User behavior anomaly detection method, electronic equipment and storage medium

Abstract

The invention provides a user behavior anomaly detection method, electronic equipment and a storage medium. The method comprises the following steps: extracting user behavior characteristics from operation data containing actual behaviors of a target user; the user behavior characteristics are input into an anomaly detection model, the anomaly detection model takes the user behavior characteristics as input and takes user abnormal behaviors as output, and the anomaly detection model is obtained by training of training data containing user personalized behavior characteristics; and performing early warning processing based on the user abnormal behavior of the target user output by the abnormal detection model. According to the invention, the abnormal behavior of the user can be accurately detected, and the situations of false report and missing report are reduced.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and more specifically to a method for detecting abnormal user behavior, an electronic device and a storage medium. Background Art

[0002] With the rapid development of information technology, information systems have been widely used in various fields. However, during the operation of information systems, various faults and security issues may occur, such as hardware failures, software vulnerabilities, network attacks, etc. If these problems cannot be discovered and handled in time, they will affect the normal operation of the system and even lead to serious consequences. Therefore, establishing an effective information system operation and maintenance early warning mechanism is of great significance to improving the stability and reliability of the system.

[0003] At present, the existing early warning mechanism for information system operation and maintenance has the following main problems: The accuracy of early warning is not high. The traditional early warning mechanism is often based on simple threshold judgment, which is prone to false alarms and missed alarms.

[0004] The above information disclosed in this background section is only for further understanding of the background of the invention and therefore it may contain information that does not constitute the prior art that is already known to a person of ordinary skill in the art. Summary of the invention

[0005] In order to solve the above problems, the present invention provides a method, an electronic device and a storage medium for detecting abnormal user behavior.

[0006] A first aspect of the present invention provides a method for detecting user behavior anomalies, which is applied to an information system. The method comprises the following steps: extracting user behavior features from operation data containing actual behavior of a target user; inputting the user behavior features into an anomaly detection model, the anomaly detection model taking the user behavior features as input and the user abnormal behavior as output, and the anomaly detection model is trained using training data containing personalized user behavior features.

[0007] A second aspect of the present invention provides an electronic device, comprising:

[0008] Memory, for storing computer instructions;

[0009] A processor is used to call and execute the computer instructions to implement the method for user anomaly detection according to the first aspect of the present invention.

[0010] Perform early warning processing based on the abnormal user behavior of the target user output by the abnormal detection model.

[0011] A third aspect of the present invention provides a computer-readable storage medium storing computer instructions or a computer program, which, when executed, implements the method for user anomaly detection according to the first aspect of the present invention.

[0012] By adopting the embodiments of the present invention, abnormal behaviors of users can be accurately detected, and false positives and false negatives can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0014] Figure 1 A schematic diagram showing a method for detecting abnormal user behavior according to an embodiment of the present application is shown.

[0015] Figure 2 A schematic flow chart of a method for determining a predicted instruction sequence according to an embodiment of the present application is shown;

[0016] Figure 3 A schematic diagram of a transition probability matrix according to an embodiment of the present application is shown;

[0017] Figure 4 A block diagram of a device for detecting abnormal user behavior in an information system according to an example of the present application is shown;

[0018] Figure 5 It is a block diagram showing a data analysis module according to an example of the present application. Specific embodiments

[0019] As used herein, the words "first", "second", etc. may be used to describe elements in exemplary embodiments of the present invention. These words are only used to distinguish one element from another, and the inherent characteristics or order of the corresponding elements, etc. are not limited by the words. Unless otherwise defined, all terms (including technical or scientific terms) used in this article have the same meaning as those commonly understood by ordinary technicians in the technical field to which the present invention belongs. Those terms defined in common dictionaries are interpreted as having the same meaning as the contextual meaning in the relevant technical field, and are not interpreted as having ideal or overly formal meanings, unless they are clearly defined as having such meanings in the present invention.

[0020] It will be understood by those skilled in the art that the apparatus and methods of the present invention described herein and illustrated in the accompanying drawings are non-limiting exemplary embodiments, and the scope of the present invention is limited only by the claims. Features illustrated or described in conjunction with one exemplary embodiment may be combined with features of other embodiments. Such modifications and variations are included within the scope of the present invention.

[0021] Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the accompanying drawings, detailed descriptions of related known functions or configurations are omitted to avoid unnecessary obscuration of the technical points of the present invention. In addition, throughout the description, the same reference numerals always refer to the same circuits, modules or units, and for the sake of brevity, repeated descriptions of the same circuits, modules or units are omitted.

[0022] In addition, it should be understood that one or more of the following methods or aspects thereof can be performed by at least one control unit or controller. The terms "control unit", "controller", "control module" or "main control module" can refer to a hardware device including a memory and a processor. The memory or computer readable storage medium is configured to store program instructions, and the processor is specifically configured to execute the program instructions to perform one or more processes that will be further described below. Moreover, it should be understood that, as will be appreciated by those of ordinary skill in the art, the following methods can be performed by including a processor in combination with one or more other components.

[0023] The solution of the present invention relates to an information system operation and maintenance early warning mechanism based on secure computing technology. The mechanism introduces secure computing technology to monitor and analyze the operation status of the information system in real time, and can detect potential faults and security risks in advance, and issue early warnings in time so that corresponding measures can be taken to deal with them, thereby improving the stability and reliability of the information system and ensuring the normal operation of the system.

[0024] The solution of the present invention is mainly used in information systems (IS). Information systems refer to systems that use information technology to collect, process, store and disseminate information to support the business processes, management and decision-making of organizations. It is usually composed of hardware (physical facilities such as servers, workstations, network equipment (such as routers, switches), storage devices, etc.), software (covering operating systems, database management systems, applications (such as ERP, CRM), middleware, etc.), data (core assets of information systems, including structured data (such as records in tables) and unstructured data (such as documents, images)), programs (writing application code for processing business logic to ensure the correct processing and circulation of data), personnel (involving system developers, maintenance personnel, end users, etc., all individuals involved in the construction and use of information systems) and operating procedures (formulating various rules and regulations and technical specifications to ensure the normal operation of the system) and other elements. The solution provided in this application is mainly used to detect and warn abnormal user behavior. Figure 1 The flowchart of a method for detecting abnormal user behavior according to an embodiment of the present application is shown, and the method is applied in an information system. Figure 1 , the method includes the following processing steps.

[0025] S100: extracting user behavior features from operation data containing actual behavior of the target user.

[0026] Optionally, in an implementation of this embodiment, user behavior features can be extracted from the target user's operation log. The target user's operation log can be extracted from a large number of operation logs of a large number of users to obtain an operation log for the target user. On the one hand, it ensures that the data set used for analysis is both comprehensive and specific, avoiding interference from irrelevant data; on the other hand, the user behavior features are automatically extracted directly from the operation log, which simplifies the data preprocessing process and improves the efficiency of the system.

[0027] S102: Inputting the user behavior characteristics into an anomaly detection model, wherein the anomaly detection model takes the user behavior characteristics as input and the user abnormal behavior as output, and the anomaly detection model is trained using training data containing the user's personalized behavior characteristics.

[0028] In this embodiment, the anomaly detection model is pre-trained and is used to determine abnormal user behavior based on user behavior characteristics.

[0029] S104: Performing early warning processing based on the abnormal user behavior of the target user output by the abnormal detection model.

[0030] Optionally, in one implementation of this embodiment, after abnormal user behavior is detected according to the anomaly detection model, early warning processing methods such as text messages, emails, system pop-ups, etc. can be used to issue early warnings in a timely manner to ensure rapid response and timely prevention of potential security threats.

[0031] By using the method provided by this embodiment, the model can more accurately capture the unique behavior patterns of each user by using training data containing personalized behavior characteristics of the user. This not only improves the accuracy of anomaly detection, but also reduces the possibility of false positives. In addition, personalized training data makes the model more sensitive to individual differences, so that real abnormal behaviors can be identified more accurately and high-precision detection can be achieved. Due to the use of personalized training data, the system can better understand the normal behavior patterns of users, thereby reducing unnecessary alarms and avoiding interruptions to the user's workflow.

[0032] The method provided in this embodiment can be applied not only to the internal information system of an enterprise, but also can be extended to other fields, such as financial transaction monitoring, medical health monitoring, etc.

[0033] Optionally, in an implementation of the present embodiment, in S100, user behavior features of the target user are extracted in the following manner: initial features are extracted from the operation log of the target user; and the user behavior features used to represent the target user are selected from the initial features according to a user behavior model of the target user.

[0034] In this implementation, the initial feature includes at least one of a time feature, an operation feature, and a network feature, wherein the time feature includes, for example, login time, activity duration, etc., the operation feature includes, for example, command execution frequency, file access mode, and the network feature includes, for example, IP address, device type, etc.

[0035] In this implementation, a user behavior model can be constructed for each user, or for each group of users (users with common characteristics). Taking the user behavior model of a single target user as an example, it includes all the behavior features used to represent the target user and the importance levels of these behavior features. Among them, all behavior features include the user's baseline behavior features and personalized behavior features.

[0036] Exemplarily, the user's baseline behavior features are used to represent the user's objective behavior, including behavior features that can be directly obtained and features enriched based on these directly obtained behavior features. The behavior features that can be directly obtained, for example, include: session ID, operation command, operation content, operation time, operation current directory, audit level ID, operation sensitivity level, database command query table name, operation type, operator, operator regional ID, organization ID, organization name, operator status, master account name, master account status, slave account name, slave account status ID, client IP, port name, database name, etc. The enriched features include: the number of different IP addresses used by the same master account, the number of devices under the same master account, the number of slave accounts under the same master account, host sensitive file access behavior, database sensitive data access behavior, root account privilege escalation, etc.

[0037] Enrichment based on these directly acquired behavioral features helps increase the value and richness of the data.

[0038] In this implementation, the user behavior model also includes the importance levels of all behavior features, for example, all behavior features are sorted in order from high to low importance. In this way, when extracting the behavior features of the target user, the more important behavior features of the target user (i.e., the ones that better reflect the characteristics of the target user) can be selectively selected for subsequent processing.

[0039] Optionally, in this embodiment, it is also possible to comprehensively consider which initial features are selected as user behavior features based on the processing pressure of real-time concurrent data, the user monitoring level, the accuracy requirements of the prediction results, etc. For example, the greater the processing pressure of concurrent data, the smaller the proportion of user behavior features selected from the initial features according to the importance level; the higher the user monitoring level (different target users have different monitoring levels due to their positions, backgrounds, historical warning times, etc., and the higher the monitoring level, the greater the possibility of abnormal behavior of the target user), the greater the proportion of user behavior features selected from the initial features according to the importance level; the higher the accuracy requirements of the prediction, the greater the proportion of user behavior features selected from the initial features according to the importance level.

[0040] Optionally, in an implementation of this embodiment, in the training of the anomaly detection model, based on the user's baseline behavior characteristics, regularity is discovered in combination with context information to obtain the personalized behavior characteristics used to represent the user's personalized behavior. The baseline behavior characteristics are used to represent the user's objective behavior, and the personalized behavior characteristics are used to represent the user's regular behavior, such as commonly used login time, preferred device, and access frequency.

[0041] Exemplarily, personalized behavioral features may include: nighttime activity frequency: calculating the user's work frequency late at night (such as 22:00-06:00); application preference: recording the user's most frequently used applications and their usage frequency; login location changes: tracking the different locations where users log in, especially newly emerging geographical locations; operation chain pattern: capturing the user's pattern of a series of continuous operations, such as opening a specific file and then executing certain commands; file access path: recording the user's common path to access files, and whether there is any behavior that deviates from the regular path; command execution speed: analyzing the speed and error rate of user input commands, especially during the late night period.

[0042] Optionally, in an implementation of this embodiment, the personalized behavior feature includes a predicted behavior feature for the user, and the predicted behavior feature includes a predicted instruction sequence. Figure 2 As shown, the predicted instruction sequence can be determined in the following way:

[0043] S200: Construct a relationship graph of operation instruction sets of all users in the user set.

[0044] S202: Based on the operation instruction set relationship graph, the predicted instruction sequence is predicted using a sequence prediction model, wherein in the operation instruction set relationship graph, the direction of the edge reflects the order in which the operation instructions are executed, and the weight of the edge reflects at least the number of jumps.

[0045] By adopting this implementation, the predicted instruction sequences of all users can be predicted, and the predicted instruction sequences can be introduced as training data in the process of training the anomaly detection model. By introducing the predicted instruction sequences, the anomaly detection model can learn more complex operation modes and dependencies, so as to more accurately identify the difference between normal behavior and abnormal behavior; training based on the predicted instruction sequence makes the model more sensitive to the user's regular operation path, reducing false positives caused by accidental or edge cases. Since each user has different operating habits, the predicted instruction sequence can help the anomaly detection model better understand individual differences and provide more personalized anomaly detection.

[0046] In addition, in this implementation, based on the predicted instruction sequence, it is also helpful to identify which instructions or instruction combinations are most critical for anomaly detection, thereby optimizing the feature selection process mentioned above, that is, optimizing the importance level of the behavioral features mentioned above.

[0047] In this implementation, the operation instruction set relationship map uses instructions and their operation objects as nodes, and the order of instructions under the same session ID as edges. The directionality of the network edges is defined according to the order of instruction execution, thereby defining the jump relationship map between instructions, setting the edge weight of the network according to the number of jumps, and constructing a weighted directed instruction relationship map for user instruction sequence prediction. To achieve personalized prediction, a portrait can be constructed for each user: with the main account as the root node and the secondary account as the secondary node, the instruction jump map under the same user is constructed downward, and a large network composed of historical data of all users under the same host operating system or database version is maintained to facilitate similar users to send and user anomaly discovery.

[0048] In this implementation, optionally, the weight of the edge can be calculated based on the number of jumps corresponding to the edge and the first weight corresponding to each number of jumps. The closer the time of occurrence of the number of jumps corresponding to the edge is to the current time, the greater the first weight corresponding to it. For example, if the number of jumps corresponding to a certain edge is 4, and they include jump 1, jump 2, jump 3 and jump 4 in chronological order, then the weight of the edge is the sum of the weights of jumps 1, 2, 3 and 4. The weight of jump 1 is less than the weight of jump 2, less than the weight of jump 3, and less than the weight of jump 4.

[0049] By adopting this implementation method, the weight of the edge is optimized by the jump occurrence time, which improves the timeliness of the operation instruction set relationship graph and is more conducive to obtaining a predicted instruction sequence close to the actual situation.

[0050] In this implementation, optionally, the weight of the edge reflects both the number of jumps and the group to which the user belongs. The method further includes: calculating the weight of the edge based on the number of jumps corresponding to the edge and the group to which the user belongs, wherein for the same type of jumps, different user groups have different effects on the weight of the edge.

[0051] The user's group can be administrators, ordinary employees, etc. Considering that different groups may have different operation modes, the weight of the edge is adjusted according to the operation characteristics of different groups, which can reflect both the commonalities within the group and the differences between different groups.

[0052] Exemplarily, please refer to the above text for the method of determining the weight of the edge according to the number of jumps. This implementation method can further optimize the weights of some types of jumps (i.e., edges) according to the group to which the user belongs, based on the determination of the weight of the edge according to the number of jumps. For example, the jump from restarting the service to checking the system status is a more common operation for administrators and a relatively rare operation for ordinary employees. Therefore, for this jump, if it corresponds to an administrator, the weight value is increased (for example, increased by 5%-15%) on the basis of the original weight (for example, the weight of the edge determined according to the number of jumps). If it corresponds to an ordinary employee, the weight value is reduced (for example, reduced by 5%-15%) on the basis of the original weight (for example, the weight of the edge determined according to the number of jumps).

[0053] Based on the ideas provided by this implementation, those skilled in the art can determine the association between different jumps and different user groups according to the different groups to which the users belong. The stronger the association, the higher the optimized weight value.

[0054] Optionally, in one implementation, in S202, the predicted instruction sequence is predicted using a sequence prediction model, including: predicting a first predicted instruction sequence using a first sequence prediction model based on real-time dependency; predicting a second predicted instruction sequence using a second sequence prediction model based on long-term and short-term dependencies; and determining the predicted instruction sequence based on the first predicted instruction sequence and the second predicted instruction sequence.

[0055] With this implementation, the first sequence prediction model focuses on capturing short-term dependencies in user behavior, such as the correlation between the most recent operations. This is very important for quickly responding to immediate changes in user behavior. The second sequence prediction model is able to capture long-term historical patterns and complex temporal dependencies, identifying behavioral features that span longer time periods. This helps to understand a wider range of operational contexts. The two models capture information at different time scales and complement each other. By combining the prediction results of the two, a more comprehensive and accurate predicted instruction sequence can be obtained. The first sequence prediction model can detect abnormal behaviors in the short term in a timely manner, while the second sequence prediction model can help confirm whether these behaviors conform to long-term patterns, thereby reducing the possibility of false positives and false negatives.

[0056] In this implementation, optionally, the first sequence prediction model is a Markov model (including a Markov model and / or a hidden Markov model), the second sequence prediction model is an LSTM model and / or a GRU model and / or an RNN model, and the prediction instruction sequence is determined based on the first prediction instruction sequence and the second prediction instruction sequence, including: based on the first prediction instruction sequence and the second prediction instruction sequence, the prediction instruction sequence is determined by majority voting. For example, assuming that a total of three models are used (including at least one Markov model and one LSTM model), if the prediction results of two models are A and the prediction result of one model is B, then A is used as the final prediction result; or, if the three models give probability values ​​for the same result, based on the average value of the probability values, the prediction result with the largest average value is selected as the final result.

[0057] Optionally, in other implementations of this embodiment, the predicted behavior features, in addition to the predicted instruction sequence, may also include predicted login time, predicted operation frequency, predicted access resources, predicted geographic location, predicted device type, predicted application preference, etc.

[0058] Through these predicted behavior features and the enriched features mentioned above, these features are merged with the baseline behavior features to form a richer feature space, which is more conducive to training an anomaly detection model that can accurately predict user abnormal behavior.

[0059] Optionally, in Figure 1 In one implementation of the illustrated embodiment, the anomaly detection model is a model trained using a KNN (K-Nearest Neighbor), Isolation Forest, or Angle-based outlier detection algorithm. The following is an illustration using the Isolation Forest algorithm as an example.

[0060] According to this implementation, the isolation forest algorithm is used to detect anomalies in user behavior. The anomaly detection algorithm extracts features from the existing massive user operation logs, extracts attribute features that meet the specifications, uses feature processing methods to obtain numerical results of the features, and finally uses the isolation forest algorithm-binary search tree structure to isolate samples. Due to the small number of outliers and their alienation from most samples, outliers will be isolated earlier, that is, outliers will be closer to the root node of the tree, while normal values ​​will be farther away from the root node.

[0061] According to one or more embodiments of the present application, the isolation forest algorithm of the present invention is divided into two stages. In the first stage, t isolated trees need to be trained to form an isolation forest. In the second stage, each sample point is brought into each isolated tree in the forest, the average height is calculated, and then the outlier score of each sample point is calculated based on the average height. The specific algorithm is:

[0062] Phase 1:

[0063] S11: Let X = {x1, ..., x n} is the collected user behavior feature dataset, let x i ∈X, and x i =(x 11 , …, x id ), d is the dimension value, randomly selected from X sample points, thus forming a subset X′ of X, and putting X′ into the root node.

[0064] S12: Randomly specify a dimension q from the d dimensions, and randomly generate a cutting point p in the current collected user data features, where the cutting point p satisfies Formula 1,

[0065] [Formula 1]

[0066] min(x ij , j = g, x ij ∈X′) <p<max(x ij , j = g, x ij ∈X′)

[0067] S13: The cutting point p generates a hyperplane, which divides the currently collected user feature data space into two subspaces (binary tree), and then puts the samples with a specified dimension smaller than p into the left child node in the space, and puts the samples greater than or equal to p into the right child node.

[0068] S14: recursively perform the above S12 and S13 until all leaf nodes have only one sample point or the isolated tree (iTree) has reached a specified height.

[0069] S15: Loop S11 to S14 until t isolated trees are generated.

[0070] Phase 2:

[0071] S21: For each data feature point x of user behavior i , let it traverse each isolated tree (iTree) and calculate the point x i The average height in the forest, normalized to the average height of all.

[0072] S22: Calculate the outlier score using the following formula (2):

[0073] [Formula 2]

[0074]

[0075] in, is the anomaly score of data point x, E(h(x)) is the average height of all trees in the isolation forest for data point x, is the parameter of the tree Related constant used to adjust the anomaly score.

[0076] in, Calculate according to formula 3.

[0077] [Formula 3]

[0078]

[0079] In the Isolation Forest algorithm, the harmonic number H(i) is a mathematical constant that represents the sum of the reciprocals of the first i natural numbers. The harmonic number can be used to estimate the expected value of the average path length of a data point in an isolation tree with randomly selected features and split points. The harmonic number H(i) can be approximated by adding the natural logarithm ln(i) to the Euler's constant, which is approximately equal to 0.5772156649. The approximate formula for the harmonic number is: H(i)≈ln(i)+0.5772156649. In the Isolation Forest, It is used to normalize the average height of all trees in the isolation forest for the user data feature point x. Normalization is necessary because trees of different depths have different effects on the expected value of the path length. Through normalization, the isolation forest algorithm of the present invention can ensure that the anomaly scores are comparable at different tree depths.

[0080] S23: Determine whether the user data point (ie, the extracted user feature or the enhanced (enriched) user data feature) is abnormal by comparing the calculated abnormal score of the data point x with a preset threshold.

[0081] According to one or more embodiments of the present application, the sequence prediction model of the present application can use the Markov model to construct the transfer probability of instructions, calculate the transfer probability between network nodes according to the number of instruction jumps, and predict the user's next possible execution instruction based on the currently executed instruction.

[0082] According to one or more embodiments of the present application, the sequence prediction model of the present invention can also use a deep learning LSTM model to perform deep-level predictions, and can predict the user's next possible execution instruction based on the currently executed instruction.

[0083] According to one or more embodiments of the present application, the prediction results of the Markov model are fused with the prediction results of the deep learning model, that is, a majority vote is performed on the two prediction results to further improve the accuracy of instruction prediction.

[0084] Below is a further example of the probability transition matrix and prediction method in the sequence prediction model in the Anomaly Detection module.

[0085] Assume that in an information system the user has the following operation and maintenance instructions: a) check system status (A); b) restart service (B); c) update software (C); d) back up data (D); e) restore data (E).

[0086] The sequence prediction model needs to determine the transition probabilities between these instructions. For example, what is the transition probability from checking the system status (A) to restarting the service (B), what is the transition probability from restarting the service (B) to updating the software (C), etc. These transition probabilities can be obtained through historical information system data, expert experience or statistics.

[0087] Through the above instructions and their transition probabilities, the user's transition probability matrix can be obtained:

[0088]

[0089] The element o in the probability transfer matrix ij represents the transition probability from instruction i to j. For example, the first row of P represents the transition probabilities from checking the system state (A) to instructions A, B, C, D, and E, which are 0.1, 0.2, 0.3, 0.4, and 0.0, respectively.

[0090] Figure 3 is a schematic diagram showing a transition probability matrix according to an embodiment of the present application.

[0091] like Figure 3 As shown in Figure 1, based on this transition probability matrix, a directed graph is used to represent the relationship between operation and maintenance instructions. Figure 3 In the model, nodes represent operation and maintenance instructions, edges represent the transitions between instructions, and the weights of edges represent the transition probabilities.

[0092] According to one or more embodiments of the present application, the next possible operation instruction executed by the user is predicted through the Markov model and the deep learning LSTM to obtain two prediction results, and the two prediction results are subjected to majority voting to obtain the next possible operation instruction executed by the user.

[0093] According to one or more embodiments of the present application, for the above-mentioned transfer probability matrix, the deep learning LSTM model can predict whether instruction A can be transferred to instructions A, B, C, D and E, and its output is 0 or 1, where 0 indicates that A cannot be transferred to other instructions, and 1 indicates that A can be transferred to other instructions; then the Markov model is used to predict the probability value that the current instruction A can be transferred to other instructions (A, B, C, D and E), thereby determining the specific value of the user in transferring to other instructions.

[0094] According to one or more embodiments of the present application, the probability of whether instruction A can be transferred to instructions A, B, C, D and E can be predicted by LSTM, and the probability that the current instruction A can be transferred to other instructions (A, B, C, D and E) can be predicted by Markov model, and the probability of transferring from instruction A to other instructions can be obtained by majority voting on these two results (probability values). When predicting the transfer probability matrix, a predetermined first weight is assigned according to the transfer probability of the operation instructions in the instruction set at different historical times, and a preset second weight is assigned to the LSTM model and the Markov model, and the final predicted transfer probability between instructions is obtained by weighting. Among them, the first weight and the second weight can be one or more, which can be set according to the specific use environment and hardware conditions of the information system.

[0095] In one embodiment of the present application, an electronic device is also provided, the electronic device comprising a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and execute the computer instructions to implement the user abnormality detection method provided by the present application.

[0096] In one embodiment of the present application, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores computer instructions or a computer program, and when the computer instructions or the computer program are executed, the method for user anomaly detection provided by the present application is implemented.

[0097] Figure 4 A block diagram of a device for detecting abnormal user behavior in an information system according to an example of the present application is shown. Figure 5 It is a block diagram showing a data analysis module according to an example of the present application.

[0098] like Figure 4 As shown, the device for detecting abnormal user behavior includes: a data acquisition module, a data processing module, a data early warning module and a response module. The data processing module further includes: a data encryption module, a data analysis module and an abnormal detection module.

[0099] like Figure 4 and Figure 5As shown, the data collection module is used to collect various user data in the information system; the data processing module includes a data encryption module, a data analysis module, and anomaly detection module. Among them, the data encryption module encrypts the collected user sensitive data; the data analysis module analyzes the collected user data to build a user behavior model and an operation instruction set relationship map; the anomaly detection module detects the user's behavior anomaly through an anomaly detection algorithm based on the behavior model, and detects the user's operation instruction anomaly through a sequence prediction model based on the operation instruction set relationship map; the data warning module sends a warning message to notify relevant personnel to handle the user's abnormal behavior when at least one abnormality is detected in the user's behavior or operation instruction; the response module takes corresponding measures to handle the user's abnormality according to the level and type of the warning.

[0100] According to one or more embodiments of the present application, the data acquisition module is responsible for collecting various operation data of the information system, including hardware status, software logs, network traffic, etc. The collected data will be transmitted to the data processing module through a secure channel for analysis.

[0101] According to one or more embodiments of the present application, the data encryption module is used to encrypt the collected sensitive data to ensure the security of the data.

[0102] According to one or more embodiments of the present application, the data analysis module uses a data analysis algorithm to analyze the encrypted data and extract key indicators and features, where the key indicators and features include at least a user behavior model and an operation instruction set relationship map.

[0103] According to one or more embodiments of the present application, the user behavior model is used to detect conventional feature attributes such as session ID, operation command, operation content, operation time, operation current directory, audit level ID, operation sensitivity level, database command query table name, operation type, operator, operator regional ID, organization ID, organization name, operator status, master account name, master account status, slave account name, slave account status ID, client IP, port name, database name, etc.; wherein the data behavior model enriches (or enhances) the extracted user feature data to obtain enriched or enhanced user behavior feature attributes, such as: instruction prediction, the number of different IP addresses used by the same master account, the number of devices under the same master account, the number of slave accounts under the same master account, host sensitive file access behavior, database sensitive data access behavior, root account privilege escalation, etc.

[0104] According to one or more embodiments of the present application, when establishing an operation instruction set relationship graph, the instructions and their operation objects are used as nodes, the order of instructions under the same session ID is used as edges, and the directionality of the network edges is defined according to the order of instruction execution, thereby defining a jump relationship graph between instructions, setting the edge weight of the network according to the number of jumps, and constructing a weighted directed instruction relationship graph for predicting user instruction sequences. To achieve personalized prediction, the algorithm constructs a portrait for each user: with the main account as the root node and the secondary account as the secondary node, it extends downward to construct an instruction jump graph under the same user, and maintains a large network composed of historical data of all users under the same host operating system or database version for similar user discovery and user anomaly discovery.

[0105] According to one or more embodiments of the present application, when detecting abnormal user behavior, the anomaly detection module uses KNN (K-Nearest Neighbors), Isolation Forest, Angle-based outlier detection, etc. to complete outlier detection.

[0106] According to one or more embodiments of the present application, the present invention uses an isolation forest algorithm to detect anomalies in user behavior. The anomaly detection algorithm extracts features from the existing massive user operation logs, extracts attribute features that meet the specifications, uses feature processing methods to obtain numerical results of the features, and finally uses the isolation forest algorithm-binary search tree structure to isolate samples. Due to the small number of outliers and their alienation from most samples, outliers will be isolated earlier, that is, outliers will be closer to the root node of the tree, while normal values ​​will be farther away from the root node.

[0107] According to one or more embodiments of the present application, the early warning module determines whether it is necessary to issue an early warning based on the analysis results of the data processing module (i.e., the output results of the abnormality detection module). If an abnormal situation is detected, the early warning module will issue an early warning message in a timely manner to notify relevant personnel to handle it. The early warning method may include text messages, emails, system pop-ups, etc.

[0108] According to one or more embodiments of the present application, the response module is responsible for processing the warning information. After receiving the warning information, relevant personnel can take corresponding measures to handle it according to the level and type of the warning, such as repairing the fault, strengthening safety protection, etc.

[0109] According to one or more embodiments of the present application, the early warning mechanism of the present invention can be applied to various information systems, such as office management systems, business management systems, etc. The implementation environment needs to have at least the following conditions: an information system server with data acquisition software installed; a secure computing platform for encrypting and analyzing the collected data; an early warning notification system, such as a text message platform, an email server, etc.

[0110] According to one or more embodiments of the present application, the acquisition module can be implemented as follows: installing data acquisition software on the information system server, which can collect system hardware status, software logs, network traffic and other data in real time. The collected data is transmitted to the secure computing platform through a secure channel for processing.

[0111] According to one or more embodiments of the present application, the data analysis module can be implemented as follows: the secure computing platform encrypts the collected data to ensure the security of the data. The encrypted data is analyzed using the processing method described in the above data analysis module to extract key indicators and features. For example, the system's CPU usage, memory usage, network latency and other indicators, as well as features such as error information and abnormal access records in the software log can be analyzed. By comparing with the normal operating state, abnormal conditions in the system are detected. For example, if the CPU usage suddenly increases, the network latency increases, a large number of error logs appear, etc., it may indicate that the system has a fault or security problem.

[0112] According to one or more embodiments of the present application, the data warning module of the present invention can be implemented as follows: when an abnormal situation is detected, the warning module will issue a warning message in a timely manner. The warning information may include a description of the abnormal situation, the time of occurrence, the severity, etc. The warning method can be selected according to the actual situation, such as SMS notification, email notification, system pop-up window, etc. Relevant personnel can timely understand the operating status of the system based on the warning information and take corresponding measures to deal with it.

[0113] According to one or more embodiments of the present application, the response module can be implemented as follows: after receiving the warning information, the relevant personnel can take corresponding measures to deal with it according to the level and type of the warning. For example, if it is a hardware failure, maintenance personnel can be arranged to repair it in time; if it is a software vulnerability, the software version can be updated in time; if it is a network attack, security protection measures can be strengthened, etc. After the processing is completed, the relevant personnel can feedback the processing results to the warning module in order to optimize and improve the warning mechanism.

[0114] According to one or more embodiments of the present application, the control logic of the method or device for detecting abnormal user behavior in an information system of the present invention can use encoded instructions (e.g., computer and / or machine-readable instructions) stored on a non-transitory computer and / or machine-readable medium (e.g., a hard drive, flash memory, read-only memory, optical disk, digital versatile disk, cache, random access memory and / or any other storage device or storage disk) to implement the processing constructed by the SDK as described above in the present invention, and store information for any time period (e.g., an extended time period, permanent, short-term instance, temporary cache and / or information cache) in a non-transitory computer and / or machine-readable medium. As used herein, the term "non-transitory computer-readable medium" is explicitly defined to include any type of computer-readable storage device and / or storage disk, and excludes propagation signals and excludes transmission media.

[0115] According to one or more embodiments of the present application, the control circuit (control logic, main control system or control module) of the method or device for detecting abnormal user behavior in an information system of the present invention may include one or more processors, and may also include a non-transitory computer-readable medium internally. Specifically, a microcontroller MCU may be included in the device (main control system or control module). (One or more) processors may include any combination of general-purpose processors and special-purpose processors (e.g., graphics processors, application processors, etc.). The processor may be coupled to and / or may include a memory / storage device, and may be configured to execute instructions stored in the memory / storage device to implement various applications and / or operating systems running on the controller in the present invention.

[0116] The accompanying drawings and detailed description of the present invention referred to above as examples of the present invention are used to explain the present invention, but do not limit the meaning or scope of the present invention described in the claims. Therefore, those skilled in the art can easily realize modifications from the above description. In addition, those skilled in the art can delete some components described herein without degrading performance, or can add other components to improve performance. In addition, those skilled in the art can change the order of the steps of the method described herein according to the environment of the process or equipment. Therefore, the scope of the present invention should not be determined by the embodiments described above, but by the claims and their equivalents.

[0117] While the invention has been described in connection with what are presently considered to be capable of implementation, it is to be understood that the invention is not limited to the disclosed embodiments, but on the contrary is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A method for detecting abnormal user behavior, applied to an information system, characterized in that: The method comprises the following steps: Extracting user behavior features from operational data containing actual behaviors of target users; Inputting the user behavior characteristics into an anomaly detection model, wherein the anomaly detection model takes the user behavior characteristics as input and the user abnormal behavior as output, and the anomaly detection model is trained using training data containing the user's personalized behavior characteristics; Perform early warning processing based on the abnormal user behavior of the target user output by the abnormal detection model.

2. The method according to claim 1, characterized in that The step of extracting user behavior features from the operation data containing the actual behavior of the target user includes: Extracting initial features from the operation log of the target user, wherein the initial features include at least one of a time feature, an operation feature, and a network feature; The user behavior feature for representing the target user is selected from the initial features according to the user behavior model of the target user, wherein the user behavior model includes all the behavior features for representing the target user and the importance levels of these behavior features.

3. The method according to claim 1, characterized in that The method further comprises: In the training of the anomaly detection model, based on the user's baseline behavior characteristics, regularity discovery is performed in combination with context information to obtain the personalized behavior characteristics used to represent the user's personalized behavior; The benchmark behavior feature is used to represent the user's objective behavior, and the personalized behavior feature is used to represent the user's regular behavior.

4. The method according to claim 1 or 3, characterized in that: The personalized behavior characteristics include predicted behavior characteristics for the user, and the predicted behavior characteristics include predicted instruction sequences; The method further comprises determining the predicted instruction sequence in the following manner: Construct a relationship graph of the operation instruction sets of all users in the user set, Based on the operation instruction set relationship graph, the predicted instruction sequence is predicted using a sequence prediction model, Among them, in the operation instruction set relationship graph, the direction of the edge reflects the order in which the operation instructions are executed, and the weight of the edge reflects at least the number of jumps.

5. The method according to claim 4, characterized in that The method further comprises: The weight of the edge is calculated according to the number of jumps corresponding to the edge and the first weight corresponding to each number of jumps; The closer the occurrence time of the number of jumps corresponding to the edge is to the current time, the greater the corresponding first weight is.

6. The method according to claim 4, characterized in that The weight of the edge reflects both the number of jumps and the group to which the user belongs. The method further includes: The weight of the edge is calculated according to the number of jumps corresponding to the edge and the group to which the user belongs. For the same type of jumps, different user groups have different effects on the weight of the edge.

7. The method according to claim 4, characterized in that The step of using a sequence prediction model to predict and obtain the predicted instruction sequence includes: A first predicted instruction sequence is obtained by predicting using a first sequence prediction model based on real-time dependency; A second predicted instruction sequence is obtained by predicting using a second sequence prediction model based on long-term and short-term dependencies; The predicted instruction sequence is determined based on the first predicted instruction sequence and the second predicted instruction sequence.

8. The method according to claim 7, characterized in that The first sequence prediction model is a Markov model; The second sequence prediction model is an LSTM model; Determining the predicted instruction sequence based on the first predicted instruction sequence and the second predicted instruction sequence includes: determining the predicted instruction sequence by majority voting based on the first predicted instruction sequence and the second predicted instruction sequence.

9. An electronic device, characterized in that: include: Memory, for storing computer instructions; A processor, configured to call and execute the computer instructions to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions or a computer program, and when the computer instructions or the computer program are executed, the method according to any one of claims 1 to 8 is implemented.

Images