between IP1 and recruitment websites or applications, content interaction traffic, and content interaction duration; the content interactions include uploading and downloading attachments or files, sending and receiving information, etc.

[0063] The turnover risk value of IP1 can be calculated according to the formula: (behavior coefficient * behavior traffic) * (behavior weight * behavior frequency) + (content coefficient * content keyword traffic) * (content keyword weight * content keyword frequency).

[0064] The behavior coefficient and content coefficient are retrieved from the behavior type configuration table in Table 1, while the behavior traffic, behavior frequency, content keyword traffic, and content keyword frequency are obtained from the statistical results.

[0065] And: The behavioral weight is the sum of the weights of all websites or applications under this risk type. The weight of the website or application is positively correlated with its access ranking among similar websites or applications across the entire network. For example, if Boss Zhipin and Zhaopin.com have similar rankings among recruitment websites across the entire network, they can be assigned weights of 0.5 and 0.5 respectively.

[0066] The content keyword weight is the sum of the keyword weights triggered by all access behaviors under this risk type. For example, if IP1 accesses these two recruitment websites and hits the three keywords "work experience", "salary", and "resume" a total of 100 times, and each keyword is hit 60 times, 30 times, and 10 times respectively, then the weights of these three content keywords are 0.6, 0.3, and 0.1 respectively.

[0067] Using the method described above, the turnover risk value of other IPs within the network can be calculated. Furthermore, the original network access logs of the top-ranking IPs in terms of turnover risk value during the aforementioned time period can be retrieved, and the information audit system's policies can be invoked for further analysis and confirmation.

[0068] In practice, you can exclude unwanted monitoring activities by setting up a whitelist of IP addresses. For example, you can exclude HR-related IP addresses from recruitment website statistics and turnover risk assessments, finance department IP addresses from tax and financial website statistics and attendance risk assessments, and public relations department IP addresses from forum website statistics and information leakage risk assessments.

[0069] As a preferred implementation, if IP1's network access behavior also includes other types, such as video, email, etc., the corresponding risk values ​​are calculated according to the method described above.

Claims

1. A method for risk assessment of online behavior, characterized in that, include: A pre-defined behavioral feature library is used to determine the type of access behavior, as well as the configuration of behavioral coefficients and content coefficients corresponding to different behavioral types, risk type weight configuration, content keyword feature library and keyword weight; the behavioral features include transport layer protocol, application layer protocol, message length, port field, website or application keywords, specific flag bits and fields; Network access data is extracted from the IP address and behavioral feature matching is performed to identify the type of access behavior; the behavior records and content records of the IP address on a specific website or application within a specific time period are statistically analyzed; the behavior records include the number of times the website or application is accessed and the access traffic; the content records include the keywords or key words hit by the website or application and the number of times they are hit, as well as the content traffic that occurs; Based on the statistical results, calculate the risk values ​​of different types for the IP within the specific time period: extract the access behavior records and content records of the specific IP with a specific risk weight greater than a preset threshold in the statistical results of the specific time period, and calculate the risk value of that type for the IP: (behavior coefficient * behavior traffic) * (behavior weight * behavior frequency) + (content coefficient * content keyword traffic) * (content keyword weight * content keyword frequency); the behavior coefficient and content coefficient are positively correlated with the traffic proportion of webpage or application clicks and content interactions in the access behavior, and click behavior includes search operations; the behavior weight is the sum of the weights of all websites or applications under this risk type, and the weight of a website or application is positively correlated with its access ranking on the entire network of similar websites or applications; the behavior frequency is the sum of all access frequency under this risk type; the keyword weight is the sum of the keyword weights triggered by all access behaviors under this risk type; the content keyword frequency is the sum of the keyword and keyword trigger frequency of all access behaviors under this risk type. Audit the original network behavior logs of IPs whose risk values ​​exceed a preset threshold under the same type of risk.

2. The risk assessment method according to claim 1, characterized in that, The identification of access behavior types includes: extracting the content of access data, matching it with the behavior feature database, and obtaining the successfully matched behavior type when preset conditions are met; and determining the name of the accessed website or application based on title or text keywords.

3. The risk assessment method according to claim 1, characterized in that, The risk type weight of the behavior type is positively correlated with the degree of correlation between the access behavior and different risk types; the risk types include turnover risk, leakage risk, work efficiency risk and illegal risk. The content keyword feature library for behavior types pre-defines the correspondence between behavior types and keywords; The weight of keywords in this type of behavior is positively correlated with the number of times they appear in historical statistics.

4. The risk assessment method according to claim 1, characterized in that, The keywords or key terms mentioned in the website or application include the website or application's title, body text, attachments, files, and interactive messages.

5. The risk assessment method according to claim 1, characterized in that, Configure a risky IP whitelist; if network access data from IPs on the whitelist is obtained, it will be filtered out.

6. A network behavior risk assessment system, implementing the network behavior risk assessment method as described in claim 1, characterized in that, include: The data storage device is used to store raw IP network behavior logs, as well as a behavior feature library for determining access behavior types, and configurations of behavior coefficients and content coefficients, risk type weights, content keyword feature libraries, and keyword weights for different behavior types; the behavior features include transport layer protocols, application layer protocols, message lengths, port fields, website or application keywords, and specific flag bits and fields. A network data processing device is used to acquire network access data of an IP address, perform behavioral feature matching, identify the corresponding behavioral type, and statistically analyze the behavior records and content records of the IP address on a specific website or application within a specific time period. The behavioral records include the number of visits to the website or application and the access traffic. The content records include the keywords or key words hit by the website or application and the number of hits, as well as the content traffic generated. The statistical calculation device extracts access behavior records and content records of a specific IP address within a specific time period whose specific risk weight exceeds a preset threshold. Based on the statistical results, it calculates the risk value for that IP address for that type of access behavior: (behavior coefficient * behavior traffic) * (behavior weight * behavior frequency) + (content coefficient * content keyword traffic) * (content keyword weight * content keyword frequency). The behavior coefficient and content coefficient are positively correlated with the traffic proportion of webpage or application clicks and content interactions within the access behavior. Click behavior includes search operations. The behavior weight is the sum of the weights of all websites or applications under this risk type, and the weight of a website or application is positively correlated with its access ranking among similar websites or applications across the entire network. The behavior frequency is the sum of all access frequency under this risk type. The keyword weight is the sum of the keyword weights triggered by all access behaviors under this risk type. The content keyword frequency is the sum of the keyword and keyword trigger frequency of all access behaviors under this risk type.

7. The risk assessment system according to claim 6, characterized in that, It also includes a log auditing device for auditing the original network behavior logs of IPs whose risk values ​​exceed a preset threshold under the same type of risk.

Images