Abnormal user detection method and device, and computer readable storage medium

Abstract

The present disclosure provides an abnormal user detection method and device, and a computer readable storage medium. The method comprises: obtaining user information of a user to be analyzed, the user information comprising user features and a historical user group to which the user to be analyzed belongs, the user features comprising user login features and user operation features; calculating a similarity average value between the user features of the user to be analyzed and average features of each user group in a plurality of user groups in a preset user group set, the plurality of user groups comprising the historical user group; selecting a user group with the largest similarity average value in the plurality of user groups as a new user group to which the user to be analyzed belongs; determining the user to be analyzed as a normal user if the new user group is consistent with the historical user group; and determining the user to be analyzed as an abnormal user if the new user group is inconsistent with the historical user group. The present disclosure realizes detection of abnormal users.

Description

Technical Field

[0001] This disclosure relates to the field of network and information security, and in particular to an abnormal user detection method and apparatus, and a computer-readable storage medium. Background Technology

[0002] Anomaly user identification, which involves labeling the risk level of user behavior, is an application of user profiling technology in the security field. In e-commerce, user profiling technology uses multi-dimensional data such as personal information, consumption habits, and preferences to characterize user traits, proving effective in advertising and targeted marketing. However, in the security field, user behavior information is more concentrated, and analyzing and detecting abnormal behavior is crucial. Directly applying existing user profiling technology to the security field presents limitations in its applicability. Summary of the Invention

[0003] One technical problem addressed by this disclosure is to provide a method for detecting abnormal users in the field of security.

[0004] According to one aspect of this disclosure, an abnormal user detection method is provided, comprising: obtaining user information of a user to be analyzed, the user information including user characteristics and historical user groups to which the user to be analyzed belongs, the user characteristics including user login characteristics and user operation characteristics; calculating the average similarity between the user characteristics of the user to be analyzed and the average characteristics of each of a plurality of user groups in a preset user group set, the plurality of user groups including the historical user groups; selecting the user group with the largest average similarity among the plurality of user groups as the new user group to which the user to be analyzed belongs; if the new user group is consistent with the historical user group, then determining the user to be analyzed as a normal user; and if the new user group is inconsistent with the historical user group, then determining the user to be analyzed as an abnormal user.

[0005] In some embodiments, the abnormal user detection method further includes: if the new user group is inconsistent with the historical user group, and the largest average similarity is greater than or equal to the average user similarity of the new user group, then the user to be analyzed is determined to be a suspected unauthorized user; and if the new user group is inconsistent with the historical user group, and the largest average similarity is less than the average user similarity of the new user group, then the user to be analyzed is a user sharing an account.

[0006] In some embodiments, the step of obtaining user information of the user to be analyzed includes: receiving system log data within the current time period; extracting the username, login source Internet Protocol IP address, login destination IP address, login result, and operation command from the system log data; and analyzing to obtain the user login characteristics and user operation characteristics of the user to be analyzed, wherein the user login characteristics include characteristics of successful user login and characteristics of failed user login, and the user operation characteristics include operation quantity characteristics and abnormal operation matching frequency characteristics.

[0007] In some embodiments, the step of analyzing the user login characteristics of the user to be analyzed includes: analyzing the source IP address and destination IP address of the user to be analyzed who successfully logged in within a predetermined time to obtain a list of successful user logins, thereby obtaining the characteristics of successful user logins; and analyzing and statistically analyzing the source IP address and destination IP address of the user to be analyzed who failed to log in within the predetermined time to obtain a list of failed user logins, thereby obtaining the characteristics of failed user logins.

[0008] In some embodiments, the step of analyzing and obtaining the user operation characteristics of the user to be analyzed includes: extracting the number of operation commands of the user to be analyzed within a predetermined time period to obtain the operation quantity characteristics of the operation commands; and extracting the operation commands of the user to be analyzed within the predetermined time period, and sequentially matching the operation commands with each feature in the abnormal operation feature database to obtain the abnormal operation matching frequency characteristics of the corresponding features of the operation commands.

[0009] In some embodiments, the abnormal user detection method further includes: before obtaining the user information of the user to be analyzed, calculating the average user similarity of each user group in the plurality of user groups in the user group set, and obtaining the average feature of each user group.

[0010] In some embodiments, the step of calculating the average user similarity of each of the plurality of user groups in the user group set includes: calculating the user behavior similarity between each user of the user group and each other user in the user group; calculating the intra-group average similarity between each user of the user group and all other users in the user group based on the user behavior similarity between each user of the user group and each other user in the user group; and calculating the average of the intra-group average similarities of all users in the user group as the average user similarity of the user group.

[0011] In some embodiments, the step of calculating the similarity of user behavior between each user in a user group and each other user in the user group includes: obtaining a user login success list, a user login failure list, operation command operation quantity characteristics, and abnormal operation matching frequency characteristics for each user in the user group, wherein the user login success list includes the source IP address and destination IP address of the user who successfully logged in within a predetermined time, and the user login failure list includes the source IP address and destination IP address of the user who failed to log in within the predetermined time; calculating the login behavior similarity of each user in the user group based on the user login success list and user login failure list; calculating the operation behavior similarity of each user in the user group based on the operation command operation quantity characteristics and abnormal operation matching frequency characteristics; and calculating the user behavior similarity of each user in the user group based on the login behavior similarity, operation behavior similarity, and corresponding weights.

[0012] In some embodiments, the step of calculating the login behavior similarity of each user in the user group includes: calculating the login success behavior similarity of each user in the user group based on the login success list of each user in the user group and the login success list of other users in the user group; calculating the login failure behavior similarity of each user in the user group based on the login failure list of each user in the user group and the login failure list of other users in the user group; and calculating the login behavior similarity of each user in the user group based on the login success behavior similarity and the login failure behavior similarity.

[0013] In some embodiments, the step of calculating the similarity of the operational behavior of each user in the user group includes: calculating a first Euclidean distance between the operation quantity feature of the operation commands of each user in the user group and the operation quantity feature of the operation commands of other users in the user group; taking the reciprocal of the first Euclidean distance to obtain the initial operational similarity between each user in the user group and other users in the user group; calculating a second Euclidean distance between the abnormal operation matching frequency feature of the operation commands of each user in the user group and the abnormal operation matching frequency feature of the operation commands of other users in the user group; taking the reciprocal of the second Euclidean distance to obtain the abnormal operation similarity between each user in the user group and other users in the user group; and calculating the sum of the initial operational similarity and the abnormal operation similarity to obtain the operational behavior similarity of each user in the user group.

[0014] In some embodiments, the step of calculating the similarity of login success behaviors of each user in a user group based on the login success lists of each user in the user group and the login success lists of other users in the user group includes: obtaining a list of source IP addresses and a list of destination IP addresses for each user's successful login based on the login success lists of each user in the user group; obtaining a list of source IP addresses and a list of destination IP addresses for other users' successful login based on the login success lists of other users in the user group; and calculating the similarity of login success behaviors of each user and other users based on the total number of IP addresses in the two user lists. The similarity calculation method calculates a first overall similarity between the source IP address list of each user's successful login and the source IP address list of other users' successful login within the user group; calculates a second overall similarity between the destination IP address list of each user's successful login and the destination IP address list of other users' successful login within the user group, based on the overall similarity calculation method for the IP address lists of the two users; and calculates the similarity of the login success behavior of each user within the user group based on the first overall similarity and the second overall similarity.

[0015] In some embodiments, the step of calculating the similarity of login failure behaviors for each user in the user group based on the login failure lists of each user in the user group and the login failure lists of other users in the user group includes: obtaining a list of source IP addresses and a list of destination IP addresses for each user's login failures based on the login failure lists of each user in the user group; obtaining a list of source IP addresses and a list of destination IP addresses for other users' login failures based on the login failure lists of other users in the user group; and calculating the similarity of login failure behaviors for each user in the user group and the login failure lists of other users based on the sum of the IP address lists of the two users. The method for calculating body similarity is as follows: A third overall similarity is calculated between the source IP address list of each user's failed login attempts and the source IP address list of other users' failed login attempts within the user group; a fourth overall similarity is calculated between the destination IP address list of each user's failed login attempts and the destination IP address list of other users' failed login attempts, using the same method as for calculating the overall similarity of the two users' IP address lists; and the similarity of login failure behavior for each user within the user group is calculated based on the third and fourth overall similarities.

[0016] In some embodiments, the two users include a first user and a second user. The method for calculating the overall similarity of the IP address lists of the two users includes: obtaining the IP address list of the first user and the IP address list of the second user; obtaining an asset information database and extracting multiple attribute fields corresponding to IP addresses from the asset information database; calculating the weight value of each of the multiple attribute fields in the asset information database; extracting attribute fields corresponding to each IP address in the IP address lists of the first user and the second user from the asset information database and saving them as different attribute lists; calculating the attribute similarity of each corresponding attribute list of the first user and the second user; and calculating the overall similarity of the IP address lists of the two users based on the attribute similarity of each corresponding attribute list of the first user and the second user and the weight value corresponding to each attribute field.

[0017] In some embodiments, the abnormal user detection method further includes: if the user to be analyzed is determined to be an abnormal user, calculating the user behavior similarity between the abnormal user and other users in the new user group; and selecting users from the new user group whose user behavior similarity is greater than the average similarity within the new user group, thereby forming a list of suspected abnormal operation users.

[0018] In some embodiments, the step of obtaining the average feature of each user group includes: setting the number of center users in the user group to N, where N is a positive integer; calculating the intra-group average similarity between each user in the user group and other users in the user group; sorting the users in the user group according to the intra-group average similarity from largest to smallest, and selecting the top N users from the user group as center users; extracting the features corresponding to the N center users to form a center user feature list for the user group, which is used as the average feature; and sequentially obtaining the average feature of each user group in the user group set.

[0019] According to another aspect of this disclosure, an abnormal user detection device is provided, comprising: an acquisition unit for acquiring user information of a user to be analyzed, the user information including user characteristics and historical user groups to which the user to be analyzed belongs, the user characteristics including user login characteristics and user operation characteristics; a calculation unit for calculating the average similarity between the user characteristics of the user to be analyzed and the average characteristics of each of a plurality of user groups in a preset user group set, the plurality of user groups including the historical user groups; and an analysis unit for selecting the user group with the largest average similarity among the plurality of user groups as the new user group to which the user to be analyzed belongs; if the new user group is consistent with the historical user group, then the user to be analyzed is determined to be a normal user; and if the new user group is inconsistent with the historical user group, then the user to be analyzed is determined to be an abnormal user.

[0020] According to another aspect of this disclosure, an abnormal user detection apparatus is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to perform the method as described above based on instructions stored in the memory.

[0021] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided having computer program instructions stored thereon that, when executed by a processor, implement the method described above.

[0022] The above method enables the detection of abnormal users. By analyzing user similarity using two types of features—user login behavior and user operation behavior—and by analyzing abnormal user behavior through operation behavior analysis, abnormal users can be detected relatively comprehensively and accurately.

[0023] Other features and advantages of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0024] The accompanying drawings, which form part of this specification, illustrate embodiments of this disclosure and, together with the specification, serve to explain the principles of this disclosure.

[0025] This disclosure will become clearer with reference to the accompanying drawings and the following detailed description, wherein:

[0026] Figure 1 This is a flowchart illustrating an abnormal user detection method according to some embodiments of the present disclosure;

[0027] Figure 2 This is a flowchart illustrating an abnormal user detection method according to some other embodiments of the present disclosure;

[0028] Figure 3 This is a schematic diagram illustrating the structure of an abnormal user detection device according to some embodiments of the present disclosure;

[0029] Figure 4 This is a schematic diagram illustrating the structure of an abnormal user detection device according to other embodiments of the present disclosure;

[0030] Figure 5 This is a schematic diagram illustrating the structure of an abnormal user detection device according to other embodiments of the present disclosure. Detailed Implementation

[0031] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present disclosure.

[0032] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0033] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit this disclosure or its application or use.

[0034] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0035] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0036] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0037] Figure 1 This is a flowchart illustrating an abnormal user detection method according to some embodiments of the present disclosure. Figure 1As shown, the method includes steps S102 to S112.

[0038] In step S102, user information of the user to be analyzed is obtained. This user information includes user characteristics and the historical user groups to which the user belongs. The user characteristics include user login characteristics and user operation characteristics. It should be noted that the characteristics mentioned in this embodiment are feature vectors.

[0039] In some embodiments, step S102 includes: receiving system log data within the current time period; extracting the username, login source IP address (hereinafter referred to as source IP address), login destination IP address (hereinafter referred to as destination IP address), login result, and operation command from the system log data; and analyzing the user login characteristics and user operation characteristics of the user to be analyzed, wherein the user login characteristics include characteristics of successful user login and characteristics of failed user login, and the user operation characteristics include operation quantity characteristics and abnormal operation matching frequency characteristics.

[0040] In some embodiments, the step of analyzing the user login characteristics of the user to be analyzed includes: analyzing the source IP address and destination IP address of the user who successfully logged in within a predetermined time to obtain a list of successful user logins, thereby obtaining the characteristics of successful user logins; and analyzing and statistically analyzing the source IP address and destination IP address of the user who failed to log in within a predetermined time to obtain a list of failed user logins, thereby obtaining the characteristics of failed user logins.

[0041] In some embodiments, the step of analyzing the user operation characteristics of the user to be analyzed includes: extracting the number of operation commands of the user to be analyzed within a predetermined time period to obtain the operation quantity characteristics of the operation commands; and extracting the operation commands of the user to be analyzed within the predetermined time period, and sequentially matching the operation commands with each feature in the abnormal operation feature library to obtain the abnormal operation matching frequency characteristics of the corresponding features of the operation commands.

[0042] The specific process of step S102 above is illustrated below:

[0043] First, for example, receive 4A (Authentication, Authorization, Account, Audit, i.e., unified security management platform) system log data.

[0044] Next, extract the username, login source IP address, login destination IP address, login result, and operation command from the 4A system log data.

[0045] Next, we analyze the source IP address (sIP) and destination IP address (dIP) of the user who successfully logs in within a predetermined time (e.g., 1 day) to obtain the list of successful user logins L_LS[(sIP1,dIP1),(sIP2,dIP2)...], thereby obtaining the characteristics of successful user logins.

[0046] Next, we analyze and statistically analyze the source IP addresses and destination IP addresses of the users who failed to log in within a predetermined time to obtain the user login failure list L_LF, thereby obtaining the characteristics of user login failures.

[0047] Next, extract the number of times the user performs commands within a predetermined time (e.g., 1 day). For example, the ls command is performed 50 times and the cd command is performed 43 times. Output the operation count feature L_CH[50,43…] for the corresponding command.

[0048] Next, the user's operation commands within a predetermined time (e.g., 1 day) are extracted, and each command is sequentially matched against features in the abnormal operation feature library. This library includes multiple abnormal operation features, for example, L_CMD_AN[regex1, regex2…]. For instance, if feature regex1 matches successfully 3 times and regex2 matches successfully once, the abnormal operation match count feature L_CA[3, 1…] corresponding to L_CMD_AN is output. Here, a successful match indicates that the corresponding abnormal operation command occurred once. It should be noted that the match count for abnormal operation features not found in the library is recorded as 0, ensuring that the dimension of the abnormal operation match count feature matches the number of abnormal operation features in the library.

[0049] In step S104, the average similarity between the user characteristics of the user to be analyzed and the average characteristics of each user group in a preset set of user groups, including historical user groups, is calculated.

[0050] Here, we take user group U_G1 from multiple user groups as an example. For instance, the average similarity between the user characteristics of user U to be analyzed and user group U_G1. for:

[0051]

[0052] Where n is the number of users in user group U_G1, S(U,U i Let U be the user to be analyzed and U be the user in user group U_G1. i The overall similarity. The method for calculating the overall similarity will be described later.

[0053] In step S106, the user group with the highest average similarity among multiple user groups is selected as the new user group to which the user to be analyzed belongs. That is, take... The user group G with the largest value X , which is the new user group G′ to which the user U to be analyzed belongs.

[0054] In step S108, it is determined whether the new user group is consistent with the historical user group. If yes, the process proceeds to step S110; otherwise, the process proceeds to step S112.

[0055] In step S110, the user to be analyzed is determined to be a normal user. That is, if the new user group is consistent with the historical user group, the user to be analyzed is determined to be a normal user.

[0056] In step S112, the user to be analyzed is determined to be an abnormal user. That is, if the new user group is inconsistent with the historical user group, the user to be analyzed is determined to be an abnormal user.

[0057] This provides a method for detecting abnormal users according to some embodiments of the present disclosure. The method includes: obtaining user information of a user to be analyzed, the user information including user characteristics and historical user groups to which the user belongs, the user characteristics including user login characteristics and user operation characteristics; calculating the average similarity between the user characteristics of the user to be analyzed and the average characteristics of each user group in a preset set of user groups, the multiple user groups including historical user groups; selecting the user group with the highest average similarity among the multiple user groups as the new user group to which the user to be analyzed belongs; if the new user group is consistent with a historical user group, then the user to be analyzed is determined to be a normal user; and if the new user group is inconsistent with a historical user group, then the user to be analyzed is determined to be an abnormal user. This embodiment achieves the detection of abnormal users. By analyzing user similarity using two types of features—user login behavior and user operation behavior—and analyzing abnormal user behavior through operation behavior analysis, abnormal users can be detected more comprehensively and accurately.

[0058] In some embodiments, the abnormal user detection method further includes: before obtaining the user information of the user to be analyzed, calculating the average user similarity of each user group in the plurality of user groups in the user group set, and obtaining the average feature list of each user group.

[0059] In some embodiments, the step of calculating the average user similarity of each of the plurality of user groups in the user group set includes: calculating the user behavior similarity of each user in the user group with each other user in the user group; calculating the intra-group average similarity of each user in the user group with all other users in the user group based on the user behavior similarity of each user in the user group with each other user in the user group; and calculating the average of the intra-group average similarities of all users in the user group as the average user similarity of the user group.

[0060] Let's take user group G1 as an example. For instance, let's calculate the relationship between a user U1 in user group G1 and every other user U1 in user group G1. i User behavior similarity S(U1,U i ).

[0061] Based on the user behavior similarity S(U1,U i Calculate the average intragroup similarity S between a given user in the user group and all other users in the user group. G1，U1 for:

[0062]

[0063] Where n is the number of users in user group G1.

[0064] Calculate the intra-group average similarity S for all users within user group G1 sequentially. G1，Ui The average value is taken as the average similarity among users in user group G1:

[0065]

[0066] Other user groups G2, G3, etc., are calculated using the same method as described above.

[0067] In some embodiments, the step of calculating the similarity of user behavior between each user in a user group and every other user in the user group includes: obtaining a user login success list, a user login failure list, operation command operation quantity characteristics, and abnormal operation matching frequency characteristics for each user in the user group, wherein the user login success list includes the source IP address and destination IP address of the user who successfully logged in within a predetermined time, and the user login failure list includes the source IP address and destination IP address of the user who failed to log in within a predetermined time; calculating the login behavior similarity of each user in the user group based on the user login success list and user login failure list; calculating the operation behavior similarity of each user in the user group based on the operation command operation quantity characteristics and abnormal operation matching frequency characteristics; and calculating the user behavior similarity of each user in the user group based on the login behavior similarity, operation behavior similarity, and corresponding weights.

[0068] For example, the methods described above can be used to obtain the list of successful logins, the list of failed logins, the number of operation commands, and the number of abnormal operation matches for each user in a user group.

[0069] Let's take a user U1 in user group G1 as an example. For instance, we can calculate the login behavior similarity J(U1,Ui) of user U1 in user group G1 based on the list of successful logins and the list of failed logins of user U1 in user group G1, where Ui represents other users in user group G1.

[0070] Calculate the similarity C(U1,Ui) of the operation behavior of each user in user group G1 based on the operation quantity characteristics and abnormal operation matching frequency characteristics of user U1 in user group G1.

[0071] The user behavior similarity of user U1 within user group G1 is calculated based on the login behavior similarity J(U1,Ui), operation behavior similarity C(U1,Ui), and corresponding weights w1 and w2.

[0072] S(U1, U i )=w1×J(U1,U i )+w2×C(U1, U i (4)

[0073] Where w1 is the weight corresponding to the similarity of login behavior, and w2 is the weight corresponding to the similarity of operation behavior. w1 and w2 can be set according to actual needs or obtained through training.

[0074] In some embodiments, the step of calculating the login behavior similarity of each user within the user group includes: calculating the login success behavior similarity of each user within the user group based on the login success list of each user (e.g., a certain user) and the login success list of other users within the user group; calculating the login failure behavior similarity of each user within the user group based on the login failure list of each user within the user group and the login failure list of other users within the user group; and calculating the login behavior similarity of each user within the user group based on the login success behavior similarity and login failure behavior similarity. For example, the login behavior similarity J(A, B) of a certain user is...

[0075] J(A, B) = w LS ×J_LS+w LF ×J_LF, (5)

[0076] Where J_LS represents the similarity of a user's successful login behavior, J_LF represents the similarity of a user's failed login behavior, and w LS As the weight corresponding to the similarity of successful login behavior, w LF The weights corresponding to the similarity to login failure behaviors. LS and w LF It can be set according to actual needs or obtained through training.

[0077] The following describes the method for calculating the overall similarity of the IP address lists of two users.

[0078] In some embodiments, the two users include a first user and a second user. The method for calculating the overall similarity of the IP address lists of the two users includes: obtaining the IP address lists of the first user and the second user; obtaining an asset information database and extracting multiple attribute fields corresponding to IP addresses from the asset information database; calculating the weight value of each of the multiple attribute fields in the asset information database; extracting attribute fields corresponding to each IP address in the IP address lists of the first user and the second user from the asset information database and saving them as different attribute lists; calculating the attribute similarity of each corresponding attribute list of the first user and the second user; and calculating the overall similarity of the IP address lists of the two users based on the attribute similarity of each corresponding attribute list of the first user and the second user and the weight value corresponding to each attribute field.

[0079] The following example illustrates how to calculate the overall similarity between the IP address lists of two users.

[0080] First, obtain the data to be analyzed. For example, receive two IP address lists L1 and L2: L1[IP1,IP2,IP3…], L2[IP1,IP2,IP3…].

[0081] Receive the asset information database, which contains IP addresses and their corresponding attribute information. Extract the attribute fields of the IP addresses, such as the network segment, department, and business system to which they belong.

[0082] Next, calculate the weight values ​​of each attribute field in the asset information database:

[0083] (1) Weight w of network segment attributes n for:

[0084]

[0085] Where p1(x i () represents the asset ratio of the network segment.

[0086] For example, if the asset information database includes four network address segments, and the proportions of assets belonging to these four network segments are 0.4, 0.2, 0.2, and 0.2 respectively, then the weight w of the network segment attribute... n for:

[0087]

[0088] (2) Weight w of the department attribute d for:

[0089]

[0090] Wherein, p2(y i () represents the department's asset ratio.

[0091] For example, if the asset information database includes 5 departments, and the proportion of assets belonging to each of the 5 departments is 0.2, then the weight of the department attribute is:

[0092]

[0093] (3) Weight w of the attribute of the business system to which it belongs s for:

[0094]

[0095] Among them, p3(z) i () represents the asset ratio of the business system.

[0096] For example, the asset information database includes three departments, and the proportions of assets belonging to the three business systems are 0.5, 0.3, and 0.2, respectively. The weighting formula for the attributes belonging to the respective business systems is as follows:

[0097]

[0098] Other attributes are calculated using similar formulas as described above.

[0099] Next, based on the asset information database, extract each attribute information corresponding to each IP address in the IP address lists L1 and L2 to be analyzed, and save them as different lists respectively:

[0100] For example, (1) List of network segment attributes to which IPs belong in L1 and L2:

[0101] L1_n[network segment 1, network segment 2, network segment 3], L2_n[network segment 2, network segment 2, network segment 3];

[0102] (2) List of department attributes of IP addresses in L1 and L2:

[0103] L1_d[Department 1, Department 2, Department 3], L2_n[Department 1, Department 2, Department 3];

[0104] (3) List of business system attributes to which IPs belong in L1 and L2:

[0105] L1_s[Business System 1, Business System 2, Business System 3...], L2_s[Business System 1, Business System 1, Business System 1...].

[0106] Other attributes are extracted using a similar method described above.

[0107] Next, calculate the similarity of each attribute between the two IP lists L1 and L2:

[0108] (1) IP address list network segment department similarity J n :

[0109]

[0110] For example,

[0111] (2) Similarity of departments to which IP address lists belong J d :

[0112]

[0113] For example,

[0114] (3) Similarity J between the business systems to which the IP address lists belong d :

[0115]

[0116] For example,

[0117] The similarity of other attributes is calculated using a similar method described above.

[0118] Next, calculate the overall similarity J(L1, L2) between the two IP address lists L1 and L2:

[0119]

[0120] For example,

[0121]

[0122] In some embodiments, the step of calculating the similarity of login success behavior of each user in the user group based on the login success lists of each user in the user group and the login success lists of other users in the user group includes: obtaining a list of source IP addresses and a list of destination IP addresses of each user's login success based on the login success lists of each user (e.g., a specific user) in the user group; obtaining a list of source IP addresses and a list of destination IP addresses of other users' login success based on the login success lists of other users in the user group; and calculating the similarity of login success behavior of each user and other users based on their IP addresses. The method for calculating the overall similarity of the lists is as follows: First overall similarity is calculated between the source IP address lists of successful logins for each user within the user group and the source IP address lists of successful logins for other users within the same user group; Second overall similarity is calculated between the destination IP address lists of successful logins for each user within the user group and the destination IP address lists of successful logins for other users within the same user group, using the same method for calculating the overall similarity of the IP address lists of the two users; Finally, the similarity of successful login behavior for each user within the user group is calculated based on the first overall similarity and the second overall similarity.

[0123] In some embodiments, the step of calculating the similarity of login failure behaviors for each user in the user group based on the login failure lists of each user in the user group and the login failure lists of other users in the user group includes: obtaining a list of source IP addresses and a list of destination IP addresses for each user's login failures based on the login failure lists of each user in the user group; obtaining a list of source IP addresses and a list of destination IP addresses for other users' login failures based on the login failure lists of other users in the user group; and calculating the similarity of login failure behaviors for each user in the user group based on the source IP address lists of the two users' login failures. The overall similarity calculation method calculates a third overall similarity between the source IP address list of each user's failed login and the source IP address list of other users' failed login within the user group; based on the destination IP address list of each user's failed login and the destination IP address list of other users' failed login within the user group, a fourth overall similarity is calculated using the same method as the overall similarity calculation of the two users' IP address lists; and based on the third and fourth overall similarities, the login failure behavior similarity of each user within the user group is calculated.

[0124] The following example illustrates the calculation process for the similarity between successful login behavior and failed login behavior.

[0125] (1) Similarity of successful user login behavior:

[0126] Receive the list of IPs that successfully logged in as user A (as a certain user) and the list of IPs that successfully logged in as user B (as another user) L_LS.

[0127] Extract the source IP list L_LS_sip_A and the destination IP list L_LS_dip_A for user A.

[0128] Extract the source IP list L_LS_sip_B and the destination IP list L_LS_dip_B for user B.

[0129] Following the method described above for calculating the overall similarity of the IP address lists of the two users, the first overall similarity J_LS between the source IP lists L_LS_sip_A and L_LS_sip_B of the two users is calculated. sip .

[0130] For example, J_LS sip =J(L_LS_sip_A, L_LS_sip_B)=0.7103.

[0131] Following the method described above for calculating the overall similarity of the IP address lists of the two users, the second overall similarity J_LS between the destination IP lists L_LS_dip_A and L_LS_dip_B of the two users is calculated. dip .

[0132] For example, J_LS dip =J(L_LS_dip_A, L_LS_dip_B)=0.8862.

[0133] Next, the similarity J_LS of successful user login behavior is calculated as follows:

[0134] J_LS=w sip1 ×J_LS sip +w dip1 ×J_LS dip (13)

[0135] Among them, w sip1 To achieve the first overall similarity J_LS sip The corresponding weight, w dip1 To achieve similarity with the second overall population J_LS dip The corresponding weight. w sip1 and w dip1 It can be set according to actual needs or obtained through training.

[0136] For example, set w sip1 =0.5, w dip1 =0.5, then

[0137] J_LS=w sip1 ×J_LS sip +w dip1 ×J_LS dip =0.5×0.7103+0.5×0.8862=0.7983.

[0138] Referring to the process of calculating the similarity of successful user login behavior, the similarity J_LF of failed user login behavior is calculated as follows:

[0139] J_LF=w sip2 ×J_LF sip +w dip2 ×J_LF dip (14)

[0140] Among them, J_LF sip For the third overall similarity, w sip2 J_LF is the weight corresponding to the third overall similarity. dip For the fourth overall similarity, w dip2The weights are those corresponding to the fourth overall similarity.

[0141] The formula for calculating the similarity of user login behavior is:

[0142] J(A, B) = w LS ×J_LS+w LF ×J_LF. (15)

[0143] weight w LS and w LF It can be set according to actual needs or obtained through training. For example, the weight w can be set. LS =0.5, w LF =0.5.

[0144] In some embodiments, the step of calculating the similarity of the operational behaviors of each user in the user group includes: calculating a first Euclidean distance between the operation quantity feature of the operation commands of each user (e.g., a certain user) in the user group and the operation quantity feature of the operation commands of other users in the user group; taking the reciprocal of the first Euclidean distance to obtain the initial operational similarity between each user in the user group and other users in the user group; calculating a second Euclidean distance between the abnormal operation matching frequency feature of the operation commands of each user in the user group and the abnormal operation matching frequency feature of the operation commands of other users in the user group; taking the reciprocal of the second Euclidean distance to obtain the abnormal operation similarity between each user in the user group and other users in the user group; and calculating the sum of the initial operational similarity and the abnormal operation similarity to obtain the operational behavior similarity of each user in the user group.

[0145] For example, consider the operation quantity features of two users to be analyzed: L_CH_A for user A (as a certain user), and L_CH_B for user B (as another user). Calculate the first Euclidean distance D1 between these two feature vectors, L_CH_A and L_CH_B, using a known algorithm. The similarity (i.e., initial operation similarity) C_H(A, B) between the operation behaviors of users A and B is:

[0146]

[0147] For example, we receive the abnormal operation matching frequency features of two users to be analyzed: abnormal operation matching frequency feature L_CA_A for user A and abnormal operation matching frequency feature L_CA_B for user B. We calculate the second Euclidean distance D2 between these two feature vectors L_CA_A and L_CA_B. The abnormal operation similarity C_A(A, B) between users A and B is:

[0148]

[0149] Next, the similarity C(A, B) of the actions of users A and B is:

[0150] C(A,B)=C_H(A,B)+C_A(A,B). (18)

[0151] Next, the user behavior similarity is calculated as follows:

[0152] S(A, B) = w J ×J(A, B)+w C ×C(A, B). (19)

[0153] Here, w J That is, w1, w mentioned above. C This refers to w2 as mentioned earlier.

[0154] In some embodiments, sample data can be input into a machine learning model, such as an SVM (support vector machine) or a Bayesian model, for training to calculate the overall user similarity weight w. J with w C .

[0155] In some embodiments, the step of obtaining the average feature of each user group includes: setting the number of center users in the user group to N, where N is a positive integer; calculating the intra-group average similarity between each user in the user group and other users in the user group; sorting the users in the user group according to the intra-group average similarity from largest to smallest, and selecting the top N users from the user group as center users; extracting the features corresponding to the N center users to form a center user feature list for the user group, which is used as the average feature; and sequentially obtaining the average feature of each user group in the user group set.

[0156] For example, let N be the number of central users in user group G1, and take... The top N users are identified as U_G1[U1,U2...]. Features corresponding to the top N users in user group G1 are extracted to form the central user feature list F_G1[[L_LS1, L_LF1, L_CH1, L_LA1], [L_LS2, L_LF2, L_CH2, L_LA2]...], which is the average feature. Log information from other user groups is received sequentially, and the corresponding central user feature lists F_G2, F_G3..., etc., for each group are output.

[0157] In some embodiments, a list of users marked as anomalous can be obtained, U_A[U1,U2...], and the average similarity of users within the anomalous user group can be calculated.

[0158]

[0159] Among them, S(U i U j ) refers to user U within the abnormal user group. i With user U j Similarity in user behavior between them.

[0160] In some embodiments, the method may further include: if the user to be analyzed is determined to be an abnormal user, calculating the user behavior similarity between the abnormal user and other users in the new user group; and selecting users from the new user group whose user behavior similarity is greater than the average similarity within the new user group, thereby forming a list of users suspected of abnormal operations. This can achieve the effect of risk user early warning.

[0161] In some implementations, the method may further include: acquiring user information for multiple users to be analyzed. These multiple users to be analyzed may belong to different user groups. Then, calculating the feature value of the abnormal operation matching frequency feature for each user to be analyzed. Next, obtaining a list of users whose feature values ​​are greater than 0, which is the abnormal operation user list. Calculating the user behavior similarity between an abnormal user in the abnormal operation user list and other users within the user group to which the abnormal user belongs. Finally, outputting users whose user behavior similarity is greater than the average similarity within the user group, forming a suspected abnormal operation user list. This can also achieve the effect of risk user early warning.

[0162] Figure 2 This is a flowchart illustrating an abnormal user detection method according to other embodiments of this disclosure. For example... Figure 2 As shown, the method includes steps S102 to S112 and S214 to S216. Steps S102 to S112 have been described in detail above and will not be repeated here. Steps S214 to S216 are described below.

[0163] In step S214, if the new user group is inconsistent with the historical user group, and the maximum average similarity is greater than or equal to the average similarity of users in the new user group, then the user to be analyzed is determined to be a suspected unauthorized user. A suspected unauthorized user refers to a user whose actual login behavior or operation differs significantly from the historical records, indicating a possibility of unauthorized access.

[0164] In step S216, if the new user group is inconsistent with the historical user group, and the maximum average similarity is less than the average similarity of users in the new user group, then the user to be analyzed is determined to be a user sharing an account. Here, the account is the credential used by the user to log in to the system. A user sharing an account refers to a user who shares an account with other people to log in to the system.

[0165] In this embodiment, abnormal users are divided into two categories: suspected unauthorized users and users sharing accounts. Using the above method, it is possible to determine whether an abnormal user is a suspected unauthorized user or a user sharing an account, thus enabling more comprehensive and accurate detection of abnormal users.

[0166] In the abnormal user detection method of the above embodiments, user similarity is analyzed by two types of features: user login behavior and user operation behavior. Abnormal user behavior is analyzed by operation behavior. Login features and operation features are combined to analyze user behavior similarity, thereby realizing risk user warning and avoiding the one-sided problem caused by relying solely on operation behavior analysis.

[0167] In analyzing user login behavior characteristics, the method comprehensively considers relevant information about the assets to which the IP belongs, including the IP network segment, the department to which it belongs, and the business system to which it belongs. This avoids the loss of behavioral information caused by precise IP matching, and allows for more comprehensive utilization of login behavior information. The method supports the addition of new features and has good scalability and flexibility.

[0168] The above method considers multi-dimensional information when calculating the similarity between IP sets, and realizes user behavior similarity analysis and calculation under multi-dimensional information.

[0169] In addition, the above method integrates information entropy theory. By analyzing the amount of information provided by each dimension of IP in the asset information database, it serves as the corresponding weight in the process of calculating user behavior similarity. This method can measure the degree of difference in the importance of each attribute under different asset environments, enabling user behavior analysis under different asset environments. The method has strong adaptability.

[0170] In some embodiments, the above method may further include a model training process. For example, the model training process:

[0171] Step 1: Input sample data.

[0172] Receive training sample data from the 4A system logs, and extract username / login source IP (sIP) / login destination IP (dIP) / login result / operation command. Obtain username-user group mapping information. Obtain the asset information database and extract information such as the department and business system to which the asset IP belongs. Receive the historical operation command database and extract the TOP100 command set L_CMD[ls,cd…]. Receive the abnormal operation feature database L_CMD_AN[regex1,regex2…]. Receive abnormal user marking information, i.e., marking information indicating whether the username is abnormal.

[0173] Step 2: Feature extraction.

[0174] Login feature extraction: Analyze the source IP and destination IP of each user who successfully logs in within 1 day to obtain the user login success list L_LS[(sIP1,dIP1),(sIP2,dIP2)...]; Analyze and count the source IP and destination IP of each user who failed to log in within 1 day to obtain the user login failure list L_LF.

[0175] Operation feature extraction: Extract the number of commands each user performs within one day, such as ls command performed 50 times and cd command performed 43 times, and output the operation number feature L_CH[50,43…] corresponding to L_CMD; Extract the commands each user performs within one day, and match each feature of L_CMD_AN in turn, such as feature regex1 matched successfully 3 times and regex2 matched successfully 1 time, and output the matching count feature L_CA[3,1…] corresponding to L_CMD_AN.

[0176] Step 3: Calculate the similarity between user login behavior and user operation behavior using the methods described above; calculate the user behavior similarity based on the similarity between user login behavior and user operation behavior.

[0177] Step 4: Output the model results

[0178] Calculate and output the average similarity within each user group according to the method described above, calculate and output the user group center user feature list (i.e. average feature), and output the average similarity of users within the abnormal user group.

[0179] This concludes the description of the model training process.

[0180] Figure 3 This is a schematic diagram illustrating the structure of an abnormal user detection device according to some embodiments of the present disclosure. Figure 3 As shown, the abnormal user detection device includes an acquisition unit 302, a calculation unit 304, and an analysis unit 306.

[0181] The acquisition unit 302 is used to obtain user information of the user to be analyzed. This user information includes user characteristics and the historical user groups to which the user to be analyzed belongs. User characteristics include user login characteristics and user operation characteristics.

[0182] The calculation unit 304 is used to calculate the average similarity between the user characteristics of the user to be analyzed and the average characteristics of each user group in a preset set of user groups. The multiple user groups include historical user groups.

[0183] The analysis unit 306 is used to select the user group with the highest average similarity among multiple user groups as the new user group to which the user to be analyzed belongs; if the new user group is consistent with the historical user group, the user to be analyzed is determined to be a normal user; and if the new user group is inconsistent with the historical user group, the user to be analyzed is determined to be an abnormal user.

[0184] Thus, an abnormal user detection apparatus according to some embodiments of this disclosure is provided. This embodiment realizes the detection of abnormal users. By analyzing user similarity based on two types of features—user login behavior and user operation behavior—and analyzing abnormal user behavior through operation behavior analysis, abnormal users can be detected more comprehensively and accurately.

[0185] In some embodiments, the analysis unit 306 is further configured to determine that the user to be analyzed is a suspected unauthorized user if the new user group is inconsistent with the historical user group and the largest average similarity is greater than or equal to the average similarity of the users in the new user group; and to determine that the user to be analyzed is a user sharing an account if the new user group is inconsistent with the historical user group and the largest average similarity is less than the average similarity of the users in the new user group.

[0186] In some embodiments, the acquisition unit 302 is used to receive system log data within the current time period; extract the username, login source Internet Protocol IP address, login destination IP address, login result, and operation command from the system log data; analyze to obtain the user login characteristics and user operation characteristics of the user to be analyzed, wherein the user login characteristics include characteristics of successful user login and characteristics of failed user login, and the user operation characteristics include operation quantity characteristics and abnormal operation matching frequency characteristics.

[0187] In some embodiments, the acquisition unit 302 is used to analyze the source IP addresses and destination IP addresses of the user to be analyzed who successfully logged in within a predetermined time to obtain a list of successful user logins, thereby obtaining the characteristics of successful user logins; and to analyze and statistically analyze the source IP addresses and destination IP addresses of the user to be analyzed who failed to log in within the predetermined time to obtain a list of failed user logins, thereby obtaining the characteristics of failed user logins.

[0188] In some embodiments, the acquisition unit 302 is used to extract the number of times the user to be analyzed performs an operation command within a predetermined time period to obtain the operation quantity feature of the operation command; and to extract the operation command of the user to be analyzed within the predetermined time period, and sequentially match the operation command with each feature in the abnormal operation feature library to obtain the abnormal operation matching number feature of the corresponding feature of the operation command.

[0189] In some embodiments, the calculation unit 304 is further configured to calculate the average user similarity of each of the plurality of user groups in the user group set. The acquisition unit 302 is further configured to obtain the average features of each user group.

[0190] In some embodiments, the calculation unit 304 is configured to calculate the user behavior similarity between each user in a user group and each other user in the user group; calculate the intra-group average similarity between each user in the user group and all other users in the user group based on the user behavior similarity between each user in the user group and each other user in the user group; and calculate the average of the intra-group average similarities of all users in the user group as the user average similarity of the user group.

[0191] In some embodiments, the acquisition unit 302 is used to acquire a user login success list, a user login failure list, operation command operation quantity characteristics, and abnormal operation matching frequency characteristics for each user in the user group. The user login success list includes the source IP address and destination IP address of a user who successfully logged in within a predetermined time period, and the user login failure list includes the source IP address and destination IP address of a user who failed to log in within the predetermined time period. The calculation unit 304 is used to calculate the login behavior similarity of each user in the user group based on the user login success list and user login failure list; calculate the operation behavior similarity of each user in the user group based on the operation command operation quantity characteristics and abnormal operation matching frequency characteristics; and calculate the user behavior similarity of each user in the user group based on the login behavior similarity, operation behavior similarity, and corresponding weights.

[0192] In some embodiments, the calculation unit 304 is configured to calculate the similarity of login success behavior of each user in the user group based on the login success list of each user in the user group and the login success list of other users in the user group; calculate the similarity of login failure behavior of each user in the user group based on the login failure list of each user in the user group and the login failure list of other users in the user group; and calculate the similarity of login behavior of each user in the user group based on the similarity of login success behavior and the similarity of login failure behavior.

[0193] In some embodiments, the calculation unit 304 is configured to calculate a first Euclidean distance between the operation quantity feature of each user's operation commands and the operation quantity feature of other users' operation commands within the user group; take the reciprocal of the first Euclidean distance to obtain the initial operation similarity between each user in the user group and other users in the user group; calculate a second Euclidean distance between the abnormal operation matching frequency feature of each user's operation commands and the abnormal operation matching frequency feature of other users' operation commands within the user group; take the reciprocal of the second Euclidean distance to obtain the abnormal operation similarity between each user in the user group and other users in the user group; and calculate the sum of the initial operation similarity and the abnormal operation similarity to obtain the operation behavior similarity between each user in the user group.

[0194] In some embodiments, the calculation unit 304 is configured to: obtain a list of source IP addresses and a list of destination IP addresses for each user's successful login based on the user login success list of each user in the user group; obtain a list of source IP addresses and a list of destination IP addresses for other users' successful login based on the user login success lists of other users in the user group; calculate a first overall similarity between the source IP address lists of each user's successful login and the source IP address lists of other users' successful login according to a method for calculating the overall similarity of the IP address lists of two users; calculate a second overall similarity between the destination IP address lists of each user's successful login and the destination IP address lists of other users' successful login according to a method for calculating the overall similarity of the IP address lists of two users; and calculate a similarity of the login success behavior of each user in the user group based on the first overall similarity and the second overall similarity.

[0195] In some embodiments, the acquisition unit 302 is configured to obtain a list of source IP addresses and a list of destination IP addresses for each user's failed login attempts based on the user login failure list of each user in the user group; and to obtain a list of source IP addresses and a list of destination IP addresses for other users' failed login attempts based on the user login failure lists of other users in the user group. The calculation unit 304 is configured to calculate a third overall similarity between the source IP address lists of each user in the user group and the source IP address lists of other users' failed login attempts, using a method for calculating the overall similarity of the IP address lists of the two users; calculate a fourth overall similarity between the destination IP address lists of each user in the user group and the destination IP address lists of other users' failed login attempts, using the same method for calculating the overall similarity of the IP address lists of the two users; and calculate the similarity of the login failure behaviors of each user in the user group based on the third overall similarity and the fourth overall similarity.

[0196] In some embodiments, the two users include a first user and a second user. The acquisition unit 302 is used to obtain a list of IP addresses for the first user and a list of IP addresses for the second user; obtain an asset information database, and extract multiple attribute fields corresponding to the IP addresses from the asset information database. The calculation unit 304 is used to calculate the weight value of each of the multiple attribute fields in the asset information database; extract attribute fields corresponding to each IP address in the list of IP addresses for the first user and the second user from the asset information database, and save them as different attribute lists; calculate the attribute similarity of each corresponding attribute list for the first user and the second user; and calculate the overall similarity of the IP address lists of the two users based on the attribute similarity of each corresponding attribute list for the first user and the second user and the weight value corresponding to each attribute field.

[0197] In some embodiments, the analysis unit 306 is further configured to, when it is determined that the user to be analyzed is an abnormal user, calculate the user behavior similarity between the abnormal user and other users in the new user group; and select users from the new user group whose user behavior similarity is greater than the average similarity within the new user group, thereby forming a list of suspected abnormal operation users.

[0198] In some embodiments, the acquisition unit 302 is used to set the number of central users in a user group to N, where N is a positive integer; calculate the intra-group average similarity between each user in the user group and other users in the user group; sort the users in the user group according to the intra-group average similarity from largest to smallest, and select the top N users from the user group as central users; extract the features corresponding to the N central users to form a central user feature list for the user group, which is used as the average feature; and sequentially acquire the average feature of each user group in the user group set.

[0199] Figure 4 This is a schematic diagram illustrating the structure of an abnormal user detection device according to other embodiments of the present disclosure. The abnormal user detection device includes a memory 410 and a processor 420. Wherein:

[0200] The memory 410 can be a disk, flash memory, or any other non-volatile storage medium. The memory is used for storing... Figure 1 and / or Figure 2 The instructions in the corresponding embodiment.

[0201] Processor 420 is coupled to memory 410 and can be implemented as one or more integrated circuits, such as a microprocessor or microcontroller. Processor 420 executes instructions stored in memory, enabling the detection of abnormal users.

[0202] In some embodiments, it may also be as follows Figure 5 As shown, the abnormal user detection device 500 includes a memory 510 and a processor 520. The processor 520 is coupled to the memory 510 via a BUS bus 530. The abnormal user detection device 500 can also be connected to an external storage device 550 via a storage interface 540 to access external data, and can also be connected to a network or another computer system (not shown) via a network interface 560, which will not be described in detail here.

[0203] In this embodiment, data instructions are stored in a memory and then processed by a processor to detect abnormal users.

[0204] In other embodiments, this disclosure also provides a non-transitory computer-readable storage medium having stored thereon computer program instructions that are implemented when executed by a processor. Figure 1 and / or Figure 2The steps of the method in the corresponding embodiments are described. Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, apparatus, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0205] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0206] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0207] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0208] This concludes the detailed description of the present disclosure. To avoid obscuring the concept of the disclosure, some details known in the art have not been described. Those skilled in the art will fully understand how to implement the technical solutions disclosed herein based on the above description.

[0209] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. An abnormal user detection method, comprising: Obtain user information of the user to be analyzed, the user information including user characteristics and the historical user group to which the user to be analyzed belongs, the user characteristics including user login characteristics and user operation characteristics; The average similarity between the user characteristics of the user to be analyzed and the average characteristics of each user group in a preset set of user groups is calculated. The set of user groups includes the historical user groups. The average characteristics are obtained by selecting the top N users with the highest average similarity within the user group as center users, extracting the characteristics corresponding to the N center users, and forming a center user characteristic list for the user group. The average similarity is the arithmetic mean obtained by calculating the overall similarity between the user characteristics of the user to be analyzed and each user in the user group. The user group with the highest average similarity among the multiple user groups is selected as the new user group to which the user to be analyzed belongs; If the new user group matches the historical user group, then the user to be analyzed is determined to be a normal user; and If the new user group is different from the historical user group, then the user to be analyzed is determined to be an abnormal user.

2. The abnormal user detection method according to claim 1 further includes: If the new user group is different from the historical user group, and the largest average similarity is greater than or equal to the average similarity of the new user group, then the user to be analyzed is determined to be a suspected unauthorized user. as well as If the new user group is not the same as the historical user group, and the largest average similarity is less than the average similarity of the new user group, then the user to be analyzed is determined to be a user sharing an account.

3. The abnormal user detection method according to claim 1, wherein, The steps to obtain user information of the user to be analyzed include: Receive system log data for the current time period; Extract the username, source Internet Protocol IP address, destination IP address, login result, and operation command from the system log data. The analysis yields the user login characteristics and user operation characteristics of the user to be analyzed. The user login characteristics include characteristics of successful user login and characteristics of failed user login. The user operation characteristics include operation quantity characteristics and abnormal operation matching frequency characteristics.

4. The abnormal user detection method according to claim 3, wherein, The steps for analyzing and obtaining the user login characteristics of the user to be analyzed include: Analyze the source IP addresses and destination IP addresses of the users who successfully logged in within a predetermined time period to obtain a list of successful user logins, thereby obtaining the characteristics of successful user logins; and By analyzing and statistically analyzing the source IP addresses and destination IP addresses of the users who failed to log in within the predetermined time period, a list of failed user logins is obtained, thereby identifying the characteristics of user login failures.

5. The abnormal user detection method according to claim 3, wherein, The steps for analyzing and obtaining the user operation characteristics of the user to be analyzed include: Extract the number of times the user performs an operation command within a predetermined time period to obtain the operation quantity feature of the operation command; and Extract the operation commands of the user to be analyzed within the predetermined time period, and match the operation commands with each feature in the abnormal operation feature library in sequence to obtain the abnormal operation matching frequency feature of the corresponding feature of the operation command.

6. The abnormal user detection method according to claim 1 further includes: Before obtaining the user information of the user to be analyzed, the average similarity of users in each of the multiple user groups in the user group set is calculated, and the average feature of each user group is obtained.

7. The abnormal user detection method according to claim 6, wherein, The steps for calculating the average user similarity for each of the plurality of user groups in the user group set include: Calculate the similarity of user behavior between each user in a user group and every other user in that user group; Calculate the intra-group average similarity between each user in the user group and all other users in the user group based on the user behavior similarity between each user in the user group and each other user in the user group; and The average of the intra-group average similarity of all users in the user group is calculated as the average user similarity of the user group.

8. The abnormal user detection method according to claim 7, wherein, The steps for calculating the similarity of user behavior between each user in a user group and every other user in that user group include: Obtain the user login success list, user login failure list, operation command operation quantity characteristics, and abnormal operation matching frequency characteristics for each user in the user group. The user login success list includes the source IP address and destination IP address of the user who successfully logged in within a predetermined time, and the user login failure list includes the source IP address and destination IP address of the user who failed to log in within the predetermined time. Calculate the similarity of login behavior for each user in the user group based on the list of successful logins and the list of failed logins for each user in the user group. Calculate the similarity of operational behaviors for each user within a user group based on the number of operational commands and the number of abnormal operation matches for each user in that user group; and The similarity of user behavior within a user group is calculated based on the similarity of login behavior, similarity of operation behavior, and corresponding weights.

9. The abnormal user detection method according to claim 8, wherein, The steps for calculating the similarity of login behavior for each user within the user group include: Calculate the similarity of login success behavior for each user in the user group based on the login success lists of each user in the user group and the login success lists of other users in the user group. Calculate the similarity of login failure behaviors for each user in the user group based on the login failure lists of each user in the user group and the login failure lists of other users in the user group; and The similarity of login behavior for each user in the user group is calculated based on the similarity of successful login behavior and the similarity of failed login behavior.

10. The abnormal user detection method according to claim 8, wherein, The steps for calculating the similarity of the operational behaviors of each user within the user group include: Calculate the first Euclidean distance between the operation quantity characteristics of each user's operation commands and the operation quantity characteristics of other users' operation commands within the user group; Take the reciprocal of the first Euclidean distance to obtain the initial operational similarity between each user in the user group and other users in the user group; Calculate the second Euclidean distance between the abnormal operation matching frequency feature of each user's operation commands in the user group and the abnormal operation matching frequency feature of other users' operation commands in the user group; Taking the reciprocal of the second Euclidean distance to obtain the similarity of anomalous operations between each user in the user group and other users in the user group; and The sum of the initial operation similarity and the abnormal operation similarity is calculated to obtain the operation behavior similarity of each user in the user group.

11. The abnormal user detection method according to claim 9, wherein, The steps for calculating the similarity of login success behavior for each user in a user group based on the user login success lists of each user in the user group and the user login success lists of other users in the user group include: Based on the successful login list of each user in the user group, obtain the source IP address list and destination IP address list of each user's successful login; Based on the list of successful logins of other users in the user group, obtain the list of source IP addresses and destination IP addresses of successful logins of other users. The first overall similarity between the source IP address list of each user in the user group who successfully logged in and the source IP address list of other users in the user group is calculated according to the overall similarity calculation method of the IP address lists of the two users. The second overall similarity between the destination IP address list of each user in the user group and the destination IP address list of other users who have successfully logged in is calculated according to the calculation method of the overall similarity of the IP address lists of the two users. Based on the first overall similarity and the second overall similarity, calculate the similarity of the login success behavior of each user in the user group.

12. The abnormal user detection method according to claim 9, wherein, The steps for calculating the similarity of login failure behaviors for each user in the user group based on the user login failure list of each user in the user group and the user login failure lists of other users in the user group include: Based on the list of failed login attempts for each user in the user group, obtain the list of source IP addresses and the list of destination IP addresses for each failed login attempt. Based on the list of failed login attempts of other users in the user group, obtain the list of source IP addresses and destination IP addresses of those failed login attempts. The third overall similarity is calculated based on the list of source IP addresses of each user's failed login attempts and the list of source IP addresses of other users' failed login attempts within the user group, using the same method as the overall similarity calculation of the IP address lists of the two users. The fourth overall similarity is calculated based on the list of destination IP addresses of each user's failed login attempts and the list of destination IP addresses of other users' failed login attempts within the user group, according to the calculation method for the overall similarity of the IP address lists of the two users. Based on the third overall similarity and the fourth overall similarity, calculate the similarity of login failure behavior for each user in the user group.

13. The abnormal user detection method according to claim 11 or 12, wherein, The two users include the first user and the second user. The method for calculating the overall similarity of the IP address lists of the two users includes: Obtain the IP address list of the first user and the IP address list of the second user; Obtain the asset information database and extract multiple attribute fields corresponding to IP addresses from the asset information database; Calculate the weight value of each of the multiple attribute fields in the asset information database; Extract the attribute fields corresponding to each IP address in the IP address list of the first user and the IP address list of the second user from the asset information database, and save them as different attribute lists respectively; Calculate the attribute similarity between the corresponding attribute lists of the first user and the second user; and The overall similarity of the IP address lists of the two users is calculated based on the attribute similarity of each corresponding attribute list of the first user and the second user and the weight value corresponding to each attribute field.

14. The abnormal user detection method according to claim 1, further comprising: If the user to be analyzed is determined to be an abnormal user, calculate the user behavior similarity between the abnormal user and other users in the new user group; as well as Users whose behavior similarity is greater than the average similarity within the new user group are selected from the new user group to form a list of users suspected of abnormal behavior.

15. The abnormal user detection method according to claim 6, wherein, The steps to obtain the average characteristics of each user group include: Let N be the number of central users in the user group, where N is a positive integer. Calculate the average intra-group similarity between each user in the user group and other users in the user group; Sort the users in the user group from largest to smallest according to the average similarity within the group, and select the top N users from the user group as the center users; Extract the features corresponding to N central users and form a list of central user features for this user group, which will be used as the average feature. The average characteristics of each user group in the user group set are obtained sequentially.

16. An abnormal user detection device, comprising: The acquisition unit is used to obtain user information of the user to be analyzed. The user information includes user characteristics and the historical user group to which the user to be analyzed belongs. The user characteristics include user login characteristics and user operation characteristics. The calculation unit is used to calculate the average similarity between the user characteristics of the user to be analyzed and the average characteristics of each user group in a preset set of user groups, wherein the multiple user groups include the historical user groups. The average characteristics are obtained by selecting the top N users with the highest average similarity within the user group as center users, extracting the characteristics corresponding to the N center users, and forming a center user characteristic list for the user group. The average similarity is the value obtained by calculating the overall similarity between the user characteristics of the user to be analyzed and each user in the user group, and then taking the arithmetic mean. The analysis unit is configured to select the user group with the highest average similarity among the plurality of user groups as the new user group to which the user to be analyzed belongs; if the new user group is consistent with the historical user group, the user to be analyzed is determined to be a normal user; and if the new user group is inconsistent with the historical user group, the user to be analyzed is determined to be an abnormal user.

17. An abnormal user detection device, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method as described in any one of claims 1 to 15 based on instructions stored in the memory.

18. A non-transitory computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the method as claimed in any one of claims 1 to 15.

Images