A method based on baseline analysis of personnel behavior and alarm of abnormal behavior

Abstract

The present invention belongs to the field of database security audit management technology, and is particularly a method based on baseline analysis of personnel behavior and alarming of abnormal behavior. The method first collects the operating behavior of operators based on specific database operation objects, then analyzes the collected operating behavior of the same type of operation objects to establish corresponding baseline samples. Later, based on specific database operation objects, the operating behavior of operators is recorded, and the operating behavior of corresponding operators is alarmed and judged through the baseline samples, so that the security audit of the database has a reference standard; and operators are divided into multiple categories, so that the established baseline samples are more referenceable and comprehensive; in addition, since the baseline samples are established, the audit work can be automatically judged, reducing the audit workload. For personnel marked with risk symbols, more stringent identity authentication methods and more stringent authorization restrictions are adopted.

Description

Technical Field

[0001] The present invention belongs to the technical field of database security audit management, and specifically relates to a method based on baseline analysis of personnel behavior and alarming of abnormal behavior. Background Art

[0002] For large power companies, there are more and more application systems used for various work scenarios such as supply chain management, project management, financial management, human resources management, and customer service management. These are all part of the company's digital and network construction, and have a great promoting effect on improving work efficiency and improving management models.

[0003] Databases are a crucial component of various application systems, serving as data warehouses. Therefore, the security management of application systems inevitably involves the security management of databases. As power group units move toward electronic and information-based office operations, the group's use of databases is increasing, leading to increasingly broad and diverse requirements for database management. Database security is particularly crucial for databases that store employee information, production information, and technical data from power companies.

[0004] In the prior art, Chinese patent publication CN108763957A describes a database security audit system, method, and server. This security audit system includes a database module, an audit data collection module, an audit data storage module, an audit data analysis module, and a visualization module. The database module processes the data in the database; the audit data collection module collects the database module's operation logs; the audit data storage module stores the audit log data, ensuring efficient and secure processing of the audit data by introducing an improved storage engine; and the audit data analysis module analyzes and processes the audit log data. This database security audit system has the following shortcomings: First, it is unclear what data is collected in the operation log; second, it is unclear which operators' operation data is collected, and there is no classification of database operators; third, there is no reference data for alarm judgment, requiring manual interpretation, which increases the audit workload. Summary of the Invention

[0005] The purpose of the present invention is to provide a method based on baseline analysis of personnel behavior and alarm of abnormal behavior, so as to solve the technical problems in the prior art of lack of reference for security audit standards of databases, insufficient comprehensiveness of security audit objects, and large audit workload.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0007] A method for analyzing baselines of human behavior and alerting of abnormal behavior is provided. The method is used for database security management and includes the following steps:

[0008] (1) Personnel behavior collection: Based on specific database operation objects, collect the operator's operation behavior;

[0009] (2) Personnel behavior judgment: Analyze the operation behaviors of the same type of operation objects collected in step (1) and establish corresponding baseline samples;

[0010] (3) Personnel behavior record: Based on specific database operation objects, record the operation behavior of operators;

[0011] (4) Abnormal behavior alarm:

[0012] (4.1) analyzing the operation behaviors of the operation objects of the set type recorded in step (3) and comparing them with the corresponding baseline samples established in step (2); if a certain operation behavior recorded exceeds the warning range of the corresponding baseline sample, a risk symbol is marked on the corresponding operator;

[0013] (4.2) During a certain monitoring period, operators marked with risk symbols are analyzed. If the risk symbol of an operator exceeds the risk warning threshold, warning management is performed on the database or the corresponding operator.

[0014] Preferably, in step (1), the specific database operation objects include external personnel and internal personnel of the enterprise, wherein the external personnel of the enterprise include database operation and maintenance personnel, former employees of the enterprise and external access personnel of the enterprise, and the internal personnel of the enterprise include database management personnel and internal access personnel of the enterprise.

[0015] Preferably, in step (2), the collected operation behaviors include the purpose of accessing the database, the duration of each access, the access rights and the access date.

[0016] Preferably, for the operation behavior of the access purpose, a density-based approach is used to establish a baseline sample. For access areas with a high density, it is determined to be a normal access, and for access areas with a low density, it is determined to be an abnormal access that requires focused monitoring.

[0017] For the operation behavior of each visit duration, a mean statistical algorithm is used to establish a baseline sample, and the visit duration is counted based on the standardized log to calculate the mean of the corresponding visit duration;

[0018] For the access rights operation behavior, a density-based approach is used to establish a baseline sample. Access rights with a high density are considered normal access, while access rights with a low density are considered abnormal access and require close monitoring.

[0019] For the operation behavior of the access date, a baseline sample is established based on the same time length, and the individual's access dates are counted in time periods of the same length and span. For those who have a high density of access dates, it is judged that they are abnormal visits and need to be monitored closely.

[0020] Preferably, the risk symbol includes risk symbols of multiple risk levels.

[0021] Preferably, the risk symbols specifically include a low-risk symbol, a medium-risk symbol and a high-risk symbol, the risk assessment value of the high-risk symbol is twice that of the medium-risk symbol, and the risk assessment value of the medium-risk symbol is twice that of the low-risk symbol.

[0022] Preferably, the operation behavior corresponding to the risk symbol in each monitoring period is updated, and the operation behavior of the operation object of the set type recorded in the previous monitoring period is used to establish the corresponding baseline sample in the next monitoring period.

[0023] Preferably, for persons marked with risk symbols, a stricter identity authentication method is used when they log into the database later to determine whether they are legitimate users, and stricter authorization restrictions are used to determine which services they are authorized to use.

[0024] Compared with the prior art, the present invention has at least the following beneficial technical effects:

[0025] The method based on personnel behavior baseline analysis and abnormal behavior alarm provided by the present invention collects the operating behavior of operators and establishes corresponding baseline samples for reference. The operating behavior of the corresponding operators is then judged by the baseline samples, so that the security audit of the database has a reference standard; and operators are divided into multiple categories, so that the established baseline samples are more referenceable and comprehensive; in addition, since the baseline samples are established, the audit work can be automatically judged, which reduces the audit workload and is beneficial to the entire power group. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 The flowchart of an embodiment of the method of the present invention based on baseline analysis of personnel behavior and alarming of abnormal behavior.

[0027] Figure 2 This is a block diagram of the composition of database operation objects in an embodiment of the method based on personnel behavior baseline analysis and abnormal behavior alarm of the present invention. DETAILED DESCRIPTION

[0028] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0029] See also Figure 1 and Figure 2 The present invention provides a method for analyzing baseline behavior of personnel and alerting abnormal behavior, which specifically includes the following steps:

[0030] Step S100: Personnel behavior collection: Based on a specific database operation object, the operation behavior of the operator is collected.

[0031] In step S100, Figure 2 As shown, specific database operation objects include external personnel and internal personnel of the enterprise. Among them, external personnel include database operation and maintenance personnel, former employees of the enterprise, and external access personnel of the enterprise, and internal personnel include database management personnel and internal access personnel of the enterprise.

[0032] Database operation and maintenance personnel are responsible for helping enterprises build, test and maintain the database in the later stage. During the maintenance process, database operation and maintenance personnel can make changes to the database architecture and operation mode, but they should not have the authority to access the data stored in the enterprise database; employees who have left the enterprise are external personnel, and their corresponding access rights should also be modified to external personnel rights, rather than internal personnel rights. After employees leave, they are labeled in the enterprise management system, and the enterprise management system is linked to the database; the authority of external access personnel of the enterprise is to access the open part of the database; internal personnel of the enterprise include database administrators and internal access personnel of the enterprise. Database administrators manage the data in the database and can manage the access rights of each personnel to the database. Internal access personnel of the enterprise log in to the account through a special client to access the area of ​​the database for internal access.

[0033] In step S100 , the collected operation behaviors include the purpose of accessing the database, the duration of each access, access rights, and access date.

[0034] For the purpose of access, a density-based approach is used to establish baseline samples. Access to areas with high density is considered normal, while access to areas with low density is considered abnormal and requires focused monitoring.

[0035] For each visit duration, we use a mean statistical algorithm to establish a baseline sample. We then perform statistics on the visit duration based on standardized logs and calculate the mean of the corresponding visit duration.

[0036] For access rights, a density-based approach is used to establish baseline samples. Access rights with high density are considered normal access, while access rights with low density are considered abnormal access and require focused monitoring.

[0037] For the operation behavior of visit date, a baseline sample is established based on the same time length. The visit dates of individuals are counted in time periods of the same length and span. For those who have a high density of visit dates, it is judged as abnormal visit and needs to be monitored closely.

[0038] The access purposes and access rights of database operation and maintenance personnel, former employees, external access personnel, database management personnel, and internal access personnel. In addition, under normal circumstances, each person is likely to access the database on weekdays. The duration of each person's database access can be used as a reference factor for behavioral alerts.

[0039] Step S200 , judging personnel behavior: analyzing the operation behaviors of the same type of operation objects collected in step S100 , and establishing corresponding baseline samples.

[0040] In this step, for database operation and maintenance personnel, former employees, external access personnel, database management personnel, and internal access personnel, the baseline samples of access purposes and access rights of each type of personnel during a monitoring period are clear; the average duration of each visit by each type of personnel serves as the baseline sample of access duration; and the day on which each type of personnel accesses the database during a monitoring period serves as the baseline sample of the access date.

[0041] Step S300: Personnel behavior record: Based on a specific database operation object, the operation behavior of the operator is recorded.

[0042] In this step, during a monitoring period, the operational behaviors of database operation and maintenance personnel, former employees, external access personnel, database management personnel, and internal access personnel are recorded for comparison with the corresponding baseline samples.

[0043] Step S400: abnormal behavior alarm.

[0044] Specifically include:

[0045] Step S410: Analyze the operation behavior of the operation object of the set type recorded in step S300 and compare it with the corresponding baseline sample established in step S200. If a recorded operation behavior exceeds the warning range of the corresponding baseline sample, mark the corresponding operator with a risk symbol.

[0046] In this step S410, the risk symbol includes risk symbols of multiple risk levels, specifically including a low risk symbol, a medium risk symbol, and a high risk symbol. The risk assessment value of the high risk symbol is twice that of the medium risk symbol, and the risk assessment value of the medium risk symbol is twice that of the low risk symbol.

[0047] Step S420: During a certain monitoring period, analyze the operators marked with risk symbols. If the risk symbol of an operator exceeds the risk warning threshold, perform warning management on the database or perform warning management on the corresponding operator.

[0048] For example, for database operation and maintenance personnel, former employees, external access personnel, database management personnel, and internal access personnel, each type of personnel has different access purposes and access rights. If it is discovered that the operation behavior of database operation and maintenance personnel, former employees, and external access personnel can access areas of the database that are only accessible to internal personnel, the relevant personnel will be marked with a high-risk symbol, and the risk assessment value of the high-risk symbol exceeds the risk warning threshold. The database will immediately perform warning management on the account of the relevant personnel. Subsequently, the database management personnel will modify the access rights of the relevant personnel.

[0049] If the duration of each visit of each type of personnel is significantly higher than the corresponding baseline sample, the person will be marked with a medium-risk symbol. When the medium-risk symbol is marked twice, the database will immediately conduct early warning management on the account of the relevant personnel, and the database administrator will subsequently modify the access rights of the relevant personnel or find out the reason for the visit.

[0050] If the visit date of each type of personnel deviates significantly from the corresponding baseline sample, for example, the baseline sample shows that most of the relevant personnel visit on weekdays, but a certain person visits on weekends, then the person will be marked with a low-risk symbol. When the low-risk symbol is marked four times, the database will immediately conduct early warning management on the account of the relevant person, and the database administrator will subsequently modify the access rights of the relevant person or find out the reason for the visit.

[0051] Furthermore, the database updates the operational behaviors corresponding to the risk symbols in each monitoring period, and uses the operational behaviors of the set type of operation objects recorded in the previous monitoring period to establish the corresponding baseline samples in the next monitoring period, making the baseline samples more referenceable.

[0052] The method based on baseline analysis of personnel behavior and alarm of abnormal behavior can be embedded in the database as an audit module of the database.

[0053] For those who have alarm records, a stricter identity authentication method will be used when they log in to the database later to determine whether they are legitimate users, and stricter authorization restrictions will be used to determine which services they are authorized to use.

[0054] In addition, authentication in the present invention is to verify the identity of the user and determine whether the user is a legitimate user. Authorization is to authorize the authenticated user to use certain services.

[0055] It should be noted that, in this document, terms such as "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements that are inherent to such process, method, article or apparatus.

[0056] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A method based on baseline analysis of personnel behavior and alarming of abnormal behavior, characterized in that: The method is used for database security management and includes the following steps: (1) Personnel behavior collection: Based on specific database operation objects, the operation behavior of operators is collected; the specific database operation objects include external personnel and internal personnel of the enterprise, wherein the external personnel of the enterprise include database operation and maintenance personnel, former employees of the enterprise and external enterprise visitors, and the internal personnel of the enterprise include database management personnel and internal enterprise visitors; (2) Personnel behavior judgment: Analyze the operational behaviors of the same type of operating objects collected in step (1) and establish corresponding baseline samples; the collected operational behaviors include the purpose of accessing the database, the duration of each access, the access rights, and the access date; For the access purpose, a density-based approach is used to establish baseline samples. Accesses in areas with high density are considered normal, while those in areas with low density are considered abnormal and require focused monitoring. For the operation behavior of each visit duration, a mean statistical algorithm is used to establish a baseline sample, and the visit duration is counted based on the standardized log to calculate the mean of the corresponding visit duration; For the access rights operation behavior, a density-based approach is used to establish a baseline sample. Access rights with a high density are considered normal access, while access rights with a low density are considered abnormal access and require close monitoring. For the visit date operation behavior, a baseline sample is established based on the same time length. The visit dates of individuals are counted in time periods of the same length and span. For those who have a high density of visit dates, it is judged as abnormal visit and needs to be monitored; (3) Personnel behavior record: Based on specific database operation objects, record the operator's operation behavior; (4) Abnormal behavior alert: (4.1) Analyze the operation behavior of the set type of operation object recorded in step (3) and compare it with the corresponding baseline sample established in step (2). If a recorded operation behavior exceeds the warning range of the corresponding baseline sample, mark the corresponding operator with a risk symbol; (4.2) During a certain monitoring period, operators marked with risk symbols are analyzed. If the risk symbol of an operator exceeds the risk warning threshold, warning management is performed on the database or the corresponding operator.

2. The method based on personnel behavior baseline analysis and abnormal behavior warning according to claim 1 is characterized in that: The risk symbols include risk symbols of multiple risk levels.

3. The method based on personnel behavior baseline analysis and abnormal behavior warning according to claim 2 is characterized in that: The risk symbols specifically include low-risk symbols, medium-risk symbols and high-risk symbols. The risk assessment value of the high-risk symbol is twice that of the medium-risk symbol, and the risk assessment value of the medium-risk symbol is twice that of the low-risk symbol.

4. The method based on personnel behavior baseline analysis and abnormal behavior warning according to claim 1 is characterized in that: The operational behaviors corresponding to the risk symbols in each monitoring period are updated, and the operational behaviors of the set type of operation objects recorded in the previous monitoring period are used to establish the corresponding baseline samples in the next monitoring period.

5. The method based on personnel behavior baseline analysis and abnormal behavior warning according to claim 1 is characterized in that: For those marked with risk symbols, a stricter identity authentication method will be used when they log in to the database later to determine whether they are legitimate users, and stricter authorization restrictions will be used to determine which services they are authorized to use.

Images