Abnormal access behavior analysis method, electronic device, medium, program product

Abstract

The present disclosure provides an analysis method of abnormal access behavior, comprising: constructing a baseline model by using an operator model in an operator library, wherein the baseline model represents a baseline rule for describing a normal behavior mode of access behavior; obtaining access behavior data; analyzing the access behavior data based on the baseline model to identify abnormal access behavior; and generating an access relationship graph based on the access behavior data and the identification result of abnormal access behavior. The present disclosure also provides an electronic device, a computer readable medium and a computer program product. The present disclosure realizes special analysis of abnormal access behavior and improves the security and protection capability of a network system through access graph analysis.

Description

Technical Field

[0001] This disclosure relates to the field of data analysis technology, and in particular to a method for analyzing abnormal access behavior, an electronic device, a computer-readable medium, and a computer program product. Background Technology

[0002] Traditional security strategies typically rely on rule engines and firewalls to block malicious attacks. However, this approach has limitations, such as difficulty adapting to new threat patterns and susceptibility to bypassing. Therefore, baseline-based attack behavior detection technology has emerged. This technology analyzes historical user behavior data to identify normal user behavior, using this analysis as the basis for determining whether user behavior constitutes an attack, thus effectively improving security protection capabilities.

[0003] However, baseline-based attack detection techniques still have limitations in certain application scenarios. Summary of the Invention

[0004] This disclosure provides a method for analyzing abnormal access behavior, an electronic device, a computer-readable medium, and a computer program product.

[0005] In a first aspect, embodiments of this disclosure provide a method for analyzing abnormal access behavior, comprising: constructing a baseline model using operator models in an operator library, wherein the baseline model represents baseline rules for describing normal behavior patterns of access behavior; acquiring access behavior data; analyzing the access behavior data based on the baseline model to identify abnormal access behavior; and generating an access relationship graph based on the access behavior data and the identification results of abnormal access behavior.

[0006] In some embodiments, analyzing the access behavior data based on the baseline model to identify abnormal access behavior includes: analyzing the degree of deviation between the access behavior data and the baseline rules according to the baseline model, identifying abnormal access data that characterizes abnormal access behavior, and obtaining an initial identification result; performing process feature generalization based on the access behavior data and the abnormal access data to obtain the identification result of abnormal access behavior.

[0007] In some embodiments, process feature generalization is performed based on the access behavior data and the abnormal access data to obtain an identification result of abnormal access behavior, including: analyzing the difference between individual access behavior and group access behavior represented by the initial identification result based on the initial identification result, and outputting a first identification result of abnormal access behavior, wherein the first identification result conforms to the baseline of normal individual and group behavior; and / or clustering the access behavior represented by the access behavior data based on the access behavior data and the initial identification result, aggregating and outputting a second identification result of abnormal access behavior; and / or evaluating the initial identification result according to preset rules, and outputting a third identification result of abnormal access behavior, wherein the third identification result satisfies the preset rules.

[0008] In some embodiments, generating an access relationship graph based on the access behavior data and the identification results of abnormal access behavior includes: performing rule mapping and data association on the access behavior data to form a dataset; analyzing the dataset through multiple dimensions based on the first identification result, and / or the second identification result, and / or the third identification result to form multi-dimensional analysis results; performing association analysis on the multi-dimensional analysis results to generate the access relationship graph, wherein the access relationship graph includes an asset profile graph and a personnel profile graph; and performing graph analysis on the asset profile graph and the personnel profile graph to identify abnormal access behavior and threat events.

[0009] In some embodiments, graph analysis is performed on the asset profile graph and the personnel profile graph to identify abnormal access behavior and threat events, including: obtaining and displaying user profile information from the access relationship graph based on user keywords obtained from the search engine; calculating the degree of deviation between the user's access behavior and the baseline rules with a preset duration as the statistical granularity, and identifying and displaying abnormal access behavior and threat events whose deviation exceeds the upper and lower limits.

[0010] In some embodiments, constructing a baseline model using operator models in an operator library includes: obtaining multiple operator models from the operator library to construct an initial baseline model; training the initial baseline model using training samples; and correcting the concatenation of operator models in the initial baseline model based on the training results and the business scenario to obtain the baseline model.

[0011] In some embodiments, constructing a baseline model using operator models in an operator library includes: constructing the baseline model through a model construction function; wherein the model construction function includes an operator management unit, a program management unit, a model management unit, a task management unit, a service management unit, and a quick management unit; the model construction function also includes a visual interface, and constructing the baseline model through the model construction function includes: responding to operation instructions obtained through the visual interface by performing the following operations: performing operations such as obtaining the operator model and customizing the operator model through the operator management unit; performing operations such as managing the program for training the initial baseline model through the program management unit; performing operations such as concatenating operator models through the model management unit; performing task management operations through the task management unit; performing service management operations through the service management unit; and performing quick management operations through the quick management unit.

[0012] In some embodiments, acquiring access behavior data includes: acquiring the access behavior data through multiple distributed receiving servers, wherein different receiving servers correspond to different log sources; converting the access behavior data collected from the multiple receiving servers into a standard data format; monitoring the data collection status of each log source to determine the health status of the log source; and monitoring each receiving server to determine the health status of the receiving server.

[0013] In a second aspect, embodiments of this disclosure provide an electronic device, including: one or more processors; and a memory storing one or more programs thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal access behavior analysis method described in the first aspect of this disclosure.

[0014] Thirdly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the abnormal access behavior analysis method described in the first aspect of embodiments of this disclosure.

[0015] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program or instructions, wherein when the computer program or instructions are executed by a processor, they implement the abnormal access behavior analysis method described in the first aspect of this disclosure.

[0016] This disclosure embodiment establishes baseline rules describing normal access behavior patterns by constructing a baseline model. Then, it analyzes access behavior data using the baseline model and generates an access relationship graph, which can be specifically used to identify abnormal access behavior. This enables baseline-based specialized analysis and detection of abnormal access behavior, reducing the false alarm rate and false negative rate of abnormal access behavior. It provides an important reference for formulating and optimizing security strategies, thereby improving the security and protection capabilities of the network system. Attached Figure Description

[0017] Figure 1 This is a flowchart of an abnormal access behavior analysis method according to an embodiment of this disclosure;

[0018] Figure 2 This is a schematic diagram of the architecture of a model building function in one embodiment of this disclosure;

[0019] Figure 3 This is a schematic diagram of the architecture of a data acquisition and management function in one embodiment of this disclosure;

[0020] Figure 4 This is a schematic diagram of the composition of an electronic device according to an embodiment of this disclosure;

[0021] Figure 5 This is a schematic diagram of an architecture for analyzing abnormal access behavior;

[0022] Figure 6 This is a schematic diagram of another architecture for analyzing abnormal access behavior;

[0023] Figure 7 This is a schematic diagram of a graph analysis architecture. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions of this disclosure will be described in detail below with reference to the accompanying drawings.

[0025] Exemplary embodiments will be described more fully below with reference to the accompanying drawings; however, these exemplary embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will enable those skilled in the art to fully understand the scope of this disclosure.

[0026] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0027] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0028] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. As used herein, the singular forms “a” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded.

[0029] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so defined herein.

[0030] Baseline-based attack detection technology collects extensive historical data to determine normal user behavior and transforms it into a series of baseline rules. When user behavior deviates from these baseline rules, it indicates a potential anomaly requiring further investigation and action.

[0031] In routine network security management activities, abnormal access behaviors such as unauthorized access, abnormal login behavior, abuse of permissions, and abnormal data access are common. This disclosure aims to detect these abnormal access behaviors based on baselines, thereby achieving specialized detection and analysis of such behaviors.

[0032] Firstly, such as Figure 1 As shown in the embodiments of this disclosure, a method for analyzing abnormal access behavior is provided, including:

[0033] S1. Construct a baseline model using operator models in the operator library, wherein the baseline model represents baseline rules for describing normal behavior patterns of access behavior;

[0034] S2. Obtain access behavior data;

[0035] S3. Analyze the access behavior data based on the baseline model to identify abnormal access behavior;

[0036] S4. Based on the access behavior data and the identification results of abnormal access behavior, generate an access relationship graph.

[0037] In this embodiment of the disclosure, an operator library is pre-configured, containing a large number of operator models. Each operator model is a pre-defined and trained operator based on machine learning algorithms, capable of performing specific computational tasks such as data processing, visualization, and machine learning. An operator model can be a single operator or a process or network composed of multiple operators. The performance of each operator model can be optimized through training.

[0038] This disclosure does not specifically limit access behavior data. In some embodiments, access behavior data includes access behavior data generated by various business systems, user authentication, terminals, threat detection, traffic auditing devices, etc.

[0039] like Figure 5 As shown, this disclosure does not specifically limit abnormal access behavior. In some embodiments, abnormal access behavior includes, but is not limited to:

[0040] Abnormal login attempts, including frequent login failures, logins from different geographical locations or at unusual times, etc.

[0041] Unauthorized file or directory access: A user attempts to access a file or directory they do not have permission to access.

[0042] Unusual data transmission, large amounts of data being transmitted to or from unusual geographical locations, external systems, or unusual times;

[0043] Abnormal privilege escalation: The user attempts to escalate their privileges or access restricted resources.

[0044] Abnormal network activity includes unusual network traffic, communication with malicious IP addresses, and unauthorized remote access.

[0045] Data theft includes users attempting to access sensitive data or files, copying or downloading files without authorization, etc.

[0046] Malware activity refers to activities that discover malware or malicious code on a user's system or network.

[0047] In this embodiment of the disclosure, the access relationship graph represents the relationship between users and resources. By analyzing the access relationship graph, behavioral patterns and threat events of abnormal access behavior can be discovered.

[0048] This disclosure embodiment establishes baseline rules describing normal access behavior patterns by constructing a baseline model. Then, it analyzes access behavior data using the baseline model and generates an access relationship graph, which can be specifically used to identify abnormal access behavior. This enables baseline-based specialized analysis and detection of abnormal access behavior, reducing the false alarm rate and false negative rate of abnormal access behavior. It provides an important reference for formulating and optimizing security strategies, thereby improving the security and protection capabilities of the network system.

[0049] In the embodiments of this disclosure, during the process of analyzing access behavior data based on a baseline model to identify abnormal access behavior, abnormal access behavior can be identified solely through the baseline model; alternatively, it can be identified first through the baseline model and then generalized through process features, thereby improving the accuracy of identification.

[0050] Accordingly, in some embodiments, the access behavior data is analyzed based on the baseline model to identify abnormal access behavior, including:

[0051] Based on the baseline model, the deviation between the access behavior data and the baseline rules is analyzed to identify abnormal access data that characterizes abnormal access behavior, and an initial identification result is obtained.

[0052] Based on the access behavior data and the abnormal access data, process feature generalization is performed to obtain the identification result of abnormal access behavior.

[0053] In this embodiment of the disclosure, in the baseline model, if the deviation of the access behavior data from the baseline rules is between a preset upper and lower limit, it indicates that the access behavior data is generated by normal access behavior; if the deviation of the access behavior data from the baseline rules exceeds the upper or lower limit, it indicates that the access behavior data is generated by abnormal access behavior.

[0054] In this embodiment of the disclosure, process feature generalization refers to extending the results obtained from baseline model analysis to a wider range or more general situations, thereby improving the accuracy of identifying abnormal access behavior.

[0055] In some embodiments, at least one of group comparison, cluster analysis, and rule learning is used for process feature generalization.

[0056] Individual group comparison refers to the analysis of the baseline model based on the baseline of normal individual group behavior. If the analysis result obtained by the baseline model falls within the range of normal individual group behavior, the identification result is output. If it falls within the range of abnormal individual group behavior, the baseline model is optimized, and the analysis result of the optimized baseline model is analyzed again by the individual group comparison algorithm, and the identification result is output.

[0057] Cluster analysis refers to dividing objects in a dataset into different groups (clusters) such that objects within the same group have high similarity, while objects between different groups have low similarity. It aggregates anomalous access behaviors and outputs the results. In some embodiments, the K-means clustering algorithm is used for cluster analysis.

[0058] Rule learning refers to the evaluation of rules by using rule learning algorithms to perform cross-validation, accuracy verification, and recall verification on data. If the rule requirements are met, the results are output; if not, the rules are optimized, relearned, and the results are output.

[0059] Accordingly, in some embodiments, process feature generalization is performed based on the access behavior data and the abnormal access data to obtain the identification result of abnormal access behavior, including:

[0060] Based on the initial identification results, the differences between individual access behavior and group access behavior represented by the initial identification results are analyzed, and a first identification result for abnormal access behavior is output, wherein the first identification result conforms to the baseline of normal individual and group behavior; and / or

[0061] Based on the access behavior data and the initial identification results, the access behaviors represented by the access behavior data are clustered, aggregated, and a second identification result for abnormal access behaviors is output; and / or

[0062] The initial identification result is evaluated according to preset rules, and a third identification result for abnormal access behavior is output, wherein the third identification result satisfies the preset rules.

[0063] In some embodiments, an access relationship graph is generated based on the access behavior data and the identification results of abnormal access behavior, including:

[0064] The access behavior data is subjected to rule mapping and data association to form a dataset;

[0065] Based on the first identification result, and / or the second identification result, and / or the third identification result, the dataset is analyzed from multiple dimensions to form multi-dimensional analysis results;

[0066] The analysis results of the multiple dimensions are correlated to generate the access relationship graph, which includes an asset profile graph and a personnel profile graph.

[0067] The asset profile map and the personnel profile map are analyzed to identify abnormal access behavior and threat events.

[0068] In some embodiments, graph analysis is performed on the asset profile map and the personnel profile map to identify abnormal access behavior and threat events, including:

[0069] Based on the user's keywords obtained from the search engine, the user's profile information is obtained from the access relationship graph and displayed;

[0070] The system uses a preset duration as the statistical granularity to analyze the degree of deviation between user access behavior and the baseline rules, identifies and displays abnormal access behaviors and threat events whose deviation exceeds the upper and lower limits.

[0071] In some embodiments, access graph analysis discovers abnormal patterns and potential threats of access violations through two dimensions: personnel and assets. This disclosure also provides a search engine that allows users to query and display user profile information by entering keywords related to users (personnel or assets), including, for example:

[0072] Basic information about personnel / assets, including avatar, employee ID, department, email, tags, assets, IP address, account, and active time; adding or removing personnel from the watchlist; adjusting the scoring mode.

[0073] Risk score, including daily risk score and historical period risk score;

[0074] The risk overview uses charts to show the distribution of threat events in the most recent historical period, the risk tags involved in the threat events, the threat scenarios involved in the threat events and their proportions, the information of the top N threat events in terms of frequency, the detailed information related to the threat events, and the relationship (topology) between various types of entities and threats.

[0075] Personnel / asset profiles are displayed in charts showing the Top N personnel tags involved in risk scores or threats, risk information detected in the most recent historical period, various threat events associated with the same person in the most recent historical period, group information, daily activity in the most recent historical period, frequently used assets in the most recent historical period, frequently accessed ports in the most recent historical period, frequently accessed domains in the most recent historical period, and the Top N threats in the most recent historical period.

[0076] In some embodiments, when identifying abnormal access behavior and threat events, the baseline behavior of personnel or assets and outlier information are displayed at a statistical granularity of 1 hour based on the data trained by the Airflow offline model and scheduling. Threat events are generated when the actual values ​​are not between the upper and lower limits.

[0077] This disclosure does not impose any special limitations on how to construct a baseline model using operator models in the operator library.

[0078] In some embodiments, a baseline model is constructed using operator models from the operator library, including:

[0079] Multiple operator models are obtained from the operator library to construct an initial baseline model;

[0080] The initial baseline model is trained using training samples;

[0081] Based on the training results and business scenarios, the concatenation of operator models in the initial baseline model is corrected to obtain the baseline model.

[0082] In some embodiments, a baseline model is constructed using operator models from the operator library, including:

[0083] The baseline model is constructed using the model building function;

[0084] The model building function includes an operator management unit, a program management unit, a model management unit, a task management unit, a service management unit, and a shortcut management unit.

[0085] The model building function also includes a visual interface, through which the baseline model is built, including:

[0086] In response to the operation instructions obtained through the visual interface, perform the following operations:

[0087] The operator management unit performs operations such as obtaining the operator model and defining a custom operator model to manage the operator model.

[0088] The program management unit performs operations to manage the program that trains the initial baseline model.

[0089] The model management unit performs operations such as operator model concatenation to manage the baseline model;

[0090] Task management operations are performed through the task management unit;

[0091] Service management operations are performed through the service management unit.

[0092] Quick management operations are performed through the quick management unit.

[0093] In this embodiment of the disclosure, users can generate operation commands by performing drag-and-drop operations in a visual interface.

[0094] Figure 2 This is a schematic diagram of the architecture of a model building function in an embodiment of this disclosure. Figure 2As shown, the model building functional unit includes an operator management unit, a program management unit, a model management unit, a task management unit, a service management unit, and a shortcut management unit. The operator management unit manages input / output operators, machine learning operators, and visualization operators; the program management unit manages supervised learning modeling, unsupervised learning modeling, and deep learning modeling; model management manages variables, fragments, and grouping; task management manages real-time tasks, scheduled tasks, and model editing; service management manages the search engine, message queue, and JDBC; and shortcut management manages adding data, selecting models, and adding tasks.

[0095] In some embodiments, the model building function has good scalability, supports custom operators and their application in the system; the operators can directly manipulate the database and analyze data from any source.

[0096] This disclosure does not impose any special limitations on how access behavior data is obtained.

[0097] In some embodiments, obtaining access behavior data includes:

[0098] The access behavior data is obtained by multiple receiving servers deployed in a distributed manner, wherein different receiving servers correspond to different log sources;

[0099] The access behavior data collected from multiple receiving servers is converted into a standard data format;

[0100] Monitor the data collection status of each log source to determine the health status of the log source;

[0101] Each of the receiving servers is monitored to determine its health status.

[0102] One embodiment of this disclosure provides a data acquisition function, such as... Figure 3 As shown, the system includes management of receivers, parsing templates, log sources, and other components. It can monitor the data collection status of specific log sources and understand their health status. It can also achieve distributed data collection through the distributed deployment of multiple receiving servers, and can monitor the receiving servers to understand their health status.

[0103] Secondly, referring to Figure 4 This disclosure provides an electronic device, which includes:

[0104] One or more processors 101;

[0105] The memory 102 stores one or more programs that, when executed by one or more processors, cause the one or more processors to implement the abnormal access behavior analysis method described in the first aspect of the present disclosure.

[0106] One or more I / O interfaces 103 are connected between the processor and the memory and configured to enable information exchange between the processor and the memory.

[0107] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read / write interface) 103 is connected between the processor 101 and the memory 102, enabling information exchange between the processor 101 and the memory 102, including but not limited to a data bus (Bus).

[0108] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0109] Thirdly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method for analyzing abnormal access behavior as described in the first aspect of embodiments of this disclosure.

[0110] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program or instructions, wherein when the computer program or instructions are executed by a processor, they implement the abnormal access behavior analysis method described in the first aspect of this disclosure.

[0111] Fifthly, embodiments of this disclosure provide an analysis apparatus for abnormal access behavior, comprising:

[0112] The model building function is used to build a baseline model using operator models in the operator library, wherein the baseline model represents baseline rules for describing normal behavior patterns of access behavior;

[0113] The data collection function is used to acquire access behavior data;

[0114] The analysis function is used to analyze the access behavior data based on the baseline model and identify abnormal access behavior;

[0115] The graph function is used to generate an access relationship graph based on the access behavior data and the identification results of abnormal access behavior.

[0116] In some embodiments, the analysis function is used to analyze the degree of deviation between the access behavior data and the baseline rules according to the baseline model, identify abnormal access data that characterizes abnormal access behavior, and perform process feature generalization based on the access behavior data and the abnormal access data to obtain the identification result of abnormal access behavior.

[0117] In some embodiments, the analysis function analyzes the difference between individual access behavior and group access behavior represented by the initial identification result based on the initial identification result, and outputs a first identification result for abnormal access behavior, wherein the first identification result conforms to the baseline of normal individual and group behavior; and / or clusters the access behavior represented by the access behavior data based on the access behavior data and the initial identification result, aggregates and outputs a second identification result for abnormal access behavior; and / or evaluates the initial identification result according to preset rules, and outputs a third identification result for abnormal access behavior, wherein the third identification result satisfies the preset rules.

[0118] In some embodiments, the graph function is used to perform rule mapping and data association on the access behavior data to form a dataset; based on the first identification result, and / or the second identification result, and / or the third identification result, the dataset is analyzed through multiple dimensions to form multi-dimensional analysis results; correlation analysis is performed on the multi-dimensional analysis results to generate the access relationship graph, wherein the access relationship graph includes an asset profile graph and a personnel profile graph; graph analysis is performed on the asset profile graph and the personnel profile graph to identify abnormal access behavior and threat events.

[0119] In some embodiments, the graph function is used to obtain and display user profile information from the access relationship graph based on user keywords obtained from the search engine; to statistically analyze the degree of deviation between the user's access behavior and the baseline rules at a preset time granularity; and to identify and display abnormal access behaviors and threat events whose deviation exceeds the upper and lower limits.

[0120] In some embodiments, the model building function is used to obtain multiple operator models from the operator library to build an initial baseline model; train the initial baseline model using training samples; and correct the concatenation of operator models in the initial baseline model according to the training results and business scenarios to obtain the baseline model.

[0121] In some embodiments, the model building function includes an operator management unit, a program management unit, a model management unit, a task management unit, a service management unit, and a shortcut management unit. The model building function also includes a visual interface. Building the baseline model through the model building function includes: responding to operation instructions obtained through the visual interface by performing the following operations: managing the operator model through the operator management unit (e.g., obtaining the operator model, defining a custom operator model); managing the program for training the initial baseline model through the program management unit; managing the baseline model through the model management unit (e.g., concatenating operator models); performing task management through the task management unit; performing service management through the service management unit; and performing shortcut management through the shortcut management unit.

[0122] In some embodiments, the data acquisition function is used to acquire the access behavior data through multiple distributed receiving servers, wherein different receiving servers correspond to different log sources; convert the access behavior data acquired from the multiple receiving servers into a standard data format; monitor the data acquisition status of each log source to determine the health status of the log source; and monitor each receiving server to determine the health status of the receiving server.

[0123] To enable those skilled in the art to more clearly understand the technical solutions provided by the embodiments of this disclosure, the technical solutions provided by the embodiments of this disclosure will be described in detail below through specific embodiments:

[0124] Example

[0125] This embodiment integrates data generated by business systems, user authentication, terminals, threat detection, and traffic auditing devices. Through data preparation methods such as data collection, cleaning, and transformation, it utilizes group comparison, cluster analysis, and pattern learning to generalize process features and construct a baseline model. Finally, based on knowledge graphs, big data technology, and profiling and tagging technology, it effectively integrates data from various business systems and displays asset and personnel profiles, thereby improving network security and data protection levels. The architecture diagram for analyzing abnormal access behavior in this embodiment is shown below. Figure 5 , Figure 6 As shown.

[0126] (1) Data Acquisition

[0127] like Figure 3As shown, this embodiment provides open data acquisition management, including management of receivers, parsing, and log sources. This embodiment can monitor the data acquisition status of specific log sources through log source monitoring, and understand the health status of the log sources. Distributed data acquisition can be achieved through the distributed deployment of multiple receiving servers, and the receiving servers can be monitored through receiving server monitoring to understand their health status.

[0128] Receiver management is based on keyword feature matching or regular expression feature matching to manage User Datagram Protocol (UDP), Transmission Control Protocol (TCP), AVRO, Message Queues, Netflow, SFTP, files, REST, etc.

[0129] Log source management is based on task scheduling or resource management, and manages SYSLOG, file sharing, database tables, message stack, APIs, etc.

[0130] In this embodiment, as Figure 3 , Figure 5 , Figure 6 As shown, the log sources involve various types of devices, including but not limited to business log brokers, OS log brokers, 4A, bastion hosts, domain controllers, EDR, botnets, honeypots, behavior auditing, and database auditing.

[0131] In this embodiment, data preparation includes data import processing, data storage, data cleaning, and data transformation.

[0132] (2) Model building

[0133] The baseline model is built based on machine learning operator algorithms, which allows for custom drag-and-drop training of abnormal behavior samples. Then, by connecting operators, the original algorithm analysis results are corrected, and the final algorithm can better fit the enterprise's business scenario and improve the accuracy of the algorithm.

[0134] This feature provides a data processing engine that can convert any data into standard system data; it has a rich set of built-in data processing, visualization, and machine learning operators to meet any data processing requirements; it also has good scalability, supporting custom operators and their application in the system; the operators can directly manipulate the database and analyze data from any source.

[0135] Functional architecture such as Figure 2 , Figure 5 , Figure 6As shown. The model building functional unit includes an operator management unit, a program management unit, a model management unit, a task management unit, a service management unit, and a quick management unit. The operator management unit manages input / output operators, machine learning operators, and visualization operators; the program management unit manages supervised learning modeling, unsupervised learning modeling, and deep learning modeling; model management manages variables, fragments, and grouping; task management manages real-time tasks, scheduled tasks, and model editing; service management manages the search engine, message queue, and JDBC; and quick management manages adding data, selecting models, and adding tasks.

[0136] (3) Model Analysis

[0137] like Figure 5 , Figure 6 As shown, the third step in the construction and analysis technology of the baseline-based access violation anomaly analysis model is model analysis. Model analysis involves embedding a large number of operator models in the operator library, combining them with feature data to form feature algorithms, and then using individual group comparison, cluster analysis, and rule learning to generalize process features.

[0138] Individual group comparison: The individual group comparison algorithm is based on the data behavior baseline. It analyzes the prepared data using the individual group comparison algorithm. If the data falls within the normal baseline range, the results are output. If the data falls within the abnormal baseline range, the baseline is optimized. The prepared data is then analyzed again and the results are output.

[0139] Cluster analysis: Cluster analysis algorithms are used to divide objects (samples) in a dataset into different groups (clusters), so that objects within the same group have high similarity and objects between different groups have low similarity. The K-means clustering algorithm is used to aggregate access violations and abnormal behaviors and output the results.

[0140] Rule learning: The rule learning algorithm uses the Apriori algorithm to evaluate the rules by cross-validating, verifying accuracy, and verifying recall on the prepared data. If the rule requirements are met, the results are output; if not, the rules are optimized, relearned, and the results are output.

[0141] like Figure 5 As shown, abnormal access behaviors in this embodiment include, but are not limited to:

[0142] Abnormal login attempts, including frequent login failures, logins from different geographical locations or at unusual times, etc.

[0143] Unauthorized file or directory access: A user attempts to access a file or directory they do not have permission to access.

[0144] Unusual data transmission, large amounts of data being transmitted to or from unusual geographical locations, external systems, or unusual times;

[0145] Abnormal privilege escalation: The user attempts to escalate their privileges or access restricted resources.

[0146] Abnormal network activity includes unusual network traffic, communication with malicious IP addresses, and unauthorized remote access.

[0147] Data theft includes users attempting to access sensitive data or files, copying or downloading files without authorization, etc.

[0148] Malware activity refers to activities that discover malware or malicious code on a user's system or network.

[0149] (4) Spectral Analysis

[0150] like Figure 6 , Figure 7 As shown, the steps for implementing the access map analysis technique are as follows:

[0151] 1. Obtain the data sources used for access graph analysis from the personnel database, rule database, and asset database.

[0152] 2. Perform data preprocessing work such as rule mapping and data association on the data source to form a standardized, consistent, and orderly dataset.

[0153] 3. Analyze the dataset using multiple analytical methods such as alarm analysis, vulnerability analysis, attack analysis, and behavior analysis, and generate multi-dimensional analysis results.

[0154] 4. Perform correlation analysis on the generated multi-dimensional dataset analysis results to finally generate asset profile maps and personnel profile maps and their corresponding analysis profile results.

[0155] In this embodiment, the following effects can be achieved by accessing the spectral analysis:

[0156] 1. Comprehensive understanding of access behavior: Access graph analysis can map the network of relationships between users or entities, helping system administrators to fully understand user access behavior and patterns. This helps in the discovery of abnormal behavior and potential threats.

[0157] 2. Quickly detect abnormal behavior: By monitoring and analyzing the access graph in real time, abnormal patterns that do not conform to normal behavior can be quickly detected, such as abnormal access paths and abnormal access frequencies, thereby providing early warnings of potential security risks.

[0158] 3. Improve security response efficiency: Access graph early warning system can promptly alert the security team, enabling them to take quick action to deal with potential threats, shorten the response time of security incidents, and reduce losses.

[0159] 4. Strengthen security management and supervision: Access graph analysis can provide more comprehensive and accurate data support for security management and supervision, which helps to strengthen the control and supervision of system access and ensure the safe and stable operation of information systems.

[0160] 5. Optimize security strategies: By analyzing access graphs, we can gain a deeper understanding of the security risks and vulnerabilities in the system, providing important reference for formulating and optimizing security strategies, and further improving the system's security and protection capabilities.

[0161] Access graph analysis technology extracts valuable insights from massive amounts of traffic, logs, and behavioral data to comprehensively and meticulously reveal a multi-dimensional picture of assets and personnel. Through modeling analysis, correlation analysis, and data visualization, it effectively integrates data from various business systems based on knowledge graphs, big data technology, and profiling and tagging technology, and displays a complete picture of assets and personnel. This solves the problems of poor correlation between different dimensions of asset and personnel data and insufficient granularity of data mining and analysis.

[0162] (5) Output data

[0163] By effectively integrating data from various business systems using knowledge graphs, big data technology, and profile tagging technology, we can output access graph analysis content for personnel profiles and asset profiles.

[0164] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0165] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in connection with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in connection with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of this disclosure as set forth by the appended claims.

Claims

1. A method for analyzing abnormal access behavior, comprising: A baseline model is constructed using operator models from the operator library, wherein the baseline model represents baseline rules for describing normal behavior patterns of access behavior; Obtain access behavior data; The access behavior data is analyzed based on the baseline model to identify abnormal access behaviors, wherein the abnormal access behaviors include at least one of the following: abnormal login attempts, unauthorized file or directory access, unusual data transmission, abnormal privilege escalation, abnormal network activity, data theft, and malware activity. Based on the access behavior data and the identification results of abnormal access behavior, an access relationship graph is generated, wherein the access relationship graph includes an asset profile graph and a personnel profile graph; Perform graph analysis on the asset profile map and the personnel profile map to identify behavioral patterns and threat events of abnormal access behavior; The baseline model is constructed using operator models from the operator library, including: Multiple operator models are obtained from the operator library to construct an initial baseline model; The initial baseline model is trained using training samples; Based on the training results and business scenarios, the concatenation of operator models in the initial baseline model is corrected to obtain the baseline model.

2. The analytical method according to claim 1, wherein, The access behavior data is analyzed based on the baseline model to identify abnormal access behaviors, including: Based on the baseline model, the deviation between the access behavior data and the baseline rules is analyzed to identify abnormal access data that characterizes abnormal access behavior, and an initial identification result is obtained. Based on the access behavior data and the abnormal access data, process feature generalization is performed to obtain the identification result of abnormal access behavior.

3. The analytical method according to claim 2, wherein, Based on the access behavior data and the abnormal access data, process feature generalization is performed to obtain the identification result of abnormal access behavior, including: Based on the initial identification results, the differences between individual access behavior and group access behavior represented by the initial identification results are analyzed, and a first identification result for abnormal access behavior is output, wherein the first identification result conforms to the baseline of normal individual and group behavior; and / or Based on the access behavior data and the initial identification results, the access behaviors represented by the access behavior data are clustered, aggregated, and a second identification result for abnormal access behaviors is output; and / or The initial identification result is evaluated according to preset rules, and a third identification result for abnormal access behavior is output, wherein the third identification result satisfies the preset rules.

4. The analytical method according to claim 3, wherein, Based on the access behavior data and the identification results of abnormal access behavior, an access relationship graph is generated, including: The access behavior data is subjected to rule mapping and data association to form a dataset; Based on the first identification result, and / or the second identification result, and / or the third identification result, the dataset is analyzed from multiple dimensions to form multi-dimensional analysis results; The analysis results of the multiple dimensions are correlated to generate the access relationship graph.

5. The analytical method according to claim 4, wherein, Graph analysis is performed on the asset profile and the personnel profile to identify behavioral patterns and threat events of abnormal access behavior, including: Based on the user's keywords obtained from the search engine, the user's profile information is obtained from the access relationship graph and displayed; The system uses a preset duration as the statistical granularity to analyze the degree of deviation between user access behavior and the baseline rules, identifies and displays abnormal access behavior patterns and threat events where the deviation exceeds the upper and lower limits.

6. The analytical method according to any one of claims 1 to 5, wherein, Constructing a baseline model using operator models from the operator library includes: The baseline model is constructed using the model building function; The model building function includes an operator management unit, a program management unit, a model management unit, a task management unit, a service management unit, and a shortcut management unit. The model building function also includes a visual interface, through which the baseline model is built, including: In response to the operation instructions obtained through the visual interface, perform the following operations: The operator management unit performs operations such as obtaining the operator model and defining a custom operator model to manage the operator model. The program management unit performs operations to manage the program that trains the initial baseline model. The model management unit performs operations such as operator model concatenation to manage the baseline model; Task management operations are performed through the task management unit; Service management operations are performed through the service management unit. Quick management operations are performed through the quick management unit.

7. The analytical method according to any one of claims 1 to 5, wherein, Obtain access behavior data, including: The access behavior data is obtained by multiple receiving servers deployed in a distributed manner, wherein different receiving servers correspond to different log sources; The access behavior data collected from multiple receiving servers is converted into a standard data format; Monitor the data collection status of each log source to determine the health status of the log source; Each of the receiving servers is monitored to determine its health status.

8. An electronic device, comprising: One or more processors; A memory having stored one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method for analyzing abnormal access behavior according to any one of claims 1 to 7.

9. A computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method for analyzing abnormal access behavior according to any one of claims 1 to 7.

10. A computer program product comprising a computer program or instructions that, when executed by a processor, implement the method for analyzing abnormal access behavior according to any one of claims 1 to 7.

Images