User portrait construction method, electronic equipment, computer readable storage medium and program product

Abstract

The invention provides a user portrait construction method, electronic equipment, a computer readable storage medium and a program product, and the method comprises the steps: recognizing network behavior information of a target user in intranet traffic information according to the intranet traffic information, the network behavior information comprising a plurality of network behavior characteristics generated by the target user in an intranet; obtaining the number of clusters corresponding to the target user; according to the network behavior information corresponding to the target user and the number of the clusters, clustering analysis is carried out on the network behaviors of the target user, a user portrait result of the target user is obtained, the user portrait result comprises the number of network behaviors of the target user in each cluster and the corresponding network behavior characteristics, and the network behavior information of the target user is obtained. Therefore, the initial portrait label of the user does not need to be manually constructed, the efficiency of constructing the portrait of the intranet employee is remarkably improved, and the workload is reduced.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and more specifically, to a user portrait construction method, an electronic device, a computer-readable storage medium, and a program product. Background Art

[0002] Automatically outlining the persona of the enterprise intranet is crucial for internal management and development of the enterprise. By summarizing and analyzing the skills, interests, and behavior data of employees, the enterprise can fully understand the work habits, knowledge areas, and potential of employees, thereby helping managers make more accurate decisions. Persona portraits not only support personalized training, skill development, and job recommendations, but also promote efficient collaboration and knowledge sharing among employees, improve overall work efficiency, enhance employee satisfaction, and ultimately promote the long-term development of the enterprise.

[0003] However, the current corporate intranet employee portraits require manual construction of initial portrait labels, which results in heavy workload and low efficiency. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a user portrait construction method, electronic device, computer-readable storage medium and program product, which can solve the problem of large workload and low efficiency in the current enterprise intranet employee portrait that requires manual construction of the initial portrait label of the person.

[0005] In a first aspect, the present invention provides a method for constructing a user portrait, the method comprising: identifying network behavior information of a target user in intranet traffic information based on intranet traffic information, wherein the network behavior information includes a variety of network behavior characteristics generated by the target user in the intranet; obtaining the number of clusters corresponding to the target user; performing cluster analysis on the network behavior of the target user based on the network behavior information and the number of clusters corresponding to the target user, and obtaining a user portrait result of the target user, wherein the user portrait result includes the number of network behaviors of the target user under each cluster and the corresponding network behavior characteristics.

[0006] The user portrait construction method designed above automatically extracts user personal information and network behavior information based on intranet traffic, and then clusters and outlines the user portrait based on the automatically extracted network behavior information, eliminating the need to manually construct the user's initial portrait label, thereby significantly improving the efficiency of intranet employee portrait construction and reducing workload.

[0007] In an optional implementation of the first aspect, network behavior information of a target user in the intranet traffic information is identified based on the intranet traffic information, including: obtaining the intranet traffic information; performing protocol parsing on the intranet traffic information to obtain a network traffic log of the protocol parsing; searching for a network traffic log associated with a target user identifier in the network traffic log of the protocol parsing based on a target user identifier of the target user to obtain a network traffic log corresponding to the target user; detecting and extracting a variety of network behavior features in the network traffic log corresponding to the target user to obtain the network behavior information of the target user.

[0008] In an optional implementation manner of the first aspect, obtaining the intranet traffic information includes: receiving a copy of the intranet traffic data transmitted by the core switch through a mirror port to obtain the intranet traffic information.

[0009] In the above implementation mode, this solution obtains the intranet traffic information by using the copy of the intranet traffic data transmitted by the core switch through the mirror port, thereby reducing the impact on the actual network traffic transmission of the intranet.

[0010] In an optional implementation of the first aspect, multiple network behavior features in the network traffic log corresponding to the target user are detected and extracted to obtain the network behavior information of the target user, including: extracting access information from the network traffic log corresponding to the target user to obtain the network access behavior features corresponding to the target user; performing file restoration on the network traffic log corresponding to the target user to obtain the file transfer features corresponding to the target user; performing attack detection on the network traffic log corresponding to the target user to obtain the abnormal operation features and attack behavior features corresponding to the target user.

[0011] In the above implementation mode, this solution can also comprehensively obtain the target user's network behavior information, including network access, file transfer, abnormal operation and attack behavior, by receiving a copy of the intranet traffic data of the core switch, performing protocol analysis and extracting multiple features, thereby providing a rich data foundation for accurate portraits. The portraits constructed through the employees' network behavior information in the intranet can help the security team quickly identify potential high-risk users from complex network data, greatly improving the efficiency of abnormal behavior detection. Based on different portrait categories, enterprises can implement targeted permission control and monitoring strategies for different employee groups, thereby more effectively protecting sensitive information.

[0012] In an optional implementation of the first aspect, obtaining the number of clusters corresponding to the target user includes: in response to a user input operation, obtaining the number of clusters input based on the input operation, and obtaining the number of clusters corresponding to the target user.

[0013] In an optional implementation of the first aspect, obtaining the number of clusters corresponding to the target user includes: determining the number of clusters corresponding to the target user according to multiple network behavior features in the network behavior information of the target user.

[0014] In an optional implementation of the first aspect, determining the number of clusters corresponding to the target user based on multiple network behavior characteristics in the network behavior information of the target user includes: obtaining the activity of each of the multiple network behavior characteristics of the target user; and determining the number of clusters corresponding to the target user based on the number of network behavior characteristics whose activity is higher than a preset activity.

[0015] The above implementation method provides two ways to determine the number of clusters: user input and activity based on network behavior characteristics. It not only satisfies the flexibility of users to make manual adjustments based on experience or specific needs, but also realizes the scientific nature of automatic intelligent determination based on users' actual network behavior characteristics, thereby improving the accuracy of cluster analysis and the quality of user portraits.

[0016] In an optional implementation of the first aspect, cluster analysis is performed on the target user's network behavior based on the network behavior information corresponding to the target user and the number of clustering clusters to obtain a user portrait result of the target user, including: preprocessing a variety of network behavior features in the network behavior information corresponding to the target user to obtain a network behavior data set corresponding to the target user; determining a feature vector data set corresponding to the target user based on the network behavior data set corresponding to the target user, wherein the feature vector data set represents feature vectors corresponding to the network behavior data participating in clustering among the target user's multiple network behaviors; and adopting a K-means clustering algorithm, utilizing the feature vector data set and the number of clustering clusters to perform cluster analysis on the target user's network behavior to obtain a user portrait result of the target user.

[0017] In a second aspect, the present application provides a user portrait construction device, which includes an identification module, an acquisition module and a cluster analysis module. The identification module is used to identify the network behavior information of the target user in the intranet traffic information based on the intranet traffic information, wherein the network behavior information includes a variety of network behavior characteristics generated by the target user in the intranet; the acquisition module is used to obtain the number of clusters corresponding to the target user; the cluster analysis module is used to perform cluster analysis on the target user's network behavior based on the network behavior information and the number of clusters corresponding to the target user, and obtain a user portrait result of the target user, wherein the user portrait result includes the number of network behaviors of the target user under each cluster and the corresponding network behavior characteristics.

[0018] The user portrait construction device designed above, this solution automatically extracts user personal information and network behavior information based on intranet traffic, and then outlines the user portrait based on the automatically extracted network behavior information clustering, thereby eliminating the need to manually construct the user's initial portrait label, thereby significantly improving the efficiency of intranet employee portrait construction and reducing workload.

[0019] In an optional implementation of the second aspect, the identification module is specifically used to obtain intranet traffic information; perform protocol analysis on the intranet traffic information to obtain a network traffic log of the protocol analysis; search for a network traffic log associated with the target user identifier in the network traffic log of the protocol analysis based on the target user identifier of the target user to obtain a network traffic log corresponding to the target user; detect and extract multiple network behavior features in the network traffic log corresponding to the target user to obtain the network behavior information of the target user.

[0020] In an optional implementation of the second aspect, the identification module is further specifically used to receive a copy of the intranet traffic data transmitted by the core switch through the mirror port to obtain the intranet traffic information.

[0021] In an optional implementation of the second aspect, the identification module is also specifically used to extract access information from the network traffic log corresponding to the target user to obtain the network access behavior characteristics corresponding to the target user; perform file restoration on the network traffic log corresponding to the target user to obtain the file transfer characteristics corresponding to the target user; perform attack detection on the network traffic log corresponding to the target user to obtain the abnormal operation characteristics and attack behavior characteristics corresponding to the target user.

[0022] In an optional implementation of the second aspect, the acquisition module is specifically configured to respond to a user input operation, acquire the number of clusters input based on the input operation, and obtain the number of clusters corresponding to the target user.

[0023] In an optional implementation of the second aspect, the acquisition module is further specifically configured to determine the number of clusters corresponding to the target user according to a plurality of network behavior features in the network behavior information of the target user.

[0024] In an optional implementation of the second aspect, the acquisition module is further specifically used to obtain the activity of each of the target user's multiple network behavior characteristics; and determine the number of clusters corresponding to the target user according to the number of network behavior characteristics whose activity is higher than a preset activity.

[0025] In an optional implementation of the second aspect, the clustering analysis module is specifically used to preprocess a variety of network behavior features in the network behavior information corresponding to the target user to obtain a network behavior data set corresponding to the target user; determine a feature vector data set corresponding to the target user based on the network behavior data set corresponding to the target user, wherein the feature vector data set represents a feature vector corresponding to the network behavior data participating in clustering among the various network behaviors of the target user; adopt a K-means clustering algorithm, utilize the feature vector data set and the number of clustering clusters, perform cluster analysis on the network behavior of the target user, and obtain a user portrait result of the target user.

[0026] In a third aspect, the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes any optional method described in the first aspect when executing the computer program.

[0027] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, performs any optional method described in the first aspect.

[0028] In a fifth aspect, the present invention provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, performs the steps of any optional method described in the first aspect.

[0029] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 A schematic diagram of the first process of the user portrait construction method provided in an embodiment of the present application;

[0032] Figure 2 A second flow chart of the method for constructing a user portrait provided in an embodiment of the present application;

[0033] Figure 3 A third flow chart of the user portrait construction method provided in an embodiment of the present application;

[0034] Figure 4 A schematic diagram of the structure of a user portrait building device provided in an embodiment of the present application;

[0035] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0036] Icons: 400 - identification module; 410 - acquisition module; 420 - clustering analysis module; 5 - electronic device; 501 - processor; 502 - memory; 503 - communication bus. DETAILED DESCRIPTION

[0037] The following embodiments of the technical solution of the present application are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0039] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0040] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0041] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0042] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0043] In the description of the embodiments of the present application, the technical terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential", etc. indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the embodiments of the present application.

[0044] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0045] Automatically outlining the persona of the enterprise intranet is crucial for internal management and development of the enterprise. By summarizing and analyzing the skills, interests, and behavior data of employees, the enterprise can fully understand the work habits, knowledge areas, and potential of employees, thereby helping managers make more accurate decisions. Persona portraits not only support personalized training, skill development, and job recommendations, but also promote efficient collaboration and knowledge sharing among employees, improve overall work efficiency, enhance employee satisfaction, and ultimately promote the long-term development of the enterprise.

[0046] However, the current corporate intranet employee portraits require manual construction of initial portrait labels, which results in heavy workload and low efficiency.

[0047] Based on the above problems, the present application designs a user portrait construction method, electronic device, computer-readable storage medium and program product. The present solution automatically extracts user personal information and network behavior information based on intranet traffic, and then outlines the user portrait based on the automatically extracted network behavior information clustering, thereby eliminating the need to manually construct the user's initial portrait label, thereby significantly improving the efficiency of intranet employee portrait construction and reducing workload. In addition, the present solution also receives a copy of the intranet traffic data from the core switch, performs protocol parsing and multiple feature extractions on it, and can comprehensively obtain the target user's network behavior information, including network access, file transfer, abnormal operations and attack behaviors, etc., providing a rich data foundation for accurate portraits, so that the portraits constructed through the employee's network behavior information in the intranet can help the security team quickly identify potential high-risk users from complex network data, greatly improving the efficiency of abnormal behavior detection, and based on different portrait categories, enterprises can implement targeted permission control and monitoring strategies for different employee groups, thereby more effectively protecting sensitive information. At the same time, this solution provides two ways to determine the number of clusters: user input and activity based on network behavior characteristics. This not only meets the flexibility of users making manual adjustments based on experience or specific needs, but also realizes the scientific nature of automatic and intelligent determination based on users' actual network behavior characteristics, thereby improving the accuracy of clustering analysis and the quality of user portraits.

[0048] Based on the above ideas, this application first provides a user portrait construction method, which can be applied to a computing device, which may include a computer, a server, a cloud server, a network audit system, etc. Figure 1 As shown, the method can be implemented by the following methods, including:

[0049] Step S100: Identify the network behavior information of the target user in the intranet traffic information according to the intranet traffic information.

[0050] Step S110: Obtain the number of clusters corresponding to the target user.

[0051] Step S120: performing cluster analysis on the network behavior of the target user according to the network behavior information corresponding to the target user and the number of clusters, and obtaining a user portrait result of the target user.

[0052] In the above implementation, Intranet, also known as intranet within an enterprise, is a comprehensive network information system established with Internet technology that can support internal business processing and information exchange within enterprises and institutions. It usually adopts certain security measures to isolate it from Internet users outside the enterprise.

[0053] Intranet traffic refers to the traffic data information generated by users in the enterprise intranet. In the case where the enterprise uses a switch to forward intranet and intranet data, the intranet traffic information can be the traffic data information flowing through the switch. The target user refers to the user in the enterprise intranet who needs to build a user profile. It can be a certain user in the enterprise intranet, some users in the enterprise intranet, or all users in the enterprise intranet. Among them, the traffic data information generated by each user in the enterprise intranet carries a corresponding feature identifier, such as user ID, mobile phone MAC, computer IP, etc. The traffic data information generated by different users can be distinguished by distinguishing the user's feature identifier.

[0054] For step S100, this solution can first identify the network behavior information of the target user in the intranet traffic information based on the intranet traffic information. The network behavior information can include a variety of network behavior characteristics generated by the target user in the intranet, where the various network behavior characteristics can include but are not limited to: network access behavior characteristics, file transfer characteristics, abnormal operation characteristics, and attack characteristics, etc.

[0055] As a specific implementation, for step S100, Figure 2 As shown, this solution can be implemented in the following ways:

[0056] Step S200: Obtaining intranet traffic information.

[0057] Step S210: Perform protocol analysis on the intranet traffic information to obtain a network traffic log of the protocol analysis.

[0058] Step S220: searching for a network traffic log associated with the target user identifier in the network traffic log parsed by the protocol according to the target user identifier of the target user, and obtaining a network traffic log corresponding to the target user.

[0059] Step S230: Detect and extract multiple network behavior features in the network traffic log corresponding to the target user to obtain the network behavior information of the target user.

[0060] For step S200, as a possible implementation method, in order to avoid the impact of the user portrait construction process of this solution on the actual network traffic transmission in the intranet, this solution can receive a copy of the intranet traffic data transmitted by the core switch through the mirror port to obtain the intranet traffic information.

[0061] Specifically, this solution can connect the monitoring port of the computing device to the mirror port of the core switch at the enterprise intranet exit. The core switch will copy and send all the traffic in and out of the enterprise intranet to the monitoring port of the computing device through the mirror port. The computing device can receive the copy of the intranet traffic data transmitted by the core switch through the mirror port through the monitoring port, thereby obtaining the intranet traffic information. Among them, the mirror port can also be called a SPAN port, and its main function is to copy the network traffic of one or more source ports (monitored ports) to one or more destination ports (monitoring ports).

[0062] In the above implementation mode, this solution obtains the intranet traffic information by using the copy of the intranet traffic data transmitted by the core switch through the mirror port, thereby reducing the impact on the actual network traffic transmission of the intranet.

[0063] For step S210, when the present solution obtains the intranet traffic information, the present solution can perform protocol parsing on the obtained intranet traffic information, thereby obtaining the network traffic log of the protocol parsing. Among them, Protocol Parsing & Extraction is the process of decoding and extracting information from the data fields of a specific protocol. After the protocol is identified, the network audit system can parse the specific data fields in the protocol, such as extracting the URL, user agent, request header information, etc. in the HTTP protocol; and parse the sender, recipient, subject, and email content in the mail protocol (such as SMTP). The detailed information extracted by the protocol parsing helps to analyze the specific behavior content of the user, and further identify and record the details of the user's web page visits, search content, file downloads, etc.

[0064] Based on the above, this solution can search for the network traffic log associated with the target user identifier in the network traffic log parsed by the protocol according to the target user identifier of the target user, obtain the network traffic log corresponding to the target user, and then detect and extract various network behavior features in the network traffic log corresponding to the target user to obtain the network behavior information of the target user.

[0065] Specifically, for step S230, this solution can extract access information from the network traffic log corresponding to the target user to obtain the network access behavior characteristics corresponding to the target user; perform file restoration on the network traffic log corresponding to the target user to obtain the file transfer characteristics corresponding to the target user; perform attack detection on the network traffic log corresponding to the target user to obtain the abnormal operation characteristics and attack behavior characteristics corresponding to the target user, thereby obtaining a variety of network behavior characteristics used by the target.

[0066] Among them, access information identification can determine the type of traffic, such as web browsing, file transfer, email sending, video streaming, etc. Traffic identification helps the network audit system understand the distribution of different types of online behaviors, thereby drawing a user's traffic profile and determining their main types of online behaviors.

[0067] File reconstruction is to reassemble the file data transmitted in a specific flow into the original file after protocol parsing. For example, when a user transfers files via HTTP, FTP or mail protocols, the network audit system can reassemble the transmitted data packets and restore them to the files uploaded or downloaded by the user. File reconstruction is particularly important for information auditing and security monitoring because it can help the system restore the user's file operations and identify potential sensitive file transfers or abnormal data flows to prevent data leakage or illegal dissemination of sensitive information.

[0068] Attack Detection is to identify potential attack behaviors in the network in real time based on traffic analysis. Attack detection can include the following aspects: using a known attack feature library (such as SQL injection, DDoS attack, cross-site scripting attack, etc.) to match attack features in the traffic. Once a matching feature pattern is detected, the system will trigger an alarm. Monitor abnormal behaviors in the network (such as sudden increase in traffic, abnormal request frequency, and non-conventional permission operations), and identify unknown attacks or potential internal threats through statistical analysis or machine learning models. Through feature matching or sandbox analysis, detect whether the traffic contains malware or links, and perform virus detection and malicious code analysis on the traffic. Detect whether there is a large amount of abnormal traffic or high-frequency requests, identify the characteristics of DDoS attacks, so as to take protective measures such as restriction or cleaning. By analyzing the correlation of traffic behavior, tracking the attack path, and determining the source of the attack, the entire attack chain can be restored.

[0069] In the above implementation mode, this solution receives a copy of the intranet traffic data of the core switch, performs protocol analysis and extracts multiple features, so as to comprehensively obtain the network behavior information of the target user, including network access, file transfer, abnormal operation and attack behavior, etc., providing a rich data foundation for accurate portrait.

[0070] In order to perform cluster analysis on the target user and obtain the user portrait result of the target user, this solution also needs to obtain the number of clusters corresponding to the target user, where the number of clusters indicates how many different groups or clusters the target user's network behavior is divided into by this solution, and this solution uses K to represent the number of clusters. For example, when K=4, this solution divides the network behavior data of the target user into 3 different categories, each category representing a typical network behavior pattern of the target user.

[0071] As a specific implementation method, this solution can obtain the number of clusters corresponding to the target user through input by the staff. Specifically, this solution can respond to the user input operation, obtain the number of clusters based on the input operation input, and thus obtain the number of clusters corresponding to the target user. For example, during the research process, it is found that the user's network behavior can be roughly divided into 3 categories, then in the new cluster analysis, this range can be referenced to select the K value, that is, the staff inputs K=3 so that the number of clusters corresponding to the target user obtained by this solution is 3.

[0072] As another possible implementation, the present solution can also determine the number of clusters corresponding to the target user based on the multiple network behavior characteristics in the network behavior information of the target user. Specifically, the present solution can obtain the activity of each network behavior characteristic of the target user in the multiple network behavior characteristics, and determine the number of clusters corresponding to the target user based on the number of network behavior characteristics with an activity higher than a preset activity. For example, when the network traffic log of the target user is obtained, it is found that the activity of the target user's website access and file download is relatively high. In this case, the present solution may set the cluster of the target user to 2 categories, i.e., K=2.

[0073] The above implementation method provides two ways to determine the number of clusters: user input and activity based on network behavior characteristics. It not only satisfies the flexibility of users to make manual adjustments based on experience or specific needs, but also realizes the scientific nature of automatic intelligent determination based on users' actual network behavior characteristics, thereby improving the accuracy of cluster analysis and the quality of user portraits.

[0074] In the case where multiple network behavior characteristics of the target user and the number of clusters corresponding to the target user are obtained by the above method, for step S120, if Figure 3 As shown, this scheme can perform cluster analysis in the following ways, including:

[0075] Step S300: pre-processing a plurality of network behavior features in the network behavior information corresponding to the target user to obtain a network behavior data set corresponding to the target user.

[0076] Step S310: determining a feature vector data set corresponding to the target user according to the network behavior data set corresponding to the target user.

[0077] Step S320: Using the K-means clustering algorithm, using the feature vector data set and the number of clusters, cluster analysis is performed on the network behavior of the target user to obtain a user portrait result of the target user.

[0078] In the above implementation, for step S300, specifically, this solution can perform data cleaning, feature engineering, and feature selection preprocessing on various network behavior raw data collected from target users, such as Internet behavior (e.g., URLs visited, website types, access frequency, etc.), file transfer (e.g., file name, file type, upload / download frequency, etc.), communication information (e.g., email exchange frequency, number of common contacts), abnormal access (e.g., frequent visits to blacklisted websites, abnormal access time, etc.), frequency of privilege escalation operations, external connections (e.g., abnormal IP connection frequency), large amounts of request or abnormal traffic behavior data, etc. Among them, data cleaning means removing duplicate and invalid data records and processing missing values, feature engineering means standardizing or normalizing different features (e.g., number of visits, time, etc.), and processing category data (e.g., "website type") in numerical form; feature selection means selecting features that are meaningful to clustering, such as access frequency, number of abnormal operations, number of file downloads, etc.

[0079] After performing the above preprocessing, the present solution can obtain the network behavior data set corresponding to the target user. For step S310, the present solution can determine the feature vector data set corresponding to the target user based on the network behavior data set corresponding to the target user, wherein the feature vector data set represents the feature vector corresponding to the network behavior data participating in the clustering among the various network behaviors of the target user. Specifically, the present solution can organize each network behavior data in the network behavior data set into the form of a feature vector, for example, feature vector 1 = [X1, X2, X3, ..., Xn], feature vector 2 = [X_1, X_2, X_3, ..., X_n], feature vector 3 = [X1, X2, X3, ..., Xn], feature vector 4 = [X1, X2, X3, ..., Xn], feature vector 5 = [X1, X2, X3, ..., Xn], feature vector 6 = [X1, X2, X3, ..., Xn], feature vector 7 = [X1, X2, X3, ..., Xn], feature vector 8 = [X1, X2, X3, ..., Xn], feature vector 9 = [X1, X2, X3, ..., Xn], feature vector 10 = [X1, X2, X3, ..., Xn], feature vector 11 = [X1, X2, X3, ..., Xn], feature vector 12 = [X1, X2, X3, ..., Xn], feature vector 13 = [X1, X2, X3, ..., Xn], feature vector 14 = [X1, X2, X3, ..., Xn], feature vector 15 = [X1, X2, X3, ..., Xn], feature vector 16 = [X1, X2, X3, ..., Xn], feature vector 17 = [X1, X2, X3, ..., Xn], feature vector 18 = [X1, X2, X3, ..., Xn], feature vector n ], where each Xi, Xi, X i Represents the value of a feature (e.g., number of accesses, number of file transfers, etc.).

[0080] On the basis of the above, this solution adopts the K-means clustering algorithm, uses the feature vector data set and the number of clusters to perform cluster analysis on the network behavior of the target user, so as to obtain the user portrait results of the target user.

[0081] Specifically, taking the feature vector data set composed of the Internet behavior features, file transfer features, abnormal operation features and attack features described above as an example, the detailed process of clustering using the K-means clustering algorithm is as follows:

[0082] 1. Feature extraction and quantification:

[0083] For online behavior characteristics, they may include the type of websites visited (such as social, work, entertainment, etc.), visit duration, visit frequency, etc. These characteristics are quantified. For example, numbers 1-5 are used to represent the frequency of visits, 1 represents very rare visits, 5 represents frequent visits; different digital codes are used to represent website types, etc.

[0084] In terms of file transfer characteristics, the size, type (such as documents, pictures, videos, executable files, etc.), transfer direction (upload or download), and transfer time of the transferred files are recorded and converted into quantitative data. For example, the file size is recorded numerically in bytes, and the file type is represented by a specific code.

[0085] Abnormal operation characteristics, such as whether there are frequent failed login attempts, whether there is abnormal port scanning behavior, etc., convert these characteristics into binary values ​​(0 means no abnormality, 1 means there is an abnormality).

[0086] Attack characteristics, such as whether signs of virus infection are detected, whether specific behavioral patterns of hacker attacks are encountered, etc., are also quantified in a similar way. For example, 0 indicates no attack and 1 indicates a specific type of attack.

[0087] The above quantized features are combined into feature vectors in a certain order. For example, the feature vector 1 described above = [X1, X2, X3, …, Xn], the feature vector 2 = [X_1, X_2, X_3, …, X_n], the feature vector 3 = [X1, X2, X3, …, Xn] n ], thus constructing a feature vector dataset containing all samples. Each sample corresponds to a feature vector, which represents the value of the sample in each feature dimension.

[0088] When the cluster K value is obtained, this scheme can first randomly select K samples from the feature vector data set as the initial cluster centers. These initial cluster centers represent the initial center positions of the K clusters, and the subsequent iterative process will classify other samples and update the cluster centers around these centers.

[0089] For each feature vector in the data set (i.e., each sample), calculate its distance to the K cluster centers. The distance metric here can be Euclidean distance, Manhattan distance, etc. For example, for a sample's feature vector [X1, X2, X3, ..., Xn] and a cluster center's feature vector [c1, c2, ..., cn], the Euclidean distance calculation formula is: According to the calculated distance, each sample is assigned to the cluster with the closest cluster center.

[0090] After all samples are classified, for each cluster, the mean of all sample feature vectors in the cluster is recalculated as the new cluster center. For example, for a set of sample feature vectors in a cluster {[X11,X12,…,X1n],[X21,X22,…,X2n],…,[Xm1,Xm2,…,Xmn]}, the calculation method of the new cluster center [c'1,c'2,…,c'n] is: Where m is the number of samples in the cluster.

[0091] Repeat the above steps of sample classification and cluster center update until the convergence condition is met. The convergence condition can be that the position change of the cluster center is less than a preset threshold (for example, the sum of the Euclidean distances of the cluster centers between two iterations is less than 0.001), or the preset maximum number of iterations (such as 100 times) is reached. When the convergence condition is met, the iterative clustering process ends, and the final K clusters and the cluster center of each cluster are obtained.

[0092] After the above clustering algorithm converges, this scheme can obtain clustering results. On the basis of the clustering results, this scheme can obtain user portrait results based on the clustering results, that is, this scheme can bind users with corresponding clustering results and specific network behavior characteristics under each cluster, so as to obtain user portrait results, wherein the user portrait results include the number of network behaviors of the target user under each clustering cluster and the corresponding network behavior characteristics. In this way, the staff can identify different types of user behaviors based on the user portrait results, which can help the security team quickly identify potential high-risk users from complex network data and greatly improve the efficiency of abnormal behavior detection. Based on different portrait categories, enterprises can implement targeted permission control and monitoring strategies for different employee groups, so as to more effectively protect sensitive information.

[0093] The user portrait construction method designed above, this solution automatically extracts user personal information and network behavior information based on intranet traffic, and then outlines the user portrait based on the automatically extracted network behavior information clustering, so there is no need to manually construct the user's initial portrait label, thereby significantly improving the efficiency of intranet employee portrait construction and reducing workload. In addition, this solution can also fully obtain the target user's network behavior information, including network access, file transfer, abnormal operations and attack behaviors, by receiving a copy of the intranet traffic data from the core switch, and performing protocol parsing and multiple feature extraction, providing a rich data foundation for accurate portraits, so that the portrait constructed through the employee's network behavior information in the intranet can help the security team quickly identify potential high-risk users from complex network data, greatly improving the efficiency of abnormal behavior detection, and based on different portrait categories, enterprises can implement targeted permission control and monitoring strategies for different employee groups, thereby more effectively protecting sensitive information. At the same time, this solution provides two ways to determine the number of clusters: user input and activity based on network behavior characteristics. This not only meets the flexibility of users making manual adjustments based on experience or specific needs, but also realizes the scientific nature of automatic and intelligent determination based on users' actual network behavior characteristics, thereby improving the accuracy of clustering analysis and the quality of user portraits.

[0094] As a specific embodiment, in this embodiment, assuming that in an enterprise intranet environment, first obtain a copy of the intranet traffic data through the mirror port of the core switch as the intranet traffic information. Perform protocol parsing on the intranet traffic information to obtain a network traffic log. Then, based on the specific identifier of the target user (such as user name, IP address, etc.), filter out the network traffic log of the target user in the network traffic log. Next, extract network access behavior features (such as visited websites, access time, etc.), file transfer features (such as transferred file type, size, time, etc.) and abnormal operation features and attack behavior features (such as whether there is port scanning, malware download, etc.) from the network traffic log of the target user, thereby obtaining the network behavior information of the target user.

[0095] At this time, the system responds to the number of clusters (for example, 5 clusters) input by the administrator through the human-computer interaction interface. Then, the various network behavior features in the network behavior information of the target user are preprocessed and converted into a data format suitable for cluster analysis to obtain a network behavior data set, and the feature vector data set is further determined. Finally, the K-means clustering algorithm is used to perform cluster analysis on the network behavior of the target user in combination with the input number of clusters. After calculation and analysis, the number of network behaviors of the target user in each cluster and the corresponding network behavior features are obtained, thereby constructing the user portrait result of the target user. For example, in a cluster, it is found that the target user frequently visits bad websites (such as gambling websites) during the working hours, and the file transfer behavior is relatively small, and there is no abnormal operation and attack behavior. This reflects that the user may have bad network access behavior, so that the company can focus on monitoring and managing the bad network access behavior of the user.

[0096] Figure 4 The present application provides a schematic structural block diagram of a user portrait construction device. It should be understood that the device is applied to the computing device described above. Figure 1 and 3 The method embodiment executed in corresponds to the embodiment of the method, and the steps involved in the aforementioned method can be executed. The specific functions of the device can be referred to the description above. To avoid repetition, the detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in the memory in the form of software or firmware or solidified in the operating system (OS) of the device. Specifically, the device includes: an identification module 400, an acquisition module 410 and a clustering analysis module 420, the identification module 400 is used to identify the network behavior information of the target user in the intranet traffic information according to the intranet traffic information, wherein the network behavior information includes a variety of network behavior characteristics generated by the target user in the intranet; the acquisition module 410 is used to obtain the number of clusters corresponding to the target user; the clustering analysis module 420 is used to cluster the network behavior of the target user according to the network behavior information and the number of clusters corresponding to the target user, and obtain the user portrait result of the target user, wherein the user portrait result includes the number of network behaviors of the target user under each cluster and the corresponding network behavior characteristics.

[0097] The user portrait construction device designed above, this solution automatically extracts user personal information and network behavior information based on intranet traffic, and then outlines the user portrait based on the automatically extracted network behavior information clustering, thereby eliminating the need to manually construct the user's initial portrait label, thereby significantly improving the efficiency of intranet employee portrait construction and reducing workload.

[0098] In an optional implementation of the present embodiment, the identification module 400 is specifically used to obtain intranet traffic information; perform protocol analysis on the intranet traffic information to obtain a network traffic log of the protocol analysis; search for a network traffic log associated with the target user identifier in the network traffic log of the protocol analysis according to the target user identifier of the target user to obtain a network traffic log corresponding to the target user; detect and extract a variety of network behavior features in the network traffic log corresponding to the target user to obtain the network behavior information of the target user.

[0099] In an optional implementation manner of this embodiment, the identification module 400 is further specifically configured to receive a copy of the intranet traffic data transmitted by the core switch through the mirror port to obtain the intranet traffic information.

[0100] In an optional implementation of the present embodiment, the identification module 400 is also specifically used to extract access information from the network traffic log corresponding to the target user to obtain the network access behavior characteristics corresponding to the target user; to perform file restoration on the network traffic log corresponding to the target user to obtain the file transfer characteristics corresponding to the target user; to perform attack detection on the network traffic log corresponding to the target user to obtain the abnormal operation characteristics and attack behavior characteristics corresponding to the target user.

[0101] In an optional implementation of this embodiment, the acquisition module 410 is specifically configured to respond to a user input operation, acquire the number of clusters input based on the input operation, and obtain the number of clusters corresponding to the target user.

[0102] In an optional implementation of this embodiment, the acquisition module 410 is further specifically configured to determine the number of clusters corresponding to the target user according to a plurality of network behavior features in the network behavior information of the target user.

[0103] In an optional implementation of this embodiment, the acquisition module 410 is further specifically used to obtain the activity of each of the target user's multiple network behavior characteristics; and determine the number of clusters corresponding to the target user according to the number of network behavior characteristics with activity higher than a preset activity.

[0104] In an optional implementation manner of the present embodiment, the clustering analysis module 420 is specifically used to preprocess a variety of network behavior features in the network behavior information corresponding to the target user to obtain a network behavior data set corresponding to the target user; determine a feature vector data set corresponding to the target user based on the network behavior data set corresponding to the target user, wherein the feature vector data set represents the feature vectors corresponding to the network behavior data participating in clustering among the various network behaviors of the target user; adopt a K-means clustering algorithm, utilize the feature vector data set and the number of clustering clusters, perform cluster analysis on the network behavior of the target user, and obtain a user portrait result of the target user.

[0105] According to some embodiments of the present application, Figure 5 As shown, the present application provides an electronic device 5, including: a processor 501 and a memory 502, the processor 501 and the memory 502 are interconnected and communicate with each other through a communication bus 503 and / or other forms of connection mechanisms (not marked), the memory 502 stores a computer program executable by the processor 501, and when the computing device is running, the processor 501 executes the computer program to execute any optional implementation method during execution, such as steps S100 to S120: identifying the network behavior information of the target user in the intranet traffic information based on the intranet traffic information; obtaining the number of clusters corresponding to the target user; performing cluster analysis on the network behavior of the target user based on the network behavior information and the number of clusters corresponding to the target user, and obtaining a user portrait result of the target user.

[0106] The present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method in any of the aforementioned optional implementations is executed.

[0107] Among them, the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, disk or optical disk.

[0108] The present application provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the method in any optional implementation manner.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and they should all be included in the scope of the claims and specification of the present application. In particular, as long as there is no structural conflict, the various technical features mentioned in the various embodiments can be combined in any way. The present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions that fall within the scope of the claims.

Claims

1. A method for constructing a user portrait, characterized in that: The method comprises: Identifying network behavior information of a target user in the intranet traffic information according to the intranet traffic information, wherein the network behavior information includes multiple network behavior characteristics generated by the target user in the intranet; Obtaining the number of clusters corresponding to the target user; According to the network behavior information corresponding to the target user and the number of clusters, a cluster analysis is performed on the network behavior of the target user to obtain a user portrait result of the target user, wherein the user portrait result includes the number of network behaviors of the target user in each cluster and the corresponding network behavior characteristics.

2. The method according to claim 1, characterized in that The step of identifying the network behavior information of the target user in the intranet traffic information according to the intranet traffic information includes: Get intranet traffic information; Performing protocol analysis on the intranet traffic information to obtain a network traffic log of the protocol analysis; According to the target user identifier of the target user, searching for the network traffic log associated with the target user identifier in the network traffic log parsed by the protocol to obtain the network traffic log corresponding to the target user; Detect and extract multiple network behavior features in the network traffic log corresponding to the target user to obtain the network behavior information of the target user.

3. The method according to claim 2, characterized in that The obtaining of intranet traffic information includes: A copy of the intranet traffic data transmitted by the core switch through the mirror port is received to obtain the intranet traffic information.

4. The method according to claim 2, characterized in that: The detecting and extracting multiple network behavior features in the network traffic log corresponding to the target user to obtain the network behavior information of the target user includes: Extracting access information from the network traffic log corresponding to the target user to obtain network access behavior characteristics corresponding to the target user; Perform file restoration on the network traffic log corresponding to the target user to obtain the file transfer characteristics corresponding to the target user; Attack detection is performed on the network traffic log corresponding to the target user to obtain abnormal operation characteristics and attack behavior characteristics corresponding to the target user.

5. The method according to claim 1, characterized in that The obtaining the number of clusters corresponding to the target user includes: In response to a user input operation, the number of clusters input based on the input operation is obtained, and the number of clusters corresponding to the target user is obtained.

6. The method according to claim 1, characterized in that The obtaining the number of clusters corresponding to the target user includes: The number of clusters corresponding to the target user is determined according to the multiple network behavior characteristics in the network behavior information of the target user.

7. The method according to claim 6, characterized in that The step of determining the number of clusters corresponding to the target user according to the multiple network behavior characteristics in the network behavior information of the target user includes: Obtaining the activity of each of the multiple network behavior characteristics of the target user; The number of clusters corresponding to the target user is determined according to the number of network behavior features whose activity is higher than a preset activity.

8. The method according to claim 1, characterized in that The step of performing cluster analysis on the network behavior of the target user according to the network behavior information corresponding to the target user and the number of clusters to obtain a user portrait result of the target user includes: Preprocessing a plurality of network behavior features in the network behavior information corresponding to the target user to obtain a network behavior data set corresponding to the target user; Determining a feature vector data set corresponding to the target user according to the network behavior data set corresponding to the target user, wherein the feature vector data set represents a set of feature vectors corresponding to the network behavior data participating in clustering among multiple network behaviors of the target user; The K-means clustering algorithm is adopted to perform cluster analysis on the network behavior of the target user by utilizing the feature vector data set and the number of cluster clusters, so as to obtain the user portrait result of the target user.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images