A user behavior anomaly detection system and method based on cluster analysis

Abstract

The present invention relates to a user behavior anomaly detection system and method, specifically a user behavior anomaly detection system and method based on cluster analysis, including a processing platform, an operation platform and a user terminal, the processing platform is communicatively connected to the operation platform and the user terminal via a network, the user terminal is communicatively connected to the operation platform via a network, the processing platform includes a network unit, a collection unit, a storage unit, an analysis unit and a screening unit, the network unit is used to connect the processing platform, the operation platform and the user terminal via a network, and the collection unit can collect a series of operation information between the user terminal logging into the operation platform and exiting the operation platform; the user behavior anomaly detection system designed by the present invention is established based on cluster analysis, can realize more comprehensive detection of user behavior, can effectively enhance the effect of anomaly detection, and reduce the probability of enterprise network being attacked.

Description

Technical Field

[0001] The present invention relates to a user behavior anomaly detection system and method, specifically a user behavior anomaly detection system and method based on cluster analysis, belonging to the field of data security technology. Background Art

[0002] With the advancement of informatization and the rapid development of the Internet and network data services, more and more people are beginning to use the Internet to obtain information. However, while enjoying the convenience of the Internet, we are also facing threats brought by various network attacks. To ensure security, existing companies generally improve network security by establishing analysis of user behavior.

[0003] Chinese patent number CN106101116B provides a user behavior anomaly detection system and method based on principal component analysis. The system includes a user behavior preprocessing module, a user behavior training module, a PCA module, a user behavior detection module, and a user behavior anomaly processing module. The method includes a user behavior training phase and a user behavior detection phase. The user behavior training phase is used to generate a user behavior anomaly threshold. The user behavior detection phase uses the user behavior anomaly threshold to determine whether real-time user behavior is abnormal. The present invention uses the PCA method to detect abnormal user behavior. PCA is very sensitive to changes in outliers. Abnormal user behavior has a significant impact on the main direction, making the user behavior detection results more effective. The detection process does not require repeated operations, which increases detection efficiency and is easy to implement. The use of thresholds to detect whether real-time user behavior is abnormal makes the detection efficient and convenient.

[0004] However, although the detection process in the above case does not involve repeated calculations, which increases detection efficiency, the detection accuracy is poor and missed detections are likely to occur, increasing the probability of the enterprise network being attacked by network attacks.

[0005] In view of this, the present invention is proposed. Summary of the Invention

[0006] The purpose of the present invention is to provide a user behavior anomaly detection system and method based on cluster analysis in order to solve the above problems.

[0007] The present invention achieves the above-mentioned purpose through the following technical solutions: a user behavior anomaly detection system based on cluster analysis, including a processing platform, an operation platform and a user terminal. The processing platform is communicatively connected to the operation platform and the user terminal through a network, and the user terminal is communicatively connected to the operation platform through a network. The processing platform includes a network unit, a collection unit, a storage unit, an analysis unit and a screening unit. The network unit is used to connect the processing platform, the operation platform and the user terminal through a network. The collection unit can collect a series of operation information between the user terminal logging into the operation platform and exiting the operation platform. The screening unit is used to screen and classify the data collected by the collection unit. The storage unit will store the data processed by the screening unit and the analysis unit. The analysis unit is used to analyze the data collected by the collection unit.

[0008] Furthermore, the network unit is composed of conventional wired network equipment and wireless network equipment, and the wired network equipment and wireless network equipment include MEC, core network and edge gateway, industrial-grade CPE and enterprise-level 5G base station and 5G IoT card.

[0009] Furthermore, the acquisition unit is established based on network tracking technology, data antivirus technology and data repair technology. The acquisition unit can not only collect data but also perform antivirus and repair processing on the data.

[0010] Furthermore, the storage unit is composed of two storage areas and a judgment program, and one storage area is an abnormal data storage area, and the other storage area is a normal data storage area.

[0011] Furthermore, the judgment program is established based on the data stored in the abnormal data storage area, and the data collected by the collection unit can be compared with the data stored in the abnormal data storage area.

[0012] Furthermore, the storage unit is composed of a cloud storage platform and a storage medium, and the storage medium is implemented by any type of volatile or non-volatile storage device or a combination thereof.

[0013] Furthermore, the analysis unit is established based on machine learning technology and big data prediction technology, and the analysis unit can predict the operation behavior of the user logging into the user terminal through the big data prediction technology.

[0014] Furthermore, the screening unit is established based on clustering and association analysis algorithms, and specifically includes K-means clustering analysis algorithm and Apriori association analysis algorithm.

[0015] Furthermore, the processing platform is established based on a cluster server, and the network unit, collection unit, storage unit, analysis unit and screening unit are all installed on the cluster server. The cluster server is composed of multiple independent processing servers, and a single processing server will only operate one program.

[0016] A method for detecting abnormal user behavior based on cluster analysis, comprising the following steps:

[0017] S1. When the user logs in to the operation platform through the user terminal, the processing platform will collect a series of operation information between the user terminal login operation platform and exit operation platform through the collection unit;

[0018] S2. The analysis unit in the processing platform analyzes and judges the data collected by the collection unit to determine whether the user's operation behavior is abnormal. If abnormal, the processing platform will send information to the user end and the operation platform as an alarm. The analysis unit can also predict user behavior and stop abnormal user behavior in a timely manner.

[0019] S3. At the same time, after the analysis is completed, the analysis results will be stored in the storage unit to expand the data content of the judgment program, so that when the user behavior is judged subsequently, the judgment program inside the storage unit will first compare and process the data collected by the collection unit. When it is confirmed that it is not abnormal after comparison with the data inside the storage unit, the analysis unit will analyze the data collected by the collection unit to determine whether the behavior is abnormal.

[0020] The technical effects and advantages of the present invention are as follows: (1) The user behavior anomaly detection system designed by the present invention is established based on cluster analysis, which can realize a more comprehensive detection of user behavior, effectively enhance the effect of anomaly detection, and reduce the probability of enterprise network being attacked; (2) The analysis unit designed by the present invention is established based on machine learning technology and big data prediction technology, which can not only improve the efficiency and accuracy of user abnormal behavior detection, but also predict user behavior and stop user abnormal behavior in time; (3) The storage unit designed by the present invention, when detecting user abnormal behavior, will receive the detection result of the analysis unit, and then the judgment program on the storage unit will compare the data collected by the collection unit with the data stored in the storage unit to confirm whether the user behavior is abnormal. This method can reduce the operation amount of the analysis unit, so that there is no repeated operation in the detection process, and increase the detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 Schematic diagram of the system structure of the present invention;

[0022] Figure 2 Schematic diagram of the processing platform structure of the present invention;

[0023] Figure 3 Flow chart of the method of the present invention.

[0024] In the figure: 1. Processing platform; 2. Operation platform; 3. User end. DETAILED DESCRIPTION

[0025] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0026] See also Figure 1-3As shown, a user behavior anomaly detection system based on cluster analysis includes a processing platform 1, an operation platform 2 and a user terminal 3. The processing platform 1 is in communication connection with the operation platform 2 and the user terminal 3 through the network, and the user terminal 3 is in communication connection with the operation platform 2 through the network. The processing platform includes a network unit, a collection unit, a storage unit, an analysis unit and a screening unit. The network unit is used to connect the processing platform 1 with the operation platform 2 and the user terminal 3 through the network. The collection unit can collect a series of operation information between the user terminal 3 logging into the operation platform 2 and exiting the operation platform 2. The screening unit is used to screen and classify the data collected by the collection unit. The storage unit will store the data processed by the screening unit and the analysis unit. The analysis unit is used to analyze the data collected by the collection unit. The network unit is composed of conventional wired network equipment and wireless network equipment, and the wired network equipment and the wireless network equipment include MEC, core network and edge gateway, industrial-grade CPE and 5G base station and 5G IoT card in the enterprise. The collection unit is established based on network tracking technology, data antivirus technology and data repair technology. The collection unit can not only The collected data can also be used to disinfect and repair the data. The storage unit is composed of two storage areas and a judgment program, and one storage area is an abnormal data storage area, and the other storage area is a normal data storage area. The judgment program is established based on the data stored in the abnormal data storage area, and the data collected by the collection unit can be compared with the data stored in the abnormal data storage area. The storage unit is composed of a cloud storage platform and a storage medium, and the storage medium is implemented by any type of volatile or non-volatile storage device or a combination thereof. The analysis unit is established based on machine learning technology and big data prediction technology, and the analysis unit can predict the user's operation behavior when logging into the user terminal 3 through big data prediction technology. The screening unit is established based on clustering and association analysis algorithms, and specifically includes K-means clustering analysis algorithm and Apriori association analysis algorithm. The processing platform is established based on a cluster server, and the network unit, collection unit, storage unit, analysis unit and screening unit are all installed on the cluster server. The cluster server is composed of multiple independent processing servers, and a single processing server will only operate one program.

[0027] A method for detecting abnormal user behavior based on cluster analysis, comprising the following steps:

[0028] S1. When the user logs in to the operation platform 2 through the user terminal 3, the processing platform 1 will collect a series of operation information between the user terminal 3 login operation platform 2 and exit operation platform 2 through the collection unit;

[0029] S2. The analysis unit in the processing platform 1 analyzes and judges the data collected by the collection unit to determine whether the user's operation behavior is abnormal. When abnormal, the processing platform 1 sends the information to the user terminal 3 and the operation platform 2 as an alarm. The analysis unit can also predict user behavior and stop the user's abnormal behavior in time;

[0030] S3. At the same time, after the analysis is completed, the analysis results will be stored in the storage unit to expand the data content of the judgment program, so that when the user behavior is judged subsequently, the judgment program inside the storage unit will first compare and process the data collected by the collection unit. When it is confirmed that it is not abnormal after comparison with the data inside the storage unit, the analysis unit will analyze the data collected by the collection unit to determine whether the behavior is abnormal.

[0031] When the present invention is in use, when the user logs in to the operation platform 2 through the user terminal 3, the processing platform 1 will collect a series of operation information between the user terminal 3 logging in to the operation platform 2 and exiting the operation platform 2 through the collection unit; the analysis unit in the processing platform 1 will analyze and judge the data collected by the collection unit to determine whether the user's operation behavior is abnormal. When it is abnormal, the processing platform 1 will send the information to the user terminal 3 and the operation platform 2 to issue an alarm, and the analysis unit can also predict the user's behavior and stop the user's abnormal behavior in time; at the same time, after the analysis is completed, the analysis result will be stored in the storage unit to expand the data content of the judgment program, so that when the user behavior is judged subsequently, the judgment program inside the storage unit will first compare and process the data collected by the collection unit. When it is confirmed that it is not abnormal after comparison with the data inside the storage unit, the analysis unit will analyze the data collected by the collection unit to determine whether the behavior is abnormal.

[0032] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

[0033] In addition, it should be understood that although this specification is described in terms of implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

Claims

1. A user behavior anomaly detection system based on cluster analysis, comprising a processing platform, an operation platform, and a user terminal, characterized by: The processing platform is in communication connection with the operation platform and the user terminal via a network, and the user terminal is in communication connection with the operation platform via a network. The processing platform includes a network unit, a collection unit, a storage unit, an analysis unit, and a screening unit. The network unit is used to connect the processing platform, the operation platform, and the user terminal via a network. The collection unit can collect a series of operation information from the user terminal logging into the operation platform to exiting the operation platform. The screening unit is used to screen and classify the data collected by the collection unit. The storage unit will store the data processed by the screening unit and the analysis unit. The analysis unit is used to analyze the data collected by the collection unit. The storage unit is composed of two storage areas and a judgment program, wherein one storage area is an abnormal data storage area, and the other storage area is a normal data storage area; after the analysis is completed, the analysis result will be stored in the storage unit to expand the data content of the judgment program, so that when the user behavior is subsequently judged, the judgment program inside the storage unit will first compare and process the data collected by the collection unit. When it is confirmed that it is not abnormal after comparison with the data inside the storage unit, the analysis unit will analyze the data collected by the collection unit to determine whether the behavior is abnormal; The judgment program is established based on the data stored in the abnormal data storage area, and can compare the data collected by the collection unit with the data stored in the abnormal data storage area; The analysis unit is established based on machine learning technology and big data prediction technology, and the analysis unit can predict the operation behavior of the user logging into the user terminal through big data prediction technology; The screening unit is established based on clustering and association analysis algorithms, and specifically includes K-means clustering analysis algorithm and Apriori association analysis algorithm; The processing platform is established based on a cluster server, and the network unit, acquisition unit, storage unit, analysis unit and screening unit are all installed on the cluster server. The cluster server is composed of multiple independent processing servers, and a single processing server will only run one program.

2. The user behavior anomaly detection system based on cluster analysis according to claim 1, characterized in that: The network unit is composed of conventional wired network equipment and wireless network equipment, and the wired network equipment and wireless network equipment include MEC, core network and edge gateway, industrial-grade CPE and 5G base station and 5G IoT card within the enterprise.

3. The user behavior anomaly detection system based on cluster analysis according to claim 1, characterized in that: The acquisition unit is established based on network tracking technology, data antivirus technology and data repair technology. The acquisition unit can not only collect data but also perform antivirus and repair processing on the data.

4. The user behavior anomaly detection system based on cluster analysis according to claim 1, characterized in that: The storage unit is composed of a cloud storage platform and a storage medium, and the storage medium is implemented by any type of volatile or non-volatile storage device or a combination thereof.

5. The user behavior anomaly detection method of the user behavior anomaly detection system based on cluster analysis according to claim 1 is characterized by: The following steps are involved: S1. When the user logs in to the operation platform through the user terminal, the processing platform will collect a series of operation information between the user terminal login operation platform and exit operation platform through the collection unit; S2. The analysis unit in the processing platform analyzes and determines the data collected by the collection unit to determine whether the user's operation behavior is abnormal. If abnormal, the processing platform will send information to the user end and the operation platform as an alert. The analysis unit can also predict user behavior and prevent abnormal user behavior in a timely manner. S3. At the same time, after the analysis is completed, the analysis results will be stored in the storage unit to expand the data content of the judgment program, so that when the user behavior is judged subsequently, the judgment program inside the storage unit will first compare and process the data collected by the collection unit. When it is confirmed that it is not abnormal after comparison with the data inside the storage unit, the analysis unit will analyze the data collected by the collection unit to determine whether the behavior is abnormal.

Images