A method and system for detecting abnormal access behavior in multiple scenarios in a power system

Abstract

The application discloses a kind of multi-scene access behavior abnormality detection method and device in power system, after collecting user role information and user access log information, first, log source is detected for single-scene abnormality, if the log in log source does not satisfy operating condition, single-scene alarm result is generated, and the number of single-scene alarm result is counted, to obtain single-scene alarm times, then multiple log sources are used to build scene sequence, and the scene sequence is detected for multi-scene abnormality, to obtain multi-scene alarm result, according to single-scene alarm times and multi-scene alarm result, to obtain final alarm information, so that power system reports according to final alarm information.This method can comprehensively investigate multiple scene behaviors, form a multi-scene behavior abnormality detection model related to scene detection indicators and occurrence order, improve the discovery rate of abnormal behavior, and reduce the false alarm rate of abnormal behavior detection.

Images