A method and apparatus for user risk assessment
By clustering and matrixing user network behavior and interaction behavior data, the problem of inaccurate user risk assessment in existing technologies has been solved, enabling precise prediction of user risk and accurate deployment of defense mechanisms.
Patent Information
- Application Number
- CN202310729370.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-19
- Publication Date
- 2025-11-28
- Estimated Expiration
- 2043-06-19
AI Technical Summary
Existing technologies cannot effectively utilize historical behavioral information of users and IPs, resulting in an inability to accurately assess user risk levels and consequently, an inability to precisely deploy interception and defense mechanisms.
Clustering algorithms are used to cluster user network behavior datasets and interaction behavior datasets to construct user group judgment matrices and IP set weight matrices. By combining the IP risk judgment matrix and user risk matrix, the risk value of user groups is determined, thereby enabling the prediction of the risk level of target users.
It enables accurate prediction of the risk level of target users, facilitates the deployment of precise interception and defense mechanisms, and improves the efficiency and quality of risk assessment in scenarios with high traffic and distinct group characteristics.
Smart Images
Figure CN117009879B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a user risk assessment method and apparatus. Background Technology
[0002] With the development of the internet, malicious behaviors and attacks have seriously impacted people's daily lives. As various detection, identification, interception, and defense mechanisms emerge, malicious behaviors continue to evolve. Currently, targeting individual behaviors, IP addresses, or even individual accounts can only reduce some attacks; they cannot effectively and systematically reduce similar behaviors.
[0003] Practice has shown that to effectively determine a user's risk level, it is necessary to consider more information and factors from upstream and downstream when dealing with malicious behavior and attacks. For example, we can use historical behavior analysis of a specific IP address, behavior trajectory analysis of a specific user, user profiles, etc.
[0004] However, in many cases, it is impossible to collect enough user and IP information or determine the correspondence between users and IPs. In such cases, it is impossible to form user profiles, and there is not enough data to analyze users' historical behavior and behavioral patterns. As a result, it is impossible to predict the risk level of users, and thus it is impossible to accurately deploy interception and defense mechanisms. Summary of the Invention
[0005] This invention aims to at least solve the technical problems existing in the prior art. To this end, the first aspect of this invention proposes a user risk assessment method, the method comprising:
[0006] Clustering algorithms were used to cluster users in the user network behavior dataset and the user network interaction behavior dataset, respectively, to obtain multiple first user groups and multiple second user groups.
[0007] A user group determination matrix is constructed based on the user similarity rate of the first user group, the user similarity rate of the second user group, and the number of identical users in the first and second user groups; the similarity rate is determined based on the relative distance between users in the group and the benchmark user.
[0008] Obtain the IP set of each user in the first user group, and the historical usage data of each IP address in the IP set; the IP set is the collection of IP addresses used by the user in history;
[0009] Based on the historical usage data and the pre-set weights of each historical usage data point, the weight value of each IP address is determined, and the matrix composed of the IP address and the weight value of the IP address is determined as the IP set weight matrix;
[0010] obtaining a pre-established IP risk judgment matrix, and determining a risk value of each IP address in the IP set weight matrix according to the IP risk judgment matrix; the IP risk judgment matrix comprises each IP address and the risk value of the IP address;
[0011] determining a comprehensive risk value of the IP set of each user in the first user group according to the risk value of each IP address and the weight value of the IP address, and determining a matrix composed of the comprehensive risk value of the IP set as a user risk matrix;
[0012] determining a group risk value of each first user group according to the user group judgment matrix and the user risk matrix, and determining a matrix composed of each group risk value as a user group risk matrix;
[0013] obtaining a target user whose risk value is to be evaluated, and determining the risk degree of the target user according to the first user group and the user group risk matrix.
[0014] Optionally, the user group judgment matrix is constructed according to the user similarity rate of the first user group, the user similarity rate of the second user group, and the number of same users in the first user group and the second user group, comprising:
[0015] matching each first user group with the plurality of second user groups respectively to determine a target second user group having the largest number of same users with the current first user group;
[0016] determining the size relationship between the proportion of the number of same users in the target second user group and a preset proportion threshold, and determining whether the current first user group and the second user group are matched successfully according to the size relationship;
[0017] determining the user similarity rate of the current first user group and the user similarity rate of the target second user group; the user similarity rate is the product of the number of users in the group and the sum of the inverse of the user similarity rate; the user similarity rate is the inverse of the relative distance of the user from the reference user of the group, and the reference user is the user closest to the clustering center point;
[0018] determining the group similarity rate corresponding to the current first user group based on the user similarity rate of the current first user group, the user similarity rate of the target second user group, or a preset default value; when the matching is successful, the group similarity rate is a linear fitting value of the user similarity rate of the current first user group and the user similarity rate of the target second user group; when the matching fails, the group similarity rate is a linear fitting value of the user similarity rate of the first user group and the default value;
[0019] The default value is 0.
[0020] Optionally, the group similarity rate corresponding to the current first user group is determined based on the user similarity rate of the current first user group, the user similarity rate of the target second user group, or a preset default value, and the group similarity rate corresponding to the current first user group is determined based on the user similarity rate of the current first user group, the user similarity rate of the target second user group, or a preset default value.
[0021] A first product is obtained by determining a product of the user similarity rate of the current first user group and M%.
[0022] A second product is obtained by determining a product of the user similarity rate of the target second user group and N%, wherein N+M=100 and N
[0023] A third product is obtained by determining a product of a preset default value and N%.
[0024] When the matching is successful, a sum of the first product and the second product is determined as the group similarity rate corresponding to the current first user group; and when the matching fails, a sum of the first product and the third product is determined as the group similarity rate corresponding to the current first user group.
[0025] Optionally, the group risk value of each first user group is determined based on the user group judgment matrix and the user risk matrix, and the group risk value of each first user group is determined based on the user group judgment matrix and the user risk matrix.
[0026] A plurality of users included in the first user group are obtained, and a comprehensive risk value of each user is obtained from the user risk matrix.
[0027] A belonging rate of each user is obtained from the first user group.
[0028] For each user, a target risk value is obtained by determining a product of the comprehensive risk value and the belonging rate.
[0029] A product of the target risk value and the belonging rate of the user is determined, a sum of the products of all users in the first user group is calculated, and a quotient of the sum and a total number of the users in the first user group is calculated.
[0030] A group risk value of the first user group is obtained by determining a product of the group similarity rate of the first user group and the quotient.
[0031] Optionally, the comprehensive risk value of the IP set of each user in the first user group is determined based on the risk value of each IP address and the weight value of the IP address, and the comprehensive risk value of the IP set of each user in the first user group is determined based on the risk value of each IP address and the weight value of the IP address.
[0032] weighting the risk values of the respective IP addresses included in the IP set of each user in the first user group and the weight values of the IP addresses to obtain a comprehensive risk value of the IP set of each user in the first user group.
[0033] Optionally, the determining the risk degree of the target user according to the first user group and the user group risk matrix comprises:
[0034] querying information of the target user from the user information of the plurality of first user groups to obtain a target group to which the target user belongs;
[0035] querying a group risk value corresponding to the target group from the user group risk matrix to obtain a target risk value;
[0036] determining the risk degree of the target user according to the target risk value.
[0037] Optionally, the IP risk judgment matrix is established by the following method:
[0038] obtaining a data set including IP full link, IP flow, threat intelligence, IP asset and IP blacklist in advance; the IP full link refers to a link composed of all IP addresses associated with a specified IP address, the IP flow refers to a browsing volume and an access volume of the IP address, the threat intelligence refers to IP address information existing threats given by an authoritative agency, the IP asset refers to an IP address set of an asset, and the IP blacklist refers to a list of risky IP addresses monitored;
[0039] determining a risk value corresponding to each IP address included in the data set according to contents of the data set;
[0040] determining a matrix composed of each IP address and the risk value of the IP address as the IP risk judgment matrix.
[0041] The second aspect of the application provides a user risk assessment device, and the device comprises:
[0042] a clustering module configured to cluster users in the user network behavior data set and the user network interaction behavior data set respectively by using a clustering algorithm to obtain a plurality of first user groups and a plurality of second user groups;
[0043] a user group judgment matrix construction module configured to construct a user group judgment matrix according to a user similarity rate of the first user group, a user similarity rate of the second user group and a number of same users in the first user group and the second user group; the similarity rate is determined according to a relative distance between a user in a group and a reference user;
[0044] an IP set acquisition module, configured to acquire an IP set of each user in the first user group and historical use data of each IP address in the IP set; the IP set is a collection of IP addresses historically used by the user;
[0045] an IP set weight matrix construction module, configured to determine a weight value of each IP address according to the historical use data and a preset weight of each historical use data, and determine a matrix composed of the IP addresses and the weight values of the IP addresses as an IP set weight matrix;
[0046] an IP risk value determination module, configured to acquire a preset IP risk judgment matrix, and determine a risk value of each IP address in the IP set weight matrix according to the IP risk judgment matrix; the IP risk judgment matrix comprises each IP address and the risk value of the IP address;
[0047] a user risk matrix construction module, configured to determine a comprehensive risk value of the IP set of each user in the first user group according to the risk value of each IP address and the weight value of the IP address, and determine a matrix composed of the comprehensive risk values of the IP sets as a user risk matrix;
[0048] a user group risk matrix construction module, configured to determine a group risk value of each first user group according to the user group judgment matrix and the user risk matrix, and determine a matrix composed of each group risk value as a user group risk matrix;
[0049] a risk degree determination module, configured to acquire a target user of an evaluated risk value, and determine a risk degree of the target user according to the first user group and the user group risk matrix.
[0050] A third aspect of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to implement the user risk assessment method according to the first aspect.
[0051] A fourth aspect of the present application provides a computer readable storage medium, wherein the storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by a processor to implement the user risk assessment method according to the first aspect.
[0052] The embodiments of the present application have the following beneficial effects:
[0053] The user risk assessment method provided by the embodiment of the application comprises the following steps: clustering users in a user network behavior data set and a user network interaction behavior data set by using a clustering algorithm to obtain a plurality of first user groups and a plurality of second user groups; constructing a user group judgment matrix according to a user similarity rate of the first user groups, a user similarity rate of the second user groups, and a number of same users in the first user groups and the second user groups, wherein the similarity rate is determined according to a relative distance between a user in a group and a reference user; obtaining an IP set of each user in the first user groups and historical use data of each IP address in the IP set, wherein the IP set is a collection of IP addresses used by the user in the past; determining a weight value of each IP address according to the historical use data and a weight of each historical use data set in advance, and determining a matrix composed of the IP addresses and the weight values of the IP addresses as an IP set weight matrix; obtaining a pre-established IP risk judgment matrix, and determining a risk value of each IP address in the IP set weight matrix according to the IP risk judgment matrix, wherein the IP risk judgment matrix comprises each IP address and the risk value of the IP address; determining a comprehensive risk value of the IP set of each user in the first user groups according to the risk value of each IP address and the weight value of the IP address, and determining a matrix composed of the comprehensive risk values of the IP sets as a user risk matrix; determining a group risk value of each first user group according to the user group judgment matrix and the user risk matrix, and determining a matrix composed of each group risk value as a user group risk matrix; obtaining a target user whose risk value is to be evaluated, and determining a risk degree of the target user according to the first user groups and the user group risk matrix. According to the user network behavior data set and the user network interaction behavior data set, the user group judgment matrix is formed, and according to the IP risk judgment matrix and the user risk matrix, the user group risk matrix composed of the group risk values is determined. Therefore, for the target user whose risk value is to be evaluated, the risk degree corresponding to the user can be obtained by querying the user group risk matrix, so that the risk level of the target user is accurately predicted, and a precise interception and defense mechanism is facilitated to be arranged. BRIEF DESCRIPTION OF DRAWINGS
[0054] Figure 1 A step flowchart of a user risk assessment method provided by the embodiment of the application;
[0055] Figure 2 A structure block diagram of a user risk assessment device provided by the embodiment of the application. DETAILED DESCRIPTION
[0056] Clearly, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the protection scope of the present application.
[0057] Hereinafter, the terms "first" and "second" are only used for description purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first" and "second" can explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, the meaning of "a plurality of" is two or more. In addition, the use of "based on" or "according to" means openness and inclusiveness, because the process, step, calculation or other action "based on" or "according to" one or more stated conditions or values can be based on additional conditions or values beyond the stated values in practice.
[0058] The inventor found in the process of researching related technologies that in the current network security research and practice, there are more solutions, research and technologies for single dimension such as user malicious behavior identification, IP risk assessment, user risk assessment, user behavior risk assessment, but there are fewer related solutions and technologies considering multiple factors as a research object.
[0059] Commonly, it is obviously limited to identify, assess and defend by taking single user, IP and malicious behavior as the main dimension.
[0060] Combining user, IP and individual malicious behavior as a research object can indeed accurately identify and assess the risk and harm of the target object to a certain extent, and then take subsequent operations, but in the scene with high access volume and obvious group characteristics, there are similar behavior users, similar behavior IP repeated judgment, multiple calculation, and insufficient use of malicious behavior history information, which is obviously not the optimal solution.
[0061] The present application designs a multi-dimensional risk assessment and identification scheme of comprehensive behavior, IP, user and group instead of single dimension in the scene with high access volume, obvious group characteristics and frequent access, improves the efficiency of identifying and assessing malicious behavior, and significantly improves the efficiency and quality in the scene with obvious group characteristics.
[0062] Figure 1 A step flowchart of a user risk assessment method provided by the embodiments of the present application. The method comprises the following steps:
[0063] Step 101, respectively clustering users in the user network behavior data set and the user network interaction behavior data set by using a clustering algorithm, to obtain a plurality of first user groups and a plurality of second user groups.
[0064] The user network behavior data set includes network behavior data of each user, for example, click behavior, browsing behavior, webpage operation behavior, transaction behavior data, etc. of the user. The user network interaction behavior data set includes communication and interaction behavior data between users.
[0065] The behavior clustering uses a Knn (k-nearest neighbor) algorithm, specifically using a high-dimensional space Euclidean distance calculator to calculate the distance of the group it belongs to, and clustering according to the user behavior characteristics. The same user group obtained after clustering has a high similarity rate behavior, that is, the users in the same group after clustering have similar behavior characteristics, and their subsequent operations can also be considered to have similar risks.
[0066] The interaction clustering process is similar to the behavior clustering, and the clustering is performed based on the behavior of mutual interaction of users. After clustering, the users in the same group interact with each other frequently, and then they also have a similar risk degree to a certain extent.
[0067] Step 102, constructing a user group judgment matrix according to the user similarity rate of the first user group, the user similarity rate of the second user group, and the number of the same users in the first user group and the second user group. The similarity rate is determined according to the relative distance between the users in the group and the reference user.
[0068] The return value of the user behavior clustering and the user interaction behavior clustering is both the user set and the relative distance of the user in the user group and the similarity rate of the group. The similarity rate of the group is the harmonic mean of the relative distance of each user and the reference user.
[0069] According to the above method, a plurality of first group similarity rates of a plurality of first user groups and a plurality of second group similarity rates of a plurality of second user groups are calculated.
[0070] Matching the first user group with each second user group respectively to determine a target second user group that matches successfully. Linear fitting the first similarity rate of the first user group and the second similarity rate of the target second user group to obtain a user group judgment matrix.
[0071] Since there are a plurality of first user groups, a plurality of user group judgment matrices can be obtained.
[0072] The user group determination matrix is linearly fitted by a first similarity rate of a first user group and a second similarity rate of a target second user group, and the matrix includes user information in the first user group and corresponding comprehensive similarity rate information of the user. The comprehensive similarity rate information is a linear fitting result of the first similarity rate and the second similarity rate.
[0073] In step 103, IP sets of each user in the first user group are obtained, and historical use data of each IP address in the IP set is obtained; the IP set is a collection of IP addresses historically used by the user.
[0074] The IP set of the user refers to a collection of IP addresses that have been used by the user. Historical use data of each IP address in the IP set of the user is obtained, and the historical use data can represent the network security risk level of the user.
[0075] The historical use data of each IP address includes a use duration, a use time, a use frequency, a frequency of use by others, a proportion of use by others, and a replacement frequency of the IP address.
[0076] In step 104, a weight value of each IP address is determined according to the historical use data and a pre-set weight of each historical use data, and a matrix composed of the IP addresses and the weight values of the IP addresses is determined as an IP set weight matrix.
[0077] One IP address corresponds to a set of historical use data, and the set of historical use data includes various behavior data. An expert scoring method is used to pre-set a corresponding weight for each behavior data. The data values and weights of various behavior data are weighted and summed, and the result of the weighted sum is normalized to obtain the weight value of the IP address.
[0078] For each user, a matrix composed of weight values of each IP address in the IP set of the user is determined as an IP set weight matrix, that is, one user corresponds to one IP set weight matrix.
[0079] In step 105, a pre-established IP risk determination matrix is obtained, and a risk value of each IP address in the IP set weight matrix is determined according to the IP risk determination matrix; the IP risk determination matrix includes each IP address and the risk value of the IP address.
[0080] Based on IP full link, IP flow analysis, and suspected risk behaviors of IP in link and flow, such as frequent requests for addresses with high risk degree that have been explicitly identified, multiple accesses to overseas black and pornographic addresses, and the like, a risk value corresponding to each IP address is set for each known IP address, and a matrix composed of each IP address and the corresponding risk value is determined as an IP risk determination matrix.
[0081] The IP risk determination matrix is used to query the risk value corresponding to each IP address in the IP set weight matrix.
[0082] Step 106, according to the risk value of each IP address and the weight value of the IP address, determine the comprehensive risk value of the IP set of each user in the first user group, and determine the matrix composed of the comprehensive risk value of the IP set as the user risk matrix.
[0083] According to the use length, use time, use frequency, use frequency by others, use frequency by others ratio and replacement frequency of the IP address, the weight value of each IP address is determined.
[0084] For each user's IP set, after querying the risk value of each IP address, the risk value and the corresponding weight value are weighted and summed to obtain the comprehensive risk value of the IP set.
[0085] The matrix composed of the comprehensive risk value of the IP set is determined as the user risk matrix.
[0086] Step 107, according to the user group determination matrix and the user risk matrix, determine the group risk value of each first user group, and determine the matrix composed of each group risk value as the user group risk matrix.
[0087] The user group determination matrix includes user information in the first user group and the corresponding comprehensive similarity rate information of each user.
[0088] From the user risk matrix, the risk value corresponding to each user in the first user group is queried, and the risk value and the corresponding attribution rate of the user are multiplied to obtain the target risk value of the user.
[0089] According to the target risk value of each user, the group risk value of the first user group is calculated, and the matrix composed of each group risk value is determined as the user group risk matrix.
[0090] Each first user group corresponds to a user group risk matrix, that is, there are multiple user risk group matrices.
[0091] Step 108, obtain the target user whose risk value needs to be evaluated, and determine the risk degree of the target user according to the first user group and the user group risk matrix.
[0092] In many cases, enough user and IP related information cannot be collected, and the correspondence between user and IP cannot be determined. In this case, the user portrait cannot be formed, and there is not enough data for user historical behavior and behavior track analysis, so the risk level of such users cannot be predicted by using the conventional method.
[0093] The user can be a target user, and the risk degree of the target user can be determined by using the user group risk matrix generated by the application. Specifically, the user information of the target user is queried in the plurality of user group risk matrices, and the group risk value corresponding to the user group risk matrix in which the user information exists is the risk value of the target user. Thus, the risk degree of the target user is determined according to the risk value of the target user.
[0094] In addition, the user group risk matrix generated by the application can also determine whether two or more users have similar risks. Specifically, the groups to which the two or more users belong are determined, and whether the two or more users have similar risks is determined according to the group risk values corresponding to the groups to which the users belong and the belonging rates of the users in the groups.
[0095] For the case that the two or more users belong to the same group, whether the two or more users have similar risks also needs to be determined according to the belonging rates of the users.
[0096] In addition, if the target user and other users belong to the same user group, and the other users are known to have high risks, it can be directly assumed that the target user also has high risks, and then other methods are used to verify the conclusion.
[0097] According to the user network behavior data set and the user network interaction behavior data set, the user group judgment matrix is formed, and according to the IP risk judgment matrix and the user risk matrix, the user group risk matrix composed of the group risk values is determined. Therefore, for the target user to be evaluated, the risk degree corresponding to the user can be obtained according to the user group risk matrix, so that the risk level of the target user is accurately predicted, and the accurate interception and defense mechanism is facilitated.
[0098] In a possible implementation, step 102 comprises the following steps:
[0099] Step 1021, match each of the first user groups with the plurality of second user groups respectively, and determine a target second user group with the largest number of same users as the current first user group.
[0100] According to the quantity of users in the user group from more to less, the users of the first user group are matched with the users of the second user group one by one, and the second user group with the largest number of same users as the current first user group is determined as the target second user group.
[0101] Step 1022, determining the size relationship between the proportion of the number of same users in the target second user group and the preset proportion threshold value, and determining whether the current first user group and the second user group are matched successfully according to the size relationship.
[0102] A threshold value k (such as 80%) is set as the standard for whether the first user group and the second user group are matched successfully. If the matching rate is greater than or equal to the threshold value k, the target second user group is matched successfully with the current first user group, otherwise, the matching fails.
[0103] Step 1023, determining the user similarity rate of the current first user group and the user similarity rate of the target second user group; the user similarity rate is the product of the number of users in the group and the sum of the user belonging rates; the belonging rate is the reciprocal of the relative distance of the user to the reference user of the group, and the reference user is the user closest to the clustering center point.
[0104] Specifically, the relative distance of the user to the reference user of the group is calculated as: the distance of the user to the center point ÷ the distance of the reference user to the center point.
[0105] The user belonging rate is calculated as: the reciprocal of the relative distance.
[0106] The user similarity rate is calculated as: {the number of users in the group} x {the reciprocal of the sum of the user belonging rates}.
[0107] The user similarity rate of the current first user group and the user similarity rate of the target second user group are calculated by the above method.
[0108] Step 1024, determining the group similarity rate corresponding to the current first user group based on the user similarity rate of the current first user group, the user similarity rate of the target second user group or a preset default value; when the matching is successful, the group similarity rate is the linear fitting value of the user similarity rate of the current first user group and the user similarity rate of the target second user group; when the matching fails, the group similarity rate is the linear fitting value of the user similarity rate of the first user group and the default value.
[0109] The default value is 0.
[0110] Specifically, a linear fitting function is used to determine the group similarity rate of the first user group. The linear fitting function can set weights for the user similarity rate of the first user group and the user similarity rate of the target second user group to distinguish the importance of the two in calculating the group similarity rate.
[0111] Since the target second user group is not successfully matched with the first user group, it indicates that the target second user group has few same users as the first user group and has small similarity, and therefore the default value is set to 0.
[0112] In the embodiment of the application, the second user group with a matching rate greater than the threshold K is fused with the first user group, so that the first user group not only includes the user behavior data of itself, but also includes the user interaction behavior data of the second user group matched with the first user group, thereby improving the data richness of the first user group and making the subsequent calculation of the group risk value more accurate and comprehensive.
[0113] Moreover, the group similarity rate of the first user group is determined by the user similarity rate of the first user group and the user similarity rate of the second user group, so that the calculation of the group similarity rate considers both the user behavior data and the user interaction behavior data.
[0114] In a possible implementation, step 1024 includes:
[0115] Step 10241, determining a product of the user similarity rate of the current first user group and M%, to obtain a first product;
[0116] Step 10242, determining a product of the user similarity rate of the target second user group and N%, to obtain a second product; wherein N+M=100, N
[0117] Step 10243, determining a product of a preset default value and N%, to obtain a third product;
[0118] Step 10244, when the matching is successful, determining a sum of the first product and the second product as the group similarity rate corresponding to the current first user group; when the matching fails, determining a sum of the first product and the third product as the group similarity rate corresponding to the current first user group.
[0119] In the embodiment of the application, the user similarity rate of the first user group and the user similarity rate of the target second user group are brought into a preset linear fitting function.
[0120] The linear fitting function f(x)={the user similarity rate of the first user group}*M%+{the user similarity rate of the target second user group or the default value}*N%. Wherein N+M=100, N
[0121] Specifically, the values of M and N can be preset according to actual requirements, for example, M is 70 and N is 30, and the embodiments of the present application do not make specific limitations on this.
[0122] When the matching is successful, f(x) = {user similarity rate of the first user group} * M% + {user similarity rate of the target second user group} * N%; when the matching fails, f(x) = {user similarity rate of the first user group} * M% + {default value} * N%.
[0123] The group similarity rate in the embodiments of the present application considers the similarity rate of the first user group and the similarity rate of the second user group. Since the importance of the user behavior data is greater than the importance of the user interaction behavior data when determining the similarity rate of the group user, N < M is set, so that the importance of the similarity rate of the first user group is greater than the importance of the similarity rate of the second user group. The group similarity rate obtained in this way is more accurate and more scientific and reasonable.
[0124] In a possible implementation, step 106 includes:
[0125] The risk values of the respective IP addresses included in the IP set of each user in the first user group and the weight values of the IP addresses are weighted and summed to obtain the comprehensive risk value of the IP set of each user in the first user group.
[0126] Specifically, the weight values corresponding to each index of the use duration, use time, use frequency, use frequency by others, use frequency by others ratio, and replacement frequency of the IP address are set, and the sum of the weight values is 1. The values of each index are multiplied by the weight values, and all the products are summed to obtain the weight value of the IP address.
[0127] For each user's IP set, after obtaining the risk values of the respective IP addresses, the weight values of the respective IP addresses are weighted and summed with the risk values of the respective IP addresses as the weight values to obtain the comprehensive risk value of the IP set of the user.
[0128] In the embodiments of the present application, the comprehensive risk value of the IP set of the user is determined by the index values in the historical use data of the respective IP addresses included in the IP set, the weights of the indexes, and the risk values of the respective IP addresses, so that the comprehensive risk value of the IP set considers the importance of different indexes in the historical use data while considering the risk values in the existing IP risk determination model, thereby improving the accuracy of the comprehensive risk value.
[0129] In a possible implementation, step 107 includes:
[0130] Step 1071, obtain a plurality of users included in the first user group, and obtain a comprehensive risk value of each of the users from the user risk matrix;
[0131] Step 1072, for each of the users, determine a product of the comprehensive risk value and the belonging rate to obtain a target risk value;
[0132] Step 1073, determine a product of the target risk value of the user and the belonging rate, and calculate a sum of the product of all users in the first user group, and calculate a quotient of the sum and a total number of the users in the first user group;
[0133] Step 1074, determine a product of the group similarity rate of the first user group and the quotient to obtain a group risk value of the first user group.
[0134] In steps 1071-1074, the comprehensive risk value of each user is obtained from the user risk matrix, and each user and the comprehensive risk value thereof constitute the user risk matrix.
[0135] The user risk matrix and the user group judgment matrix are fused, and the specific fusion method is that user information (the user information can be specifically user unique identification and user name information, etc.) in the user risk matrix is used to find corresponding user information from the user group judgment matrix.
[0136] Since the user group judgment matrix includes user group information and user information, the user group information mainly includes the similarity rate of the user group, and the user information mainly includes the unique identification of the user, the user name, and the belonging rate of the user. Therefore, the belonging rate information corresponding to the user information can be obtained from the user group judgment matrix.
[0137] The product of the comprehensive risk value of the user and the belonging rate information is taken as the target risk value of the user, and the target risk value of the user is updated in the user group judgment matrix to obtain the fusion result of the user risk matrix and the user group judgment matrix.
[0138] The weighted average method is used to calculate the group risk value of each first user group.
[0139] Specifically, the group risk value of the first user group = {the similarity rate of the user group} * [{the target risk value of each user} * {the belonging rate of the user} sum] / n, wherein n is the number of users in the group. Wherein, {the target risk value of each user} * {the belonging rate of the user} sum / n means: first, the product of the target risk value of each user and the belonging rate is calculated, then the sum of the above product of all users in the first user group is calculated, and then the sum of the above product is divided by the total number of users in the first user group.
[0140] In this way, the calculation of the group risk value considers the belonging rate of the user in the group, the product of the target risk value of each user and the belonging rate is calculated first, and the belonging rate of the user in the group is taken as the weight value for calculating the group risk value, the greater the belonging rate, the higher the weight value. Moreover, the calculation method also considers the group similarity rate, and the product of the group similarity rate and the quotient is taken as the group risk value, the higher the group similarity rate, the closer the group risk value is to the quotient. Considering the belonging rate and the similarity rate makes the result of the group risk value more scientific and reasonable.
[0141] In a possible implementation, step 108 includes:
[0142] Step 1081, querying the information of the target user from the user information of the plurality of first user groups to obtain a target group to which the target user belongs;
[0143] Step 1082, querying the group risk value corresponding to the target group from the user group risk matrix to obtain a target risk value;
[0144] Step 1083, determining the risk degree of the target user according to the target risk value.
[0145] In steps 1081-1083, the user information of the target user is queried in the plurality of user group risk matrices, and the group risk value corresponding to the user group risk matrix in which the user information exists is the risk value of the target user. Thus, the risk degree of the target user is determined according to the risk value of the target user.
[0146] Specifically, a corresponding relationship between the risk value and the risk degree can be set in advance. The risk degree can be set to three levels, i.e., high, medium and low, which correspond to the risk value in a certain range. Thus, the level of the risk degree corresponding to the target user can be determined through the risk value of the target user.
[0147] In a possible implementation, the IP risk judgment matrix is established by the following method:
[0148] Step 201, acquiring a pre-established data set including an IP full link, IP traffic, threat intelligence, IP asset and IP blacklist; the IP full link refers to a link composed of all IP addresses associated with a specified IP address, the IP traffic refers to the browsing volume and access volume of the IP address, the threat intelligence refers to the information of the IP address with threat given by an authoritative organization, the IP asset refers to the IP address set of the asset, and the IP blacklist refers to a list of risky IP addresses monitored;
[0149] Step 202, determining the risk value corresponding to each IP address included in the data set according to the content of the data set;
[0150] Step 203, determine a matrix composed of each IP address and the risk value of the IP address as an IP risk judgment matrix.
[0151] In steps 201-203, the IP full link refers to a mesh structure formed with a certain specified IP as a focus point, and all IPs related to the IP are present in a certain position in the link. IP traffic refers to the browsing volume and access volume of IP addresses. Threat intelligence refers to a list of risky domain names or IPs given by some authoritative agencies. IP assets refer to the IP set of assets, wherein the assets can include servers, terminals, desktops, etc. For example, a server has many virtual machines, and the virtual machines have many IPs, which are IP assets. The IP blacklist refers to a list of risky IP addresses monitored, and the list is generally derived from the monitoring of enterprise content.
[0152] Based on the IP full link, IP traffic analysis, and suspected risk behavior of IP in the link and traffic, such as frequent requests for addresses with high risk degree explicitly identified, multiple accesses to overseas black and pornographic addresses, etc., a risk value corresponding to each IP address is set, and a matrix composed of each IP address and the corresponding risk value is determined as an IP risk judgment matrix.
[0153] In addition to the IP risk query function, the IP risk judgment matrix also has an IP correction function. The IP correction function is based on IP addresses that have been identified as normal assets or abnormal assets, blacklists, and full network threat intelligence. The risk value corresponding to the IP address is queried in the IP risk judgment matrix, the risk degree is determined, and it is determined whether the previous identification is incorrect, so as to fully correct the identification. This makes the effect and benefit of the IP risk judgment matrix more significant.
[0154] Figure 2 is a structural block diagram of a user risk assessment device provided by an embodiment of the application. The user risk assessment device 200 includes:
[0155] The clustering module 201 is configured to cluster users in the user network behavior data set and the user network interaction behavior data set respectively by using a clustering algorithm to obtain a plurality of first user groups and a plurality of second user groups.
[0156] The user group judgment matrix construction module 202 is configured to construct a user group judgment matrix according to a user similarity rate of the first user groups, a user similarity rate of the second user groups, and a number of same users in the first user groups and the second user groups. The similarity rate is determined according to the relative distance between the users in the group and the reference user.
[0157] The IP set acquisition module 203 is configured to acquire an IP set of each user in the first user group and historical use data of each IP address in the IP set; the IP set is a collection of IP addresses historically used by the user;
[0158] The IP set weight matrix construction module 204 is configured to determine a weight value of each IP address according to the historical use data and a preset weight of each historical use data, and determine a matrix composed of the IP addresses and the weight values of the IP addresses as an IP set weight matrix;
[0159] The IP risk value determination module 205 is configured to acquire a preset IP risk judgment matrix, and determine a risk value of each IP address in the IP set weight matrix according to the IP risk judgment matrix; the IP risk judgment matrix includes each IP address and the risk value of the IP address.
[0160] The user risk matrix construction module 206 is configured to determine a comprehensive risk value of the IP set of each user in the first user group according to the risk value of each IP address and the weight value of the IP address, and determine a matrix composed of the comprehensive risk values of the IP sets as a user risk matrix;
[0161] The user group risk matrix construction module 207 is configured to determine a group risk value of each first user group according to the user group judgment matrix and the user risk matrix, and determine a matrix composed of each group risk value as a user group risk matrix;
[0162] The risk degree determination module 208 is configured to acquire a target user of an evaluated risk value, and determine a risk degree of the target user according to the first user group and the user group risk matrix. As to the device in the above-mentioned embodiments, the specific manners in which each module performs operations have been described in detail in the embodiments of the method, and thus will not be described in detail here.
[0163] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, storage, databases, or other media in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0164] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure that are deemed to fall within the general principles of the disclosure and include commonly known or customary practice in the art. The specification and examples are to be considered exemplary only, with the true scope and spirit of the disclosure being indicated by the following claims.
[0165] It should be understood that the present disclosure is not limited to the precise structures as herein described and illustrated in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the claims that follow.
Claims
1. A method of user risk assessment, characterized by, The method comprises: Clustering the users in the user network behavior data set and the user network interaction behavior data set respectively by using a clustering algorithm to obtain a plurality of first user groups and a plurality of second user groups; According to the user similarity rate of the first user group, the user similarity rate of the second user group, and the number of same users in the first user group and the second user group, a user group judgment matrix is constructed; the similarity rate is determined according to the relative distance of the users in the group to the reference user; Obtain the IP set of each user in the first user group, and the historical use data of each IP address in the IP set; the IP set is a collection of IP addresses used by the user in the past; According to the historical use data and the pre-set weight of each historical use data, the weight value of each IP address is determined, and the matrix composed of the IP address and the weight value of the IP address is determined as the IP set weight matrix; Obtain the pre-established IP risk judgment matrix, and determine the risk value of each IP address in the IP set weight matrix according to the IP risk judgment matrix; the IP risk judgment matrix includes each IP address and the risk value of the IP address; According to the risk value of each IP address and the weight value of the IP address, the comprehensive risk value of the IP set of each user in the first user group is determined, and the matrix composed of the comprehensive risk value of the IP set is determined as the user risk matrix; According to the user group judgment matrix and the user risk matrix, the group risk value of each first user group is determined, and the matrix composed of each group risk value is determined as the user group risk matrix; Obtain the target user whose risk value needs to be evaluated, and determine the risk degree of the target user according to the first user group and the user group risk matrix.
2. The method of claim 1, wherein, According to the user similarity rate of the first user group, the user similarity rate of the second user group, and the number of same users in the first user group and the second user group, the user group judgment matrix is constructed, which comprises: Match each first user group with the plurality of second user groups respectively to determine the target second user group with the largest number of same users as the current first user group; Determine the size relationship between the proportion of the number of same users in the target second user group and the pre-set proportion threshold, and determine whether the current first user group and the second user group are matched successfully according to the size relationship; Determine the user similarity rate of the current first user group and the user similarity rate of the target second user group; the user similarity rate is the product of the reciprocal of the sum of the number of users in the group and the user attribution rate; the attribution rate is the reciprocal of the relative distance between the user and the reference user of the group, and the reference user is the user closest to the clustering center point; determine a group similarity rate corresponding to the current first user group based on the user similarity rate of the current first user group, the user similarity rate of the target second user group, or a preset default value; when the matching is successful, the group similarity rate is a linear fitting value of the user similarity rate of the current first user group and the user similarity rate of the target second user group; when the matching fails, the group similarity rate is a linear fitting value of the user similarity rate of the first user group and the default value; wherein the default value is 0.
3. The method of claim 2, wherein, The determining of the group similarity rate corresponding to the current first user group based on the user similarity rate of the current first user group, the user similarity rate of the target second user group, or a preset default value comprises: determining a first product by multiplying the user similarity rate of the current first user group by M%; determining a second product by multiplying the user similarity rate of the target second user group by N%; wherein N+M=100, and N determining a third product by multiplying a preset default value by N%; when the matching is successful, determining the group similarity rate corresponding to the current first user group by summing the first product and the second product; when the matching fails, determining the group similarity rate corresponding to the current first user group by summing the first product and the third product.
4. The method of claim 1, wherein, The determining of the group risk value of each first user group according to the user group judgment matrix and the user risk matrix comprises: obtaining a plurality of users included in the first user group, and obtaining a comprehensive risk value of each user from the user risk matrix; obtaining a belonging rate of each user from the first user group; for each user, determining a target risk value by multiplying the comprehensive risk value and the belonging rate; determining the product of the target risk value and the belonging rate of the user, and calculating the sum of the products of all users in the first user group, and calculating the quotient of the sum and the total number of users in the first user group; determining the group risk value of the first user group by multiplying the group similarity rate of the first user group and the quotient.
5. The method of claim 1, wherein, The determining of the comprehensive risk value of the IP set of each user in the first user group according to the risk value of each IP address and the weight value of the IP address comprises: performing weighted summation on the risk value of each IP address included in the IP set of each user in the first user group and the weight value of the IP address to obtain the comprehensive risk value of the IP set of each user in the first user group.
6. The method of claim 1, wherein, The determining of the risk degree of the target user according to the first user group and the user group risk matrix comprises: querying information of the target user from user information of the plurality of first user groups to obtain a target group to which the target user belongs; querying a group risk value corresponding to the target group from the user group risk matrix to obtain a target risk value; determining the risk degree of the target user according to the target risk value.
7. The method of claim 1, wherein, The IP risk judgment matrix is established by the following method: obtaining a pre-established data set including IP full link, IP flow, threat intelligence, IP asset and IP blacklist; the IP full link refers to a link composed of all IP addresses associated with a specified IP address, the IP flow refers to the browsing volume and access volume of the IP address, the threat intelligence refers to the IP address information with threat given by an authoritative organization, the IP asset refers to an IP address set of an asset, and the IP blacklist refers to a list of risky IP addresses monitored; determining a risk value corresponding to each IP address in the data set according to the content of the data set; determining a matrix composed of each IP address and the risk value of the IP address as an IP risk judgment matrix.
8. A user risk assessment apparatus, characterized by, The device comprises: a clustering module configured to cluster users in a user network behavior data set and a user network interaction behavior data set by using a clustering algorithm to obtain a plurality of first user groups and a plurality of second user groups; a user group judgment matrix construction module configured to construct a user group judgment matrix according to a user similarity rate of the first user groups, a user similarity rate of the second user groups, and a number of same users in the first user groups and the second user groups; the similarity rate is determined according to a relative distance between a user in a group and a reference user; an IP set acquisition module configured to acquire an IP set of each user in the first user groups and historical use data of each IP address in the IP set; the IP set is a set of IP addresses used by the user in the past; an IP set weight matrix construction module configured to determine a weight value of each IP address according to the historical use data and a pre-set weight of each historical use data, and determine a matrix composed of the IP address and the weight value of the IP address as an IP set weight matrix; an IP risk value determination module configured to acquire a pre-established IP risk judgment matrix, and determine a risk value of each IP address in the IP set weight matrix according to the IP risk judgment matrix; the IP risk judgment matrix comprises each IP address and the risk value of the IP address; a user risk matrix construction module configured to determine a comprehensive risk value of the IP set of each user in the first user groups according to the risk value of each IP address and the weight value of the IP address, and determine a matrix composed of the comprehensive risk value of the IP set as a user risk matrix; a user group risk matrix construction module configured to determine a group risk value of each first user group according to the user group judgment matrix and the user risk matrix, and determine a matrix composed of each group risk value as a user group risk matrix; a risk degree determination module configured to acquire a target user to be evaluated, and determine a risk degree of the target user according to the first user groups and the user group risk matrix.
9. An electronic device, comprising: The electronic device includes a processor and a memory having stored therein at least one instruction, at least one program, a code set or instruction set, which is loaded and executed by the processor to implement the user risk assessment method of any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The storage medium has stored therein at least one instruction, at least one program, a code set or instruction set, which is loaded and executed by the processor to implement the user risk assessment method of any one of claims 1-7.
Citation Information
Patent Citations
Network safety situation evaluation method and device
CN109150868A
IP address evaluation method, system and equipment
CN112822143A