User behavior analysis method and device, electronic equipment and computer storage medium

Abstract

The present disclosure provides a user behavior analysis method and device, electronic equipment and computer storage medium, obtaining target user's to-be-analyzed data in a target intranet; converting the to-be-analyzed data into a corresponding feature vector; performing abnormality detection on the feature vector based on a pre-trained abnormality detection model to obtain abnormal data in the to-be-analyzed data, and / or performing detection on the feature vector based on a machine learning algorithm to obtain abnormal data; and generating a behavior portrait of the target user based on the abnormal data. In the present disclosure, the to-be-analyzed data of the target user in the target intranet can be converted into a corresponding feature vector, and the feature vector can be detected for abnormality based on a pre-trained abnormality detection model to obtain abnormal data in the to-be-analyzed data, and / or the feature vector can be detected based on a machine learning algorithm to obtain abnormal data, thereby achieving accurate detection of abnormal data in the to-be-analyzed data, and further achieving accurate analysis of user behavior in the intranet.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network security, and more particularly, to a user behavior analysis method and device, an electronic device, and a computer storage medium. BACKGROUND

[0002] Currently, in order to facilitate mutual communication among multiple users, the multiple users can be included in a set local area network (LAN), so that the multiple users communicate by means of the LAN. However, since computers in the LAN can access and communicate with each other and can share resources, the security of the LAN is affected by users, such as malicious spread of encrypted files, tampering with confidential files, and the like, which can reduce the security of the LAN.

[0003] In order to ensure the security of the LAN, the behavior of the user can be detected based on feature knowledge base and rule matching recognition detection, so as to determine whether the LAN is secure. However, the feature knowledge base and rule matching recognition detection is a non-black or white detection technology, which has a strong dependence on domain technology and knowledge, and needs the support of domain experts or professional technology. In addition, the expert knowledge can only establish a rule base for historical malicious characteristics or characteristics that can be predicted in advance. However, the randomness and flexibility of user behavior is high, and it is difficult for experts to predict in advance. Therefore, the feature knowledge base and rule matching recognition detection cannot detect various potential "legal" behaviors triggered by users in the LAN, and is prone to missed detection, which makes it difficult to ensure the security of the LAN.

[0004] In summary, how to accurately analyze the behavior of users in the LAN is a problem that needs to be solved by those skilled in the art. SUMMARY

[0005] The purpose of the present disclosure is to provide a user behavior analysis method which can solve the technical problem of how to accurately analyze the behavior of users in the LAN to some extent. The present disclosure also provides a user behavior analysis device, an electronic device, and a computer readable storage medium.

[0006] According to a first aspect of an embodiment of the present disclosure, a user behavior analysis method is provided, comprising:

[0007] obtaining to-be-analyzed data of a target user in a target LAN;

[0008] converting the to-be-analyzed data into a corresponding feature vector;

[0009] performing anomaly detection on the feature vector based on a pre-trained anomaly detection model to obtain abnormal data in the to-be-analyzed data, and / or performing detection on the feature vector based on a machine learning algorithm to obtain the abnormal data;

[0010] generating a behavior portrait of the target user based on the abnormal data.

[0011] Preferably, the converting the to-be-analyzed data into a corresponding feature vector comprises:

[0012] performing normalization processing on the to-be-analyzed data to obtain a processing result;

[0013] converting the processing result into a corresponding feature vector;

[0014] Preferably, the normalization processing comprises information completion, attribute unified mapping, data verification and merging, association integration, filtering, aggregation, and abnormal behavior identification.

[0015] Preferably, the converting the processing result into a corresponding feature vector comprises:

[0016] performing feature processing and conversion on the processing result based on a feature processing operator one-hot encoding, and / or an N-Gram model, and / or a TF-IDF model, and / or a preset feature operator, and / or a preset algorithm, to obtain a corresponding feature vector, wherein the preset feature operator comprises counting, variance, and mean.

[0017] Preferably, the performing feature processing and conversion on the processing result based on a feature processing operator one-hot encoding, and / or an N-Gram model, and / or a TF-IDF model, and / or a preset feature operator, and / or a preset algorithm, to obtain a corresponding feature vector comprises:

[0018] performing feature processing and conversion on enumeration type data in the to-be-analyzed data based on the feature processing operator one-hot encoding, to obtain a corresponding feature vector;

[0019] and / or performing feature processing and conversion on to-be-aggregated data in the to-be-analyzed data based on the preset feature operator, to obtain a corresponding feature vector;

[0020] and / or performing feature processing and conversion on text type strings in the to-be-analyzed data based on the N-Gram model and the TF-IDF model, to obtain a corresponding feature vector;

[0021] and / or performing feature processing and conversion on the processing result based on the preset algorithm, to obtain a corresponding feature vector.

[0022] Preferably, the performing abnormal detection on the feature vector based on a pre-trained abnormal detection model comprises:

[0023] performing anomaly detection on the feature vector based on the pre-trained anomaly detection model, the anomaly detection model comprising a detection model generated based on a time series algorithm and / or a classification algorithm and / or a statistical analysis algorithm.

[0024] Preferably, the anomaly detection model comprises:

[0025] a first detection model for performing anomaly detection on single-dimensional time series data in the data to be analyzed, built based on the time series algorithm and the statistical analysis algorithm;

[0026] a second detection model for performing anomaly detection on multi-dimensional labeled data in the data to be analyzed, built based on the classification algorithm, wherein the classification algorithm comprises SVM and xgboost.

[0027] Preferably, the detection on the feature vector based on the machine learning algorithm comprises:

[0028] detection on the feature vector corresponding to multi-dimensional unlabeled data in the data to be divided based on the machine learning algorithm, the machine learning algorithm comprising a clustering algorithm and a graph algorithm.

[0029] Preferably, the types of the data to be analyzed comprise user behavior information, classified information flow data, network traffic data, user self information, and internal network information.

[0030] Preferably, the generation of the behavior portrait of the target user based on the abnormal data comprises:

[0031] determination of an abnormal behavior category and an abnormal behavior event of the target user based on the abnormal data;

[0032] generation of the behavior portrait based on the abnormal behavior category and the abnormal behavior event.

[0033] Preferably, the abnormal behavior category comprises one or more of login anomaly, overreach violation, operation violation, login violation, duty anomaly, and data export violation; and the abnormal behavior event comprises one or more of violation downgrade printing data, violation use of peripheral device, foreign address login, violation possession of classified information, host login violation, database login violation, violation access to classified information, non-ordinary device login, frequent deletion of account, frequent change of file, process control violation, violation modification of registration information, and non-working time login.

[0034] According to a second aspect of the embodiments of the present disclosure, a user behavior analysis apparatus is provided, comprising:

[0035] a first acquisition module configured to acquire data to be analyzed of a target user in a target internal network;

[0036] The first conversion module is configured to convert the data to be analyzed into a corresponding feature vector.

[0037] The first detection module is configured to perform anomaly detection on the feature vector based on a pre-trained anomaly detection model to obtain abnormal data in the data to be analyzed, and / or perform detection on the feature vector based on a machine learning algorithm to obtain the abnormal data.

[0038] The first generation module is configured to generate a behavior portrait of the target user based on the abnormal data.

[0039] According to a third aspect of the embodiments of the present disclosure, an electronic device is provided, comprising:

[0040] The memory is configured to store a computer program.

[0041] The processor is configured to execute the computer program in the memory to implement the steps of any of the above methods.

[0042] According to a fourth aspect of the embodiments of the present disclosure, a computer readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0043] The user behavior analysis method provided by the present disclosure comprises the following steps: obtaining data to be analyzed of a target user in a target intranet; converting the data to be analyzed into a corresponding feature vector; performing anomaly detection on the feature vector based on a pre-trained anomaly detection model to obtain abnormal data in the data to be analyzed, and / or performing detection on the feature vector based on a machine learning algorithm to obtain the abnormal data; and generating a behavior portrait of the target user based on the abnormal data. In the user behavior analysis method provided by the present disclosure, the data to be analyzed of the target user in the target intranet can be converted into a corresponding feature vector, which facilitates subsequent processing of the data to be analyzed. In addition, anomaly detection can be performed on the feature vector based on a pre-trained anomaly detection model to obtain abnormal data in the data to be analyzed, and / or detection can be performed on the feature vector based on a machine learning algorithm to obtain the abnormal data, which realizes accurate detection of abnormal data in the data to be analyzed. In this way, when a behavior portrait of the target user is generated based on the abnormal data, a behavior portrait that can accurately reflect the abnormal behavior of the target user can be generated, and accurate analysis of user behavior in the intranet is realized. The user behavior analysis device, the electronic device and the computer readable storage medium provided by the present disclosure also solve the corresponding technical problems.

[0044] It should be understood that the general description above and the detailed description below are only exemplary and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only a part of the embodiments of the present disclosure, and for those skilled in the art, other drawings can be obtained based on the provided drawings without creative labor.

[0046] Figure 1 A first flow chart of a user behavior analysis method according to an exemplary embodiment;

[0047] Figure 2 A second flow chart of a user behavior analysis method according to an exemplary embodiment;

[0048] Figure 3 A third flow chart of a user behavior analysis method according to an exemplary embodiment;

[0049] Figure 4 A schematic diagram of a visual interface;

[0050] Figure 5 A schematic diagram of a multi-task parallel computing framework;

[0051] Figure 6 A fourth flow chart of a user behavior analysis method according to an exemplary embodiment;

[0052] Figure 7 A structural schematic diagram of a user behavior analysis apparatus according to an exemplary embodiment;

[0053] Figure 8 A block diagram of an electronic device 900 according to an exemplary embodiment. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the present disclosure.

[0055] At present, in order to facilitate mutual communication among multiple users, the multiple users can be brought into a set local area network (LAN) so that the multiple users communicate by means of the LAN. However, since the computers in the LAN can access and communicate with each other and can share resources, etc., the security of the LAN is affected by the users, and in recent years, data leakage events occur frequently. According to an investigation report of an authoritative organization, more than 70% of information leakage events come from "legal" users in the enterprise LAN, that is, users who have legal permissions in the LAN environment and implement unintentional or malicious behaviors to seriously threaten the security of the LAN. The operation behaviors of the "legal" users can completely bypass the security protection mechanism due to the legality, break through the network boundary, and steal sensitive data.

[0056] The reason is that the LAN has the following problems: the LAN does not belong to a completely isolated network, the computers can access and communicate with each other, such as exchanging information and transferring data by means of tools such as email and instant messaging; some computers are shared, such as printers, CD burners, etc., and can share and transfer data resources; human factors cause policy configuration errors, such as a security administrator assigning a high permission to a low permission account; and the LAN system itself has technical or management vulnerabilities. Based on the above, if the security awareness and confidentiality awareness of the LAN users are weak, etc., some non-compliant or seemingly "legal" behaviors can be triggered, such as sharing classified information to personnel outside the scope of permission, transferring high-classification-level information to a low-classification-level domain through email or instant messaging tools, attempting to remove the classification of classified files, attempting to tamper with classified files, attempting to collect classified information through low-frequency and long-term operation, and not installing system patches in time due to negligence. These behaviors can threaten the security of the LAN.

[0057] In order to ensure the security of the LAN, the behaviors of the users can be detected based on feature knowledge base and rule matching recognition detection to determine whether the LAN is secure. However, the feature knowledge base and rule matching recognition detection is a non-black or white detection technology, which has strong dependence on domain technology and knowledge, needs the support of domain experts or professional technology, and the expert knowledge can only establish a rule base for historical malicious characteristics or characteristics that can be predicted in advance. The randomness and flexibility of user behaviors are high, and experts are difficult to predict in advance. Therefore, the feature knowledge base and rule matching recognition detection cannot detect various potential "legal" behaviors triggered by users in the LAN, is prone to missed detection, and is difficult to ensure the security of the LAN. The user behavior analysis method provided in the present application can accurately analyze the behaviors of the users in the LAN.

[0058] Please refer to Figure 1 , Figure 1A first flowchart of a user behavior analysis method according to an exemplary embodiment.

[0059] The user behavior analysis method according to the present disclosure can comprise the following steps:

[0060] Step S101: Obtain the to-be-analyzed data of a target user in a target intranet.

[0061] It can be understood that the type of the to-be-analyzed data can be determined according to the application scenario, such as the to-be-analyzed data can include user behavior information, classified information flow data, network traffic data, user information, intranet information, etc. The user behavior information refers to information describing the corresponding behavior of the user in the intranet, such as the user's file sending behavior information, file deletion behavior information, etc. The classified information flow data refers to the flow data of information related to secrecy, such as the transmission data of encrypted files in the intranet, etc. The network traffic data refers to the traffic data generated by the user behavior in the intranet, etc. The user information and the intranet information can include personnel attribute data, classified information attribute data, organization information, etc. Further, after obtaining the to-be-analyzed data of the target user in the target intranet, the to-be-analyzed data can be stored according to categories for subsequent quick processing of the corresponding to-be-analyzed data, such as storing the user information, classified information flow data, and intranet information into a relational database, storing the user behavior information, network traffic data, and intranet information into an elasticsearch cluster or a queue, etc.

[0062] It can be understood that the obtaining process of the to-be-analyzed data of the target user in the target intranet can also be determined according to the application scenario, such as obtaining the to-be-analyzed data of the target user in the target intranet through syslog (system log), jdbc (Java Database Connectivity), rest (Representational State Transfer) interface, etc. In addition, the format of the obtained to-be-analyzed data can be a log, etc., which is not limited in the present disclosure.

[0063] It should be noted that in the application scenario, the corresponding to-be-analyzed data of the target user can be recorded from the perspectives of beat.hostname, beat.name, beat.versin, event category, event generation time, event level, event name, event responsible department, event responsible department ID, event responsible person ID, event responsible person name, event responsible person secret level, event label, event type, host IP, log type, operation result, Key of event reporting device asset, event reporting device IP, Syslog log reporting module, timestamp, user name, etc. so that the user can know the corresponding information of the to-be-analyzed data in detail and accurately. For example, beat.hostname can be K-PC, beat.name can be auditlog, beat.versin can be 7.3.2, event category can be audit log, event generation time can be 2021 / 3 / 10T16:00:00.000+0800, event level can be information, event name can be file download audit, event responsible department can be security application product line, event responsible department ID can be 01001001003, event responsible person ID can be e6e6ad937b5a464cb9dfc591d36b1001b, event responsible person name can be Huang XX4565, event responsible person secret level can be important secret, event label can be behavior related, file flow, event type can be file operation audit, host IP can be 192.168.100.231, log type can be download file output, operation result can be operation success, Key of event reporting device asset can be collection agent / Windows / V1.0, event reporting device IP can be 10.131.110.10, Syslog log reporting module can be AUD, timestamp can be 2021 / 11 / 26 / 13:14:11, and user name can be Huang XX4565, etc. The present disclosure does not make specific limitations here.

[0064] Step S102: converting the to-be-analyzed data into a corresponding feature vector.

[0065] It can be understood that after obtaining the to-be-analyzed data of the target user in the target intranet, the to-be-analyzed data can be converted into a corresponding feature vector, so as to subsequently process the feature vector by means of a machine learning algorithm, and then process the to-be-analyzed data.

[0066] Step S103: performing anomaly detection on the feature vector based on a pre-trained anomaly detection model to obtain abnormal data in the to-be-analyzed data, and / or performing detection on the feature vector based on a machine learning algorithm to obtain abnormal data.

[0067] Step S104: generating a behavior portrait of the target user based on the abnormal data.

[0068] It can be understood that after the to-be-analyzed data is converted into the corresponding feature vector, the feature vector can be detected for abnormality based on the pre-trained abnormality detection model to obtain the abnormal data in the to-be-analyzed data, and / or the feature vector can be detected based on the machine learning algorithm to obtain the abnormal data; and then the behavior portrait of the target user can be generated based on the abnormal data.

[0069] It should be noted that in the present disclosure, the frequency of detecting the feature vector for abnormality based on the pre-trained abnormality detection model to obtain the abnormal data in the to-be-analyzed data, and / or detecting the feature vector based on the machine learning algorithm to obtain the abnormal data can be determined according to the application scenario, such as detecting the feature vector for abnormality based on the pre-trained abnormality detection model to obtain the abnormal data in the to-be-analyzed data, and / or detecting the feature vector based on the machine learning algorithm to obtain the abnormal data at a fixed time every day; or detecting the feature vector for abnormality based on the pre-trained abnormality detection model to obtain the abnormal data in the to-be-analyzed data, and / or detecting the feature vector based on the machine learning algorithm to obtain the abnormal data every interval, such as every 3 days, and the like, which is not limited in the present disclosure.

[0070] The user behavior analysis method provided by the present disclosure comprises the following steps: In the user behavior analysis method provided by the present disclosure, the to-be-analyzed data of the target user in the target intranet can be converted into the corresponding feature vector, which is convenient for subsequent processing of the to-be-analyzed data, and the feature vector can be detected for abnormality based on the pre-trained abnormality detection model to obtain the abnormal data in the to-be-analyzed data, and / or the feature vector can be detected based on the machine learning algorithm to obtain the abnormal data, which realizes accurate detection of the abnormal data in the to-be-analyzed data. In this way, when the behavior portrait of the target user is generated based on the abnormal data, the behavior portrait that can accurately reflect the abnormal behavior of the target user can be generated, and accurate analysis of the user behavior in the intranet is realized.

[0071] Please refer to Figure 2 , Figure 2 FIG. 2 is a second flowchart of a user behavior analysis method according to an exemplary embodiment.

[0072] The user behavior analysis method provided by the present disclosure can comprise the following steps:

[0073] Step S201: Obtain the to-be-analyzed data of a target user in a target intranet.

[0074] Step S202: Perform normalization processing on the to-be-analyzed data to obtain a processing result; wherein the normalization processing includes information completion, attribute unified mapping, data verification and merging, association integration, filtering, aggregation, and abnormal behavior identification.

[0075] Step S203: Convert the processing result into a corresponding feature vector.

[0076] It can be understood that, in order to accurately and quickly process the to-be-analyzed data, in the process of converting the to-be-analyzed data into a corresponding feature vector, the to-be-analyzed data can be first normalized to obtain a processing result; and then the processing result is converted into a corresponding feature vector. The type of normalization processing can be determined according to the application scenario, for example, the normalization processing can include information completion, attribute unified mapping, data verification and merging, association integration, filtering, aggregation, and abnormal behavior identification. It should be noted that the information completion can include organization information completion, the association integration can include association integration of relatively isolated data in the to-be-analyzed data, the filtering and aggregation can be used for removing false data and keeping true data, and the abnormal behavior identification can include identification of sensitive operations, abnormal use, rule violation access, and abnormal privilege promotion, etc. The present disclosure does not make specific limitations here.

[0077] It can be understood that the process of converting the processing result into the corresponding feature vector can be determined according to the application scenario, such as feature processing and conversion of the processing result based on the One-Hot Encoding, and / or N-Gram model, and / or TF-IDF (Term Frequency-Inverse Document Frequency) model, and / or preset feature operator, and / or preset algorithm, the preset feature operator can include one or more of count, variance, mean, etc. It should be noted that in order to accurately convert the processing result into the corresponding feature vector, the appropriate conversion method can be selected based on the type of the processing result, that is, in the process of feature processing and conversion of the processing result based on the One-Hot Encoding, and / or N-Gram model, and / or TF-IDF model, and / or preset feature operator, and / or preset algorithm, the corresponding feature vector can be obtained, the enumeration type data in the to-be-analyzed data can be processed and converted based on the One-Hot Encoding feature processing operator; and / or the to-be-aggregated data in the to-be-analyzed data can be processed and converted based on the preset feature operator; and / or the text type string in the to-be-analyzed data can be processed and converted based on the N-Gram model and the TF-IDF model, such as tokenizing the text type string based on the part-of-speech tagger model in the N-Gram model, then constructing a fixed-length bag-of-words model, and finally calculating the word frequency / weight and other feature processing to obtain the corresponding feature vector; and / or the processing result can be processed and converted based on the preset algorithm to obtain the corresponding feature vector, the type of the preset algorithm can be determined according to the specific application scenario, which is not limited herein.

[0078] Step S204: performing anomaly detection on the feature vector based on the pre-trained anomaly detection model to obtain anomaly data in the to-be-analyzed data, and / or detecting the feature vector based on a machine learning algorithm to obtain the anomaly data.

[0079] Step S105: generating a behavior portrait of the target user based on the anomaly data.

[0080] Please refer to Figure 3 , Figure 3 A third flowchart of a user behavior analysis method according to an example embodiment is shown.

[0081] The user behavior analysis method disclosed by the present disclosure can include the following steps:

[0082] Step S301: obtaining to-be-analyzed data of a target user in a target intranet.

[0083] Step S302: converting the to-be-analyzed data into a corresponding feature vector.

[0084] Step S303: performing anomaly detection on the feature vector based on the pre-trained anomaly detection model to obtain anomaly data in the data to be analyzed, and / or performing detection on the feature vector based on a machine learning algorithm to obtain anomaly data; wherein the anomaly detection model includes a detection model generated based on a time series algorithm and / or a classification algorithm and / or a statistical analysis algorithm.

[0085] It can be understood that the type of anomaly detection model applied when performing anomaly detection on the feature vector based on the pre-trained anomaly detection model in the present disclosure can be determined according to the application scenario, such as the anomaly detection model can include a detection model generated based on a time series algorithm and / or a classification algorithm and / or a statistical analysis algorithm, etc., and in some implementation scenarios, the corresponding anomaly detection model can be determined according to the type of feature vector processed, for example, the anomaly detection model can include a first detection model for anomaly detection of single-dimensional time series data in the data to be analyzed, which is built based on a time series algorithm and a statistical analysis algorithm, and the first detection model can be a historical baseline model, etc.; for example, the anomaly detection model can include a second detection model for anomaly detection of multi-dimensional labeled data in the data to be analyzed, which is built based on a classification algorithm, wherein the classification algorithm includes SVM (Support Vector Machine), xgboost, etc.; the present disclosure does not make specific limitations here. In addition, in the application scenario, the anomaly detection model, anomaly data, etc. can also be stored in a database or a file, etc., such as a MySQL database, an elasticsearch database, etc., so as to manage the anomaly detection model, anomaly data, etc. by means of the database or file, etc., and in actual application, the detection process of the anomaly data can be recorded from the aspects of anomaly data detection time, anomaly detection type, anomaly detection type description, anomaly data, anomaly detection model name, anomaly detection model generation algorithm name, anomaly detection model generation algorithm type, etc. so as to trace the detection process of the anomaly data based on the record data later, such as the anomaly data detection time can be 2022 / 5 / 4, the anomaly detection type can be device reported data volume prediction anomaly detection, the anomaly detection type description can be anomaly detection of device reported log data volume by using device reported data volume single-dimensional time series data prediction model, the anomaly data can be log reported volume, the anomaly detection model name can be device reported data volume detection model, the anomaly detection model generation algorithm name can be Fbrophet, the anomaly detection model generation algorithm type can be time series algorithm, etc., the present disclosure does not make specific limitations here.

[0086] It can be understood that in the application scenario, the first detection model type can be determined according to actual needs, for example, the first detection model can include a model for detecting single-dimensional numerical vector features based on a statistical analysis algorithm, and the processing process of the statistical analysis algorithm can include feature vector mean calculation, feature vector standard deviation calculation, deviation parameter configuration, detection, etc.; the first detection model can include a model for detecting single-dimensional time series numerical data based on a time series algorithm, and the processing process of the time series algorithm can include building a data trend prediction model, prediction model learning, confidence region setting, etc.

[0087] It can be understood that the training process of the second detection model using the classification algorithm can be determined according to the application scenario, for example, the multi-dimensional data in the feature vector can be labeled first, then the multi-dimensional data is divided into training data and validation data according to the labeling result, the classification algorithm is applied to classify the training data, the parameters of the second detection model are configured, and then the training data and the corresponding classification result are applied to train the second detection model. After training, the second detection model is verified using the validation data. If the second detection model is the optimal model, the second detection model is output. If the second detection model is not the optimal model, the step of configuring the parameters of the second detection model and the subsequent steps can be returned to execute until the optimal second detection model is output.

[0088] It can be understood that the process of detecting the feature vector based on the machine learning algorithm can be determined according to the application scenario, for example, the feature vector corresponding to the multi-dimensional unlabeled data in the data to be divided can be detected based on the machine learning algorithm. In this process, the machine learning algorithm can be applied to mine and learn the rules of the feature vector corresponding to the multi-dimensional unlabeled data, find the outlier data points in the feature vector corresponding to the multi-dimensional unlabeled data, and take the outlier data points as abnormal data, etc., and the type of machine learning algorithm applied can be determined according to the application scenario, for example, the machine learning algorithm can include clustering algorithm, graph algorithm, etc. In the implementation scenario, the processing process of the clustering algorithm can include feature clustering calculation, abnormality recognition parameter configuration learning, etc. The processing process of the graph algorithm can include determining whether to perform hmm (hidden Markov model) learning. If yes, hmm learning is performed, then damping coefficient learning is performed. If no, damping coefficient learning is performed directly, and then Topk parameters are determined based on the damping coefficient learning result.

[0089] It can be understood that the training process of the anomaly detection model can be flexibly determined according to the application scenario, such as training the anomaly detection model at regular intervals, and verifying the anomaly detection model to screen the final anomaly detection model; in addition, in the process of applying the anomaly detection model to process the feature vector, the anomaly detection model can be applied to match the feature vector, and if the feature vector data does not match the anomaly detection model, it can be considered that the feature vector is abnormal data, etc.

[0090] Step S304: generating a behavior portrait of the target user based on the abnormal data.

[0091] It can be understood that in the application scenario, in order to facilitate the user to control the user behavior analysis method provided by the present disclosure, a corresponding visual management interface can be set for the user to enable the user to control the user behavior analysis process through the visual management interface. It should be noted that the form of the visual management interface can be determined according to actual needs, such as the visual interface as shown in Figure 4 It can be understood that in the application scenario, in order to facilitate the user to control the user behavior analysis method provided by the present disclosure, a corresponding visual management interface can be set for the user to enable the user to control the user behavior analysis process through the visual management interface. It should be noted that the form of the visual management interface can be determined according to actual needs, such as the visual interface as shown in

[0092] It can be understood that in the application scenario, in order to improve the running efficiency of the user behavior analysis method provided by the present disclosure, a multi-task parallel mode can be used to implement the scheme of the present disclosure, and the multi-task parallel mode can be determined according to actual needs, such as the multi-task parallel computing framework as shown in Figure 5As shown, that is, the multi-task parallel computing framework can include a WEB module, a computing framework master module, a computing node module, and a monitoring module; wherein the WEB module can be used to create, submit, receive, and show the task state of the user behavior analysis task, and the task running result feedback; the computing framework master module can be responsible for receiving the user behavior analysis task application of the WEB module and executing the task and distributing to the Kafka cluster; the Kafka cluster module can be used to allocate the computing task, that is, allocate the task message to different consumers in the same consumer group, to realize the concurrent execution of multiple tasks; the computing node module can be used to receive the computing allocation instruction of the computing framework master module, start the execution of the specific computing task, and feed back the task running state and result to the monitoring module; the monitoring data collection module can be used to collect the task running state information of each computing node, and push the collected node information to the WEB for display; the database cluster can be used to provide the query of the computing data to each computing node, receive and store the computing result returned by each computing node, and provide the data query to be displayed to the WEB. It should be noted that the task in the multi-task parallel computing framework disclosed in the embodiment refers to the corresponding task in the user behavior analysis process, such as the abnormal detection model training task, the abnormal data analysis task, and the feature vector conversion task, in other words, the user behavior analysis process in the present disclosure can be split and executed by means of the task, which is not limited in the present disclosure.

[0093] Referring to Figure 6 , Figure 6 FIG. 4 is a fourth flowchart of a user behavior analysis method according to an example embodiment.

[0094] The user behavior analysis method disclosed in the present disclosure can include the following steps:

[0095] Step S401: obtaining the to-be-analyzed data of the target user in the target intranet.

[0096] Step S402: converting the to-be-analyzed data into a corresponding feature vector.

[0097] Step S403: performing abnormal detection on the feature vector based on a pre-trained abnormal detection model, to obtain abnormal data in the to-be-analyzed data, and / or performing detection on the feature vector based on a machine learning algorithm, to obtain abnormal data.

[0098] Step S404: determining the abnormal behavior category and the abnormal behavior event of the target user based on the abnormal data.

[0099] Step S405: generating a behavior portrait based on the abnormal behavior category and the abnormal behavior event.

[0100] Understandably, the process of generating a target user's behavioral profile based on abnormal data can be determined according to the application scenario. For example, the abnormal behavior categories and abnormal behavior events of the target user can be determined first based on the abnormal data; and then a behavioral profile can be generated based on the abnormal behavior categories and abnormal behavior events.

[0101] Understandably, the types of abnormal behavior and abnormal behavior events can be determined based on the application scenario. For example, abnormal behavior categories may include one or more of the following: login abnormality, unauthorized access violation, operational violation, login violation, abnormal performance of duties, and data outsourcing violation. Abnormal behavior events may include one or more of the following: unauthorized downgraded printing of data, unauthorized use of peripheral devices, login from a foreign address, unauthorized possession of classified documents, host login violation, database login violation, unauthorized access to classified documents, login from uncommon devices, frequent account deletion, frequent file modification, process control violation, unauthorized modification of registration information, and login outside of working hours.

[0102] Understandably, furthermore, the abnormal behavior events of target users can be classified into risk levels, such as extremely risky, high risky, medium risky, and low risky. Risk scores can also be assigned to target users, such as scoring them on a scale of 1 to 100. The risk of target users threatening the target intranet can be quantified by using the classification results and risk scores, so as to facilitate the assessment of the threat posed by target users to the target intranet.

[0103] Understandably, in some application scenarios, to facilitate operations and maintenance personnel and security analysts in obtaining information such as abnormal behavior of target users, user monitoring lists and user behavior event monitoring lists can be used to record each user and their corresponding abnormal behavior events. This allows operations and maintenance personnel and security analysts to obtain information about users' abnormal behavior events. Furthermore, during the generation of behavioral profiles, operations and maintenance personnel and security analysts can select the desired user abnormal behavior events from the user monitoring lists and user behavior event monitoring lists to generate corresponding behavioral profiles. It should be noted that operations and maintenance personnel and security analysts can directly select the desired user abnormal behavior events from the user monitoring lists and user behavior event monitoring lists, or they can use the set search box to select the desired user abnormal behavior events from the user monitoring lists and user behavior event monitoring lists. Moreover, when recording user abnormal behavior events using user monitoring lists and user behavior event monitoring lists, they can also be recorded according to a timeline, so that operations and maintenance personnel and security analysts can analyze and process user abnormal behavior events according to the timeline. This disclosure does not impose specific limitations here.

[0104] Please refer to Figure 7 , Figure 7 FIG. 1 is a structural schematic diagram of a user behavior analysis device according to an exemplary embodiment.

[0105] The user behavior analysis device 700 according to the present disclosure can include:

[0106] The first acquisition module 710 is configured to acquire target user data in a target intranet for analysis.

[0107] The first conversion module 720 is configured to convert the data for analysis into a corresponding feature vector.

[0108] The first detection module 730 is configured to perform anomaly detection on the feature vector based on a pre-trained anomaly detection model to obtain abnormal data in the data for analysis, and / or perform detection on the feature vector based on a machine learning algorithm to obtain abnormal data.

[0109] The first generation module 740 is configured to generate a behavior portrait of the target user based on the abnormal data.

[0110] The user behavior analysis device according to the present disclosure can include:

[0111] The first processing unit is configured to perform normalization processing on the data for analysis to obtain a processing result.

[0112] The first conversion unit is configured to convert the processing result into a corresponding feature vector.

[0113] The normalization processing includes information completion, attribute unified mapping, data verification and merging, association integration, filtering, aggregation, and abnormal behavior recognition.

[0114] The user behavior analysis device according to the present disclosure can include:

[0115] The user behavior analysis device disclosed by the present disclosure can include a first conversion unit configured to: perform feature processing and conversion on enumeration type data in the data to be analyzed based on a feature processing operator one-hot encoding, to obtain a corresponding feature vector; and / or perform feature processing and conversion on data to be aggregated in the data to be analyzed based on a preset feature operator, to obtain a corresponding feature vector; and / or perform feature processing and conversion on text type strings in the data to be analyzed based on an N-Gram model and a TF-IDF model, to obtain a corresponding feature vector; and / or perform feature processing and conversion on the processing result based on a preset algorithm, to obtain a corresponding feature vector.

[0116] The user behavior analysis device disclosed by the present disclosure can include a first detection module configured to:

[0117] The first detection unit is configured to perform anomaly detection on the feature vector based on a pre-trained anomaly detection model, and the anomaly detection model includes a detection model generated based on a time series algorithm and / or a classification algorithm and / or a statistical analysis algorithm.

[0118] The user behavior analysis device disclosed by the present disclosure can include an anomaly detection model configured to:

[0119] The first detection model is configured to perform anomaly detection on single-dimensional time series data in the data to be analyzed based on a time series algorithm and a statistical analysis algorithm.

[0120] The second detection model is configured to perform anomaly detection on multi-dimensional labeled data in the data to be analyzed based on a classification algorithm, and the classification algorithm includes SVM and xgboost.

[0121] The user behavior analysis device disclosed by the present disclosure can include a first detection module configured to:

[0122] The second detection unit is configured to perform detection on the feature vector corresponding to the multi-dimensional unlabeled data in the data to be analyzed based on a machine learning algorithm, and the machine learning algorithm includes a clustering algorithm and a graph algorithm.

[0123] The user behavior analysis device disclosed by the present disclosure can include a first detection module configured to:

[0124] The user behavior analysis device disclosed by the present disclosure can include a first generation module configured to:

[0125] The first determination unit is configured to determine an abnormal behavior category and an abnormal behavior event of the target user based on the abnormal data.

[0126] The first generation unit is configured to generate a behavior portrait based on the abnormal behavior category and the abnormal behavior event.

[0127] The user behavior analysis device disclosed in the present disclosure can include one or more of login anomaly, overreach violation, operation violation, login violation, duty performance anomaly, data transmission violation, and the abnormal behavior event can include one or more of violation downgrade printing data, violation use of peripheral, foreign address login, violation holding of confidential files, host login violation, database login violation, violation access to confidential files, login of non-ordinary equipment, frequent deletion of accounts, frequent change of files, process control violation, violation modification of registration information, and login during non-working hours.

[0128] Figure 8 A block diagram of an electronic device 900 according to an exemplary embodiment is shown. As shown, the electronic device 900 can include a processor 901, a memory 902. The electronic device 900 can further include one or more of a multimedia component 903, an input / output (I / O) interface 904, and a communication component 905. Figure 8

[0129] ​The processor 901 is configured to control overall operations of the electronic device 900 to complete all or part of the steps of the user behavior analysis method described above. The memory 902 is configured to store various types of data to support operations of the electronic device 900, which can include, for example, instructions for operating any application or method on the electronic device 900, and application-related data, such as contact data, sent and received messages, pictures, audio, video, and the like. The memory 902 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk, or an optical disk. The multimedia component 903 can include a screen and an audio component. The screen can be, for example, a touch screen, and the audio component is configured to output and / or input audio signals. For example, the audio component can include a microphone configured to receive external audio signals. The received audio signals can be further stored in the memory 902 or transmitted through the communication component 905. The audio component also includes at least one speaker configured to output audio signals. The I / O interface 904 provides an interface between the processor 901 and other interface modules, which can be a keyboard, a mouse, a button, and the like. The buttons can be virtual buttons or physical buttons. The communication component 905 is configured to perform wired or wireless communication between the electronic device 900 and other devices. The wireless communication, such as Wi-Fi, Bluetooth, near field communication (NFC), 2G, 3G, or 4G, or a combination of one or more of them, so the corresponding communication component 905 can include a Wi-Fi module, a Bluetooth module, and an NFC module.

[0130] In an exemplary embodiment, the electronic device 900 can be implemented by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), controllers, micro-controllers, microprocessors, or other electronic elements for performing the above-mentioned user behavior analysis method.

[0131] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the above-mentioned user behavior analysis method. For example, the computer-readable storage medium can be the above-mentioned memory 902 including program instructions, which can be executed by the processor 901 of the electronic device 900 to complete the above-mentioned user behavior analysis method.

[0132] The above-mentioned user behavior analysis apparatus, electronic device and related parts of the computer-readable storage medium provided by the embodiments of the present disclosure are described in detail in the corresponding parts of the above-mentioned user behavior analysis method, and will not be described here again. In addition, the parts of the above-mentioned technical solutions provided by the embodiments of the present disclosure which are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail, so as not to be too verbose.

[0133] It should also be noted that, in this document, relational terms such as first and second, and the like, are used solely to distinguish one entity or action from another entity or action, without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0134] The above description of disclosed embodiments enables a person skilled in the art to implement or use the disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the disclosure. Thus, the present disclosure is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A user behavior analysis method, characterized by, The method comprises: acquiring target user data to be analyzed in a target intranet; converting the data to be analyzed into a corresponding feature vector; performing anomaly detection on the feature vector based on a pre-trained anomaly detection model to obtain abnormal data in the data to be analyzed, and detecting the feature vector based on a machine learning algorithm to obtain the abnormal data; generating a behavior portrait of the target user based on the abnormal data; wherein the detection of the feature vector based on the machine learning algorithm to obtain the abnormal data comprises: applying the machine learning algorithm to mine and learn the rules of the feature vector corresponding to multi-dimensional unlabeled data, find outlier data points in the feature vector corresponding to multi-dimensional unlabeled data, and take the outlier data points as abnormal data; the machine learning algorithm includes a graph algorithm; wherein the anomaly detection model comprises: a first detection model for anomaly detection of single-dimensional time series data in the data to be analyzed, which is built based on a time series algorithm and a statistical analysis algorithm; and a second detection model for anomaly detection of multi-dimensional labeled data in the data to be analyzed, which is built based on a classification algorithm; wherein the generation of the behavior portrait of the target user based on the abnormal data comprises: determining the abnormal behavior category and abnormal behavior event of the target user based on the abnormal data; generating the behavior portrait based on the abnormal behavior category and the abnormal behavior event.

2. The method of claim 1, wherein, The conversion of the data to be analyzed into a corresponding feature vector comprises: performing normalization processing on the data to be analyzed to obtain a processing result; converting the processing result into a corresponding feature vector; wherein the normalization processing includes information completion, attribute unified mapping, data verification and merging, association integration, filtering, aggregation, and abnormal behavior identification.

3. The method of claim 2, wherein, The conversion of the processing result into a corresponding feature vector comprises: feature processing and conversion of the processing result based on a feature processing operator one-hot encoding, and / or an N-Gram model, and / or a TF-IDF model, and / or a preset feature operator, and / or a preset algorithm, to obtain a corresponding feature vector, wherein the preset feature operator includes counting, variance, and mean.

4. The method of claim 3, wherein, The feature processing and conversion of the processing result based on a feature processing operator one-hot encoding, and / or an N-Gram model, and / or a TF-IDF model, and / or a preset feature operator, and / or a preset algorithm, to obtain a corresponding feature vector, comprises: feature processing and conversion of enumeration type data in the data to be analyzed based on the feature processing operator one-hot encoding to obtain a corresponding feature vector; and / or feature processing and conversion of data to be aggregated in the data to be analyzed based on the preset feature operator to obtain a corresponding feature vector; and / or feature processing and conversion of text type strings in the data to be analyzed based on the N-Gram model and the TF-IDF model to obtain a corresponding feature vector; and / or feature processing and conversion of the processing result based on the preset algorithm to obtain a corresponding feature vector.

5. The method of claim 1, wherein, The classification algorithm includes an SVM and an xgboost.

6. The method according to any one of claims 1 to 5, characterized in that, The types of the data to be analyzed include user behavior information, classified information flow data, network traffic data, user self-information, and internal network information.

7. The method of claim 6, wherein, The abnormal behavior categories include one or more of login abnormality, overreach violation, operation violation, login violation, duty performance abnormality, and data export violation.

8. A user behavior analysis apparatus characterized by comprising: The abnormal behavior events include one or more of the following: violation of printing data downgrade, violation of using peripheral devices, login from foreign addresses, violation of holding classified files, host login violation, database login violation, violation of accessing classified files, login from unusual devices, frequent deletion of accounts, frequent change of files, process control violation, violation of modifying registration information, and login during non-working hours. The method comprises: a first obtaining module configured to obtain data to be analyzed of a target user in a target internal network; a first conversion module configured to convert the data to be analyzed into corresponding feature vectors; a first detection module configured to perform abnormality detection on the feature vectors based on a pre-trained abnormality detection model, to obtain abnormal data in the data to be analyzed, and to perform detection on the feature vectors based on a machine learning algorithm, to obtain the abnormal data; a first generation module configured to generate a behavior portrait of the target user based on the abnormal data; The first detection module is configured to mine and learn the rules of the feature vectors corresponding to multi-dimensional unlabeled data by applying the machine learning algorithm, to find outlier data points in the feature vectors corresponding to the multi-dimensional unlabeled data, and to take the outlier data points as the abnormal data; and the machine learning algorithm includes a graph algorithm. The abnormality detection model includes a first detection model for performing abnormality detection on single-dimensional time series data in the data to be analyzed, which is built based on a time series algorithm and a statistical analysis algorithm; and a second detection model for performing abnormality detection on multi-dimensional labeled data in the data to be analyzed, which is built based on a classification algorithm. The first generation module includes: a first determination unit configured to determine abnormal behavior categories and abnormal behavior events of the target user based on the abnormal data; 9. An electronic device, comprising: a first generation unit configured to generate the behavior portrait based on the abnormal behavior categories and the abnormal behavior events. The method comprises: a memory configured to store a computer program; 10. A computer-readable storage medium having stored thereon a computer program, characterized in that, a processor configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 7. The computer program is executed by the processor to implement the steps of the method according to any one of claims 1 to 7.

Images