User audit method, system, electronic device, and storage medium

Abstract

The present disclosure provides a user audit method, system, electronic device and computer readable storage medium to solve the technical problems of difficult and low efficiency of user audit, the method comprising: exporting system logs formed by user operations in a preset time period, extracting keywords from data in the system logs and forming a reference dictionary after processing according to a preset method; extracting keywords from user data to be audited, classifying the extracted keywords according to the reference dictionary, and forming a knowledge graph; matching the user data to be audited according to the knowledge graph, and establishing the risk level of the user according to the matching result and a preset rule. The technical scheme of the present disclosure can automatically and efficiently identify abnormal users and improve the identification accuracy.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network security, in particular to a user auditing method, a user auditing system, an electronic device and a computer readable storage medium. BACKGROUND

[0002] At present, the auditing of internal users of enterprises mainly relies on manual means, and abnormal users are found out by periodically analyzing system logs. System logs are behavior records of information systems expressed according to certain specifications, and play a significant role in the auditing analysis and traceability tracking of network security. However, for large enterprises, their network systems are generally complex, there are numerous personnel accounts, and there are various types of log data. Moreover, the knowledge and technology involved in log analysis are quite extensive. It is often difficult to find all abnormal users by relying only on firewall alarm information and manual directory auditing, and it requires a lot of manpower and time, which is extremely disadvantageous for enterprise network security protection. SUMMARY

[0003] In order to at least solve the technical problems of difficult user auditing and low efficiency in the prior art, the present disclosure provides a user auditing method, a user auditing system, an electronic device and a computer readable storage medium, which can automatically and efficiently identify abnormal users, improve identification accuracy, and realize monitoring and management of user behavior, as well as investigation and evidence collection of illegal operations and leakage behavior.

[0004] In a first aspect, the present disclosure provides a user auditing method, which comprises:

[0005] Exporting system logs formed by user operations in a preset time period, extracting keywords from data in the system logs and forming a reference dictionary after processing according to a preset method;

[0006] Extracting keywords from user data to be audited, classifying the extracted keywords with reference to the reference dictionary, and forming a knowledge graph;

[0007] Matching the user data to be audited according to the knowledge graph, and establishing a risk level of the user according to a matching result and a preset rule.

[0008] Further, the extracting keywords from data in the system logs and forming a reference dictionary after processing according to a preset method comprises:

[0009] Extracting keywords from data in the system logs after cleaning the data;

[0010] Determine the word frequency and part of speech of the extracted keywords, and determine the weight of the nodes and edges between the nodes using a preset hash table, wherein the nodes are keywords, and the edges are the connections between the keywords, to form a full graph containing all keywords and the relationships between the keywords as a reference dictionary.

[0011] Further, the keyword extraction of the user data to be audited, and the classification of the extracted keywords with reference to the reference dictionary, include:

[0012] Using the wordnet dictionary to extract keywords and disambiguate speech from the user data to be audited, and using a Bayesian classifier to classify the extracted keywords with reference to the reference dictionary.

[0013] Further, the method further includes:

[0014] After the formation of the knowledge graph, the knowledge graph is visualized by means of a Java toolkit.

[0015] Further, the items to be matched according to the knowledge graph include at least one of abnormal login time, abnormal increase, deletion and modification operation, permission change and abnormal location login.

[0016] The matching of the user data to be audited according to the knowledge graph, and the establishment of the risk level of the user according to the matching result and the preset rules, include:

[0017] The matching of the user data to be audited according to the knowledge graph, and the establishment of the risk level of the user according to the matching result and the preset rules, include:

[0018] The evaluation function is:

[0019] ,

[0020] Wherein, if the matching result is that the i-th item of user data conforms to the i-th item of security rule, x i=0, otherwise, x i=1, i takes 1 to n in turn; is the basic coefficient, , …, are preset coefficient values corresponding to each item.

[0021] In a second aspect, the present disclosure improves a user audit system, which includes:

[0022] a processing module configured to export system logs formed by user operations in a preset time period, extract keywords from data in the system logs, and form a reference dictionary by processing the keywords according to a preset method;

[0023] a knowledge graph production module configured to extract keywords from user data to be audited, classify the extracted keywords according to the reference dictionary, and form a knowledge graph;

[0024] a matching module configured to match the user data to be audited according to the knowledge graph, and establish a risk level of the user according to a matching result and a preset rule.

[0025] Further, the knowledge graph production module is specifically configured to:

[0026] extract keywords from the user data to be audited and disambiguate speech using a wordnet dictionary, and classify the extracted keywords using a Bayesian classifier with reference to the reference dictionary.

[0027] Further, the items of matching the user data to be audited according to the knowledge graph include at least one of an abnormal login time, an abnormal increase, a deletion and modification operation, a permission change, and an abnormal location login.

[0028] The matching module is specifically configured to:

[0029] match the user data to be audited according to the knowledge graph item by item, calculate a risk value of the user according to a matching result and a preset evaluation function, and establish a risk level of the user according to the calculated risk value of the user.

[0030] The evaluation function is:

[0031] ,

[0032] wherein, if the matching result is that the i-th item of user data meets the i-th item of security rules, then x i=0, otherwise, x i=1, i is sequentially taken as 1 to n; is a basic coefficient, 、 …、 are preset coefficient values corresponding to each item.

[0033] In a third aspect, the present disclosure provides an electronic device including a memory and a processor, the memory storing a computer program, and when the processor runs the computer program stored in the memory, the processor executes the user auditing method according to any one of the first aspect.

[0034] In a fourth aspect, the present disclosure provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the user auditing method of any one of the first aspect.

[0035] Advantages:

[0036] The user auditing method, the user auditing system, the electronic device and the computer readable storage medium provided by the present disclosure export the system log formed by the user operation in a preset time period, extract keywords from the data in the system log and form a reference dictionary by processing the keywords according to a preset method; extract keywords from the user data to be audited, classify the extracted keywords according to the reference dictionary, and form a knowledge graph; match the user data to be audited according to the knowledge graph, and establish the risk level of the user according to the matching result and a preset rule. The technical scheme of the present disclosure analyzes the abnormal behavior of the user in the enterprise intranet, forms a reference dictionary, establishes a knowledge graph according to the operation data of the user to be audited, analyzes the operation behavior of the user according to the knowledge graph, and finally outputs the risk value of the user, thereby automatically and efficiently identifying the abnormal user, improving the identification accuracy, realizing the monitoring and management of the user behavior, and tracing the evidence of the illegal operation and the leakage behavior. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 A flowchart of an abnormal user auditing method provided by the first embodiment of the present disclosure is shown in the figure;

[0038] Figure 2 A knowledge graph structure diagram formed after the knowledge graph provided by the first embodiment of the present disclosure is converted from the data layer to the concept layer is shown in the figure;

[0039] Figure 3 An abnormal login result diagram output by the first embodiment of the present disclosure is shown in the figure;

[0040] Figure 4 An abnormal user auditing system architecture diagram provided by the second embodiment of the present disclosure is shown in the figure;

[0041] Figure 5 An architecture diagram of an electronic device provided by the third embodiment of the present disclosure is shown in the figure. DETAILED DESCRIPTION

[0042] In order for those skilled in the art to better understand the technical scheme of the present disclosure, the present disclosure will be described in further detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are only used to explain the present disclosure, and not to limit the present disclosure.

[0043] It should be noted that the terms "first", "second", etc. in the description of the present disclosure and the claims and the above drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence; and, without conflict, the embodiments in the present disclosure and the features in the embodiments can be combined with each other at will.

[0044] The terms used in the embodiments of the present disclosure are merely for the purpose of describing specific embodiments, and are not intended to limit the present disclosure. The singular forms "a", "said" and "the" used in the embodiments of the present disclosure and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0045] In the following description, the suffixes such as "module", "component", or "unit" used to represent elements are merely for the convenience of description of the present disclosure, and have no specific meaning. Therefore, "module", "component", or "unit" can be used interchangeably.

[0046] At present, when auditing abnormal users, relying on firewall alarm information and manual directory audit is to find the characteristics and differences between normal log content and attack log content, which is to analyze single log, and the abnormal user detection result is not accurate, it is often difficult to find all abnormal users, and it needs to spend a lot of manpower and time, which is extremely unfavorable for enterprise network security protection.

[0047] The technical solutions of the present disclosure and how the technical solutions of the present disclosure solve the above problems will be described in detail in specific embodiments. The following several specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0048] Figure 1 A flowchart of an abnormal user auditing method provided by Embodiment One of the present disclosure is shown in FIG. 1, which comprises the following steps. Figure 1 As shown in FIG. 1, the method comprises the following steps.

[0049] Step S101: exporting system logs formed by user operations in a preset time period, extracting keywords from data in the system logs and forming a reference dictionary after processing according to a preset method;

[0050] Step S102: extracting keywords from user data to be audited, classifying the extracted keywords with reference to the reference dictionary, and forming a knowledge graph;

[0051] Step S103: matching the user data to be audited according to the knowledge graph, and establishing the risk level of the user according to the matching result and a preset rule.

[0052] The system log is information recording hardware, software and system problems in the system, which can monitor events occurring in the system. After exporting the system log formed by user operations, keywords in the log data are extracted, such as account, login, verification, access, add, delete, modify, query, access IP, access time, protocol, etc. After processing the keywords and the relationship between the keywords, a reference dictionary (referred to as a dictionary) is formed. The reference dictionary can be regarded as a full graph containing all keywords and the relationship between the keywords. The user data (intranet log data) to be audited is also subjected to keyword extraction. The keywords (nodes) obtained this time are a subset of the previous reference, because the log this time may involve the association between two keywords, or may not involve the association relationship between the two keywords. The obtained dictionary can be regarded as a full data set. After keyword extraction, the reference dictionary formed can be referred to, and the extracted keywords are classified and the knowledge graph of the intranet user audit features is made. The user data is matched according to the knowledge graph. Specifically, it can be matched in order. The obtained knowledge graph is arranged in a form similar to Figure 2 If a certain line is judged, the next line is automatically matched in order. If it is not involved this time, the item is skipped. When matching, the corresponding rules are determined in advance with network security experts, and each item is matched according to the rules to determine whether each item is in violation, and the evaluation risk value of all items is calculated. According to the risk value, the risk level of the user is determined. Referring to the reference dictionary formed can make the knowledge graph of the intranet user audit features more consistent with the company's normal user operation rules, suitable for actual situations, and improve the effectiveness of subsequent operations.

[0053] Further, the reference dictionary formed by extracting keywords from the data in the system log and processing according to the preset method comprises:

[0054] The keywords in the data in the system log are extracted after cleaning.

[0055] The word frequency and the part of speech of the extracted keywords are determined, and the preset hash table is used to determine the weight of the nodes and the edges between the nodes, wherein the node is the keyword, and the edge is the connection between the keywords, so as to form a full graph containing all keywords and the relationship between the keywords as a reference reference dictionary.

[0056] Some of the information is not valuable in abnormal user detection, and the data needs to be cleaned. For the information that is not useful in abnormal user detection, the valuable information is removed, which can improve the data processing efficiency. After extracting the keywords, the word frequency and the part of speech of each keyword are determined. The word frequency is the number of times it appears in the log, and the part of speech can be understood as a noun or a verb. Here it can be understood as an operation or an operation object. The relationship between the initial keywords and the keywords can be considered to be obtained by statistical calculation of a large number of computer internal network security logs and stored in a hash table. The node is the keyword, and the edge is the connection between the keywords (association, inclusion, equivalence, decision, influence, etc.). There is an edge between two nodes with a relationship, and the weight of the edge is the number of connections between the two nodes. A full graph similar to the one containing all keywords and the relationship between keywords is obtained, that is, the reference dictionary.

[0057] Further, the method further comprises:

[0058] Further, the method further comprises:

[0059] Wordnet is a dictionary based on cognitive linguistics, which can form a "word network" according to the meaning of a word. Using the Bayesian classifier is to calculate the posterior probability of an object through its prior probability, that is, the probability that the object belongs to a certain class, and to select the class with the maximum posterior probability as the class to which the object belongs. After classifying the keywords with the formed dictionary, the nodes and edges of the knowledge graph are obtained, and the knowledge graph of the internal network user audit features is made.

[0060] Further, the method further comprises:

[0061] After the knowledge graph is formed, the knowledge graph is visualized by means of the Java toolkit.

[0062] After the knowledge graph is visualized, the knowledge graph is converted from the data layer to the concept layer, and is formed in the form as shown in Figure 2 The user data is classified into user permissions, user behavior, user risk assessment, etc. The user behavior can be further divided into login, file operation, malicious behavior, etc. The operation can be further subdivided. For example, login has login time, login location, etc. corresponding to each item matched according to the knowledge graph. When matching, a certain item is judged, and then the next automatic matching is performed in order. If it is not involved this time, the item is skipped.

[0063] Further, the items of the user data to be audited matched according to the knowledge graph include at least one of abnormal login time, abnormal increase, delete and modify operation, permission change and abnormal place login;

[0064] The matching of the user data to be audited according to the knowledge graph includes:

[0065] The matching of the user data to be audited according to the knowledge graph includes:

[0066] The evaluation function is:

[0067] ,

[0068] If the matching result is that the i-th item of user data meets the i-th item of security rules, then x i=0, otherwise, x i=1, i takes 1 to n in turn; is a basic coefficient, , …, is a preset coefficient value corresponding to each item.

[0069] The user data is matched according to the knowledge graph for each item, for example, for the small item of user login time, set According to the login time period, it can be divided into low risk, medium risk and high risk, and each item is divided according to the respective rules, as shown in the following table.

[0070]

[0071] In actual calculation, it can be considered that is an array [0, 0.2, 0.8]; if the user has normal login (login during working hours), there is also common login (login during non-working hours), abnormal login (login during abnormal time), then x1=[1,1,1] T Similarly, for abnormal place login, set It can also be divided into low risk, medium risk and high risk, such as local login, internal network non-local login, external domain login (such as foreign IP login), and the corresponding values The corresponding array is set, and the overall risk value is obtained by accumulating each item, and the overall risk value is divided by distance:

[0072] ①, when is less than 1, and each item is ( ) no high-risk operation exists, the user is considered to be low-risk;

[0073] ② When is greater than 1, and no item exists, i.e. is a high-risk operation, the user is considered to be medium-risk

[0074] ③ When is greater than 1, and an item exists, i.e. is a high-risk operation, the user is preliminarily judged to be high-risk; and according to whether the knowledge graph high-risk item is associated, if the risk item is associated, it is a high-risk (suspected intrusion user) and an alarm is given, if not associated, only the risk level is judged to be high; the risk item is associated, as shown in Figure 3 , the output abnormal login, login time, login location and abnormal operation are all high-risk, and the operation is considered to be high-risk (suspected intrusion user) and an alarm is given.

[0075] , , …, are coefficients established after communication with network security experts. Of course, the items matched according to the knowledge graph can also be set according to actual needs, and calculated in the same way, which is not limited here.

[0076] The embodiments of the present disclosure analyze the abnormal behavior of the users in the enterprise intranet, form a reference dictionary, establish a knowledge graph according to the operation of the user, and make a full-process analysis on the operation behavior of the abnormal user, and finally output the risk value of the user, automatically and efficiently realize the identification of the abnormal user, improve the identification accuracy through multi-dimensional matching, realize the monitoring and management of the user behavior, and trace the evidence of the illegal operation and the leakage behavior.

[0077] Figure 4 is an architecture diagram of an abnormal user audit system provided by the second embodiment of the present disclosure, as shown in Figure 4 , comprising:

[0078] a processing module 11, which is set to export the system log formed by the operation of the user in a preset time period, extract keywords from the data in the system log, and form a reference dictionary after processing according to a preset method;

[0079] a knowledge graph making module 12, which is set to extract keywords from the user data to be audited, classify the extracted keywords according to the reference dictionary, and form a knowledge graph;

[0080] a matching module 13, which is set to match the user data to be audited according to the knowledge graph, and establish the risk level of the user according to the matching result and a preset rule.

[0081] Further, the processing module 11 is specifically configured to:

[0082] After cleaning the data in the system log, keywords are extracted therefrom;

[0083] The word frequency and part of speech of the extracted keywords are determined, and a preset hash table is used to determine the weight of the nodes and the edges between the nodes, wherein the nodes are keywords, and the edges are the connections between the keywords, so as to form a full graph containing all keywords and the relationships between the keywords as a reference dictionary.

[0084] Further, the knowledge graph production module 12 is specifically configured to:

[0085] The wordnet dictionary is used to extract keywords and disambiguate speech from the user data to be audited, and a Bayesian classifier is used to classify the extracted keywords with the reference dictionary as a reference.

[0086] Further, the knowledge graph production module 12 is further configured to:

[0087] After the knowledge graph is formed, a java toolkit is used to visualize the knowledge graph.

[0088] Further, the items to be matched with the knowledge graph according to the user data to be audited include at least one of abnormal login time, abnormal increase, deletion and modification operation, permission change and abnormal location login;

[0089] The matching module 13 is specifically configured to:

[0090] The user data to be audited is matched with the knowledge graph item by item, the risk value of the user is calculated according to the matching result and a preset evaluation function, and the risk level of the user is determined according to the calculated risk value of the user;

[0091] The evaluation function is:

[0092] ,

[0093] Wherein, if the matching result is that the i-th item of user data meets the i-th item of security rule, x i=0, otherwise, x i=1, i takes 1 to n in turn; is a basic coefficient, , …, are preset coefficient values corresponding to each item.

[0094] The abnormal user auditing system of the embodiments of the present disclosure is used to implement the abnormal user auditing method in the method embodiments, and thus is described simply. For details, refer to the related description in the above method embodiment one, which will not be repeated here.

[0095] In addition, as Figure 5 The embodiments of the present disclosure also provide an electronic device, including a memory 10 and a processor 20, the memory 10 stores a computer program, when the processor 20 runs the computer program stored in the memory 10, the processor 20 executes the above various possible abnormal user auditing methods.

[0096] The memory 10 is connected with the processor 20, the memory 10 can adopt a flash memory or a read-only memory or other memories, and the processor 20 can adopt a central processing unit or a single-chip microcomputer.

[0097] In addition, the embodiments of the present disclosure also provide a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by a processor to execute the above various possible methods.

[0098] The computer readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information such as computer readable instructions, data structures, computer program modules or other data. The computer readable storage medium includes but is not limited to RAM (Random Access Memory, Random Access Memory), ROM (Read-Only Memory, Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory, Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory, Compact Disc Read-Only Memory), digital versatile disc (DVD) or other optical disc storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer.

[0099] It can be understood that the above embodiments are only exemplary embodiments adopted for illustrating the principles of the present disclosure, and the present disclosure is not limited thereto. Various modifications and improvements can be made by those skilled in the art without departing from the spirit and essence of the present disclosure, and these modifications and improvements are also considered as the protection scope of the present disclosure.

Claims

1. A method of user auditing, characterized by, The method comprises: exporting a system log formed by user operations in a preset time period, extracting keywords from data in the system log, and forming a reference dictionary after processing the keywords according to a preset method; wherein the keywords include an account, login, verification, access, addition, deletion, modification, query, access IP, access time, and protocol; extracting keywords from the user data to be audited, classifying the extracted keywords according to the reference dictionary, and forming a knowledge graph; matching the user data to be audited according to the knowledge graph, and establishing a risk level of the user according to a matching result and a preset rule; the matching the user data to be audited according to the knowledge graph and establishing the risk level of the user according to the matching result and the preset rule comprises: matching the user data to be audited according to the knowledge graph item by item, calculating a risk value of the user according to a matching result and a preset evaluation function, and establishing the risk level of the user according to the calculated risk value of the user; the evaluation function is: ， If the matching result of the i-th item of user data conforms to the security rule of the i-th item, then x i=0, otherwise, x i=1, i takes 1 to n in turn, and each item of user data is divided into low-risk, medium-risk and high-risk operations; is a basic coefficient, , …, are preset coefficient values corresponding to each item. If less than 1, and none of the high-risk operations exist, the risk level of the user is determined as low risk. If greater than 1, and If none of the high-risk operations exist, the risk level of the user is determined as medium risk. If greater than 1, and there is a high-risk operation, it is further determined whether it is associated with a high-risk item in the knowledge graph, if it is associated, it is determined that the user is a high-risk user and an alarm is given, if it is not associated, it is determined that the risk level of the user is high-risk.

2. The method of claim 1, wherein, the extracting keywords from data in the system log and forming the reference dictionary after processing the keywords according to the preset method comprises: extracting keywords from the data in the system log after cleaning the data; determining a word frequency and a part of speech of the extracted keywords, and determining a weight of a node and an edge between nodes by using a preset hash table, wherein the node is a keyword, and the edge is a connection between keywords, so as to form a full graph containing all keywords and relationships between the keywords as a reference reference dictionary.

3. The method according to claim 1 or 2, characterized in that, the extracting keywords from the user data to be audited and classifying the extracted keywords according to the reference dictionary comprises: extracting keywords from the user data to be audited and classifying the extracted keywords according to the reference dictionary by using a wordnet dictionary and a Bayesian classifier.

4. The method of claim 1, wherein, the method further comprises: after the knowledge graph is formed, performing a visualization operation on the knowledge graph by using a java toolkit.

5. The method according to claim 1 or 2, characterized in that, the items for matching the user data to be audited according to the knowledge graph include at least one of an abnormal login time, abnormal addition, deletion, and modification operations, a change in permission, and an abnormal location login.

6. A user audit system, characterized by comprises: a processing module configured to export a system log formed by user operations in a preset time period, extract keywords from data in the system log, and form a reference dictionary after processing the keywords according to a preset method; wherein the keywords include an account, login, verification, access, addition, deletion, modification, query, access IP, access time, and protocol; a knowledge graph making module configured to extract keywords from the user data to be audited, classify the extracted keywords according to the reference dictionary, and form a knowledge graph; a matching module configured to match the user data to be audited according to the knowledge graph, and establish a risk level of the user according to a matching result and a preset rule; the matching module is specifically configured to: The user data to be audited is matched item by item according to the knowledge graph, a risk value of the user is calculated according to a matching result and a pre-established evaluation function, and a risk level of the user is established according to the calculated risk value of the user. The evaluation function is: ， If the matching result of the i-th item of user data conforms to the security rule of the i-th item, then x i=0, otherwise, x i=1, i takes 1 to n in turn, and each item of user data is divided into low-risk, medium-risk and high-risk operations; is a basic coefficient, , …, are preset coefficient values corresponding to each item. If less than 1, and If there is no high-risk operation, the risk level of the user is determined as low risk. If greater than 1, and If none of the high-risk operations exist, the risk level of the user is determined as medium risk. If greater than 1, and there is a high-risk operation, it is further determined whether it is associated with a high-risk item in the knowledge graph, if it is associated, it is determined that the user is a high-risk user and an alarm is given, if it is not associated, it is determined that the risk level of the user is high-risk. ​ 7. The system of claim 6, wherein, The knowledge graph production module is specifically configured to: The wordnet dictionary is used to extract keywords and resolve speech ambiguity from the user data to be audited, and the extracted keywords are classified using a Bayesian classifier with the reference dictionary as a reference.

8. The system of claim 6 or 7, wherein, The items to which the user data to be audited is matched according to the knowledge graph include at least one of an abnormal login time, an abnormal increase, an add, delete and modify operation, a permission change and an abnormal location login.

9. An electronic device, comprising: A computer program is stored in a memory, and when a processor executes the computer program stored in the memory, the processor executes the user audit method according to any one of claims 1-5.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the user audit method according to any one of claims 1-5.

Images