Abnormal behavior alarm method and device, equipment and storage medium

Abstract

The invention discloses an abnormal behavior warning method and device, equipment and a storage medium, and relates to the field of information security, and the method comprises the steps: carrying out the preprocessing of obtained original data and / or historical data based on a preset data preprocessing rule, so as to obtain corresponding to-be-analyzed data; entity objects are extracted from the to-be-analyzed data, association relationships among the entity objects are configured, and an analysis object library is constructed based on the entity objects and the association relationships; determining baseline data in the to-be-analyzed data based on historical data, and determining abnormal behavior information corresponding to the to-be-analyzed data by using an offline model engine, a batch data processing model, the baseline data, the long-period data and a preset abnormal behavior detection rule; and triggering a corresponding safety alarm operation by utilizing the analysis object library, the abnormal behavior information and the real-time model engine. Therefore, the accuracy of abnormal behavior detection can be improved, and the abnormal behavior can be alarmed.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to an abnormal behavior alarm method, device, equipment and storage medium. Background Art

[0002] In the field of information security, especially in the scenario of security data analysis, the network environment is complex and changeable, the means of attack are endless and increasingly hidden, there are many deep-level security threats and abnormal behaviors, and it is extremely necessary to detect such abnormal behaviors in a timely and accurate manner and issue alarms quickly.

[0003] Currently, when establishing normal behavior patterns, historical data may be overfitted, resulting in oversensitivity to minor abnormal behaviors, and normal behaviors may be misreported as abnormal behaviors, resulting in unnecessary alarms and interference. In addition, existing technologies focus more on the identification of overall behavior patterns, and may not necessarily involve details, and cannot provide more detailed analysis.

[0004] Therefore, how to improve the accuracy of abnormal behavior detection and issue alerts for abnormal behavior is a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide an abnormal behavior alarm method, device, equipment and storage medium, which can improve the accuracy of abnormal behavior detection and alarm abnormal behavior. The specific scheme is as follows:

[0006] In a first aspect, the present application provides an abnormal behavior alarm method, comprising:

[0007] Preprocessing the acquired raw data and / or historical data based on preset data preprocessing rules to obtain corresponding data to be analyzed; wherein the raw data is unprocessed data acquired from a third party, and the historical data is data processed from the raw data and stored within a preset time period;

[0008] Extracting entity objects from the data to be analyzed, and configuring association relationships between the entity objects, so as to construct an analysis object library based on the entity objects and the association relationships;

[0009] Determine baseline data in the data to be analyzed based on the historical data, and determine abnormal behavior information corresponding to the data to be analyzed using an offline model engine, a batch data processing model, the baseline data, long-period data, and preset abnormal behavior detection rules; wherein the long-period data is data whose time window duration corresponding to the offline model engine is greater than a preset time duration threshold;

[0010] The analysis object library, the abnormal behavior information and the real-time model engine are used to trigger corresponding security alarm operations.

[0011] Optionally, extracting entity objects from the data to be analyzed and configuring association relationships between the entity objects to construct an analysis object library based on the entity objects and the association relationships includes:

[0012] Filtering the data to be analyzed according to preset data filtering rules, and extracting entity objects and user objects from the filtered data to be analyzed;

[0013] Configuring the association relationship between the entity objects based on business requirements and data characteristics of the data to be analyzed to complete the relationship configuration operation;

[0014] An analysis object library is determined using the user object, the entity object, and the association relationship.

[0015] Optionally, determining baseline data in the data to be analyzed based on the historical data includes:

[0016] Baseline data is determined in the data to be analyzed based on the offline model engine, the baseline analysis model and the historical data.

[0017] Optionally, the determining of abnormal behavior information corresponding to the data to be analyzed by using an offline model engine, a batch data processing model, the baseline data, the long-period data, and a preset abnormal behavior detection rule includes:

[0018] Determine abnormal indicators based on business scenarios and data analysis requirements, and configure corresponding risk scores for the abnormal indicators;

[0019] Determining a preset abnormal behavior detection rule corresponding to the abnormal indicator based on a preset static detection threshold, a preset dynamic detection threshold, and configuration information of an associated entity; wherein the associated entity is an entity object associated through entity identity information;

[0020] The abnormal behavior information in the data to be analyzed is determined by using an offline model engine, a batch data processing model, the baseline data, the long-period data, and the preset abnormal behavior detection rules.

[0021] Optionally, the determining of abnormal behavior information corresponding to the data to be analyzed by using an offline model engine, a batch data processing model, the baseline data, the long-period data, and a preset abnormal behavior detection rule further includes:

[0022] Count the number of occurrences of each abnormal behavior in the current abnormal behavior information to complete the number counting operation;

[0023] Determine the behavior weight value corresponding to each abnormal behavior based on the target behavior weight coefficient, the natural constant and the number of occurrences; wherein the target behavior weight coefficient is an adjustable weight coefficient that decreases exponentially with the score of the abnormal behavior;

[0024] The corresponding single behavior abnormality score is determined based on the behavior weight value and the aggregate score of each abnormal behavior; wherein the aggregate score is a score calculated according to a preset behavior aggregation calculation formula and the number of occurrences.

[0025] Optionally, the determining a corresponding single behavior abnormality score based on the behavior weight value and the aggregate score of each abnormal behavior further includes:

[0026] Calculate based on the single behavior abnormality score and the preset daily incremental abnormality score calculation formula to obtain the daily incremental abnormality score;

[0027] A calculation is performed based on the daily incremental anomaly score and the time decay index to obtain a total anomaly score of the abnormal behavior.

[0028] Optionally, the using the analysis object library, the abnormal behavior information and the real-time model engine to trigger a corresponding security warning operation includes:

[0029] Calculate based on the analysis object library, the real-time model engine, the trigger frequency of the current abnormal indicator, the severity of each abnormal behavior and the total abnormal score to obtain the risk score of each of the user object and the entity object;

[0030] A corresponding risk level is determined based on the risk score, so as to trigger a corresponding risk control operation based on the risk level.

[0031] In a second aspect, the present application provides an abnormal behavior alarm device, comprising:

[0032] A data processing module, used to pre-process the acquired original data and / or historical data based on preset data pre-processing rules to obtain corresponding data to be analyzed; wherein the original data is unprocessed data obtained from a third party, and the historical data is data processed from the original data and stored within a preset time period;

[0033] An object library construction module, used to extract entity objects from the data to be analyzed, and configure association relationships between entity objects, so as to construct an analysis object library based on the entity objects and the association relationships;

[0034] An abnormality determination module, used to determine baseline data in the data to be analyzed based on the historical data, and determine abnormal behavior information corresponding to the data to be analyzed using an offline model engine, a batch data processing model, the baseline data, long-period data, and preset abnormal behavior detection rules; wherein the long-period data is data whose time window duration corresponding to the offline model engine is greater than a preset time duration threshold;

[0035] The security alarm module is used to trigger corresponding security alarm operations using the analysis object library, the abnormal behavior information and the real-time model engine.

[0036] In a third aspect, the present application provides an electronic device, including:

[0037] Memory, used to store computer programs;

[0038] The processor is used to execute the computer program to implement the aforementioned abnormal behavior alarm method.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned abnormal behavior alarm method is implemented.

[0040] In this application, the acquired raw data and / or historical data are preprocessed based on preset data preprocessing rules to obtain corresponding data to be analyzed; wherein the raw data is data obtained from a third party, and the historical data is data processed and stored in a preset time period for the raw data; entity objects are extracted from the data to be analyzed, and the association relationship between the entity objects is configured to build an analysis object library based on the entity objects and the association relationship; baseline data is determined in the data to be analyzed based on the historical data, and abnormal behavior information corresponding to the data to be analyzed is determined using an offline model engine, a batch data processing model, the baseline data, long-period data, and preset abnormal behavior detection rules; wherein the long-period data is data whose time window duration corresponding to the offline model engine is greater than a preset duration threshold; the analysis object library, the abnormal behavior information, and the real-time model engine are used to trigger corresponding security alarm operations. As can be seen from the above, this application preprocesses the raw data of a third party and the historical data that has been processed and stored in a preset time period based on preset rules to obtain data to be analyzed. Entity objects are extracted from the data to be analyzed, association relationships are configured, and an analysis object library is built. The baseline data is determined through historical data, and the abnormal behavior information of the data to be analyzed is determined by using the offline model engine, batch processing model, baseline data, long-term data and anomaly detection rules. By analyzing the object library, abnormal behavior information and the real-time model engine, the security alarm operation is triggered. In this way, this application can improve the accuracy of abnormal behavior detection and warn of abnormal behavior to optimize the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0042] Figure 1 A flow chart of an abnormal behavior alarm method disclosed in this application;

[0043] Figure 2 A schematic diagram of a safety alarm generation process disclosed in this application;

[0044] Figure 3 A specific abnormal behavior alarm method flow chart disclosed in this application;

[0045] Figure 4 A schematic diagram of a process for determining an abnormal total score disclosed in the present application;

[0046] Figure 5This is a schematic diagram of the structure of an abnormal behavior alarm device disclosed in this application;

[0047] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Currently, when establishing normal behavior patterns, historical data may be overfitted, resulting in oversensitivity to minor abnormal behaviors, and normal behaviors may be misreported as abnormal behaviors, resulting in unnecessary alarms and interference. In addition, the prior art focuses more on the identification of overall behavior patterns, does not necessarily involve details, and cannot provide more detailed analysis. To this end, the present application provides an abnormal behavior alarm method, device, equipment, and storage medium, which can improve the accuracy of abnormal behavior detection and alarm abnormal behavior.

[0050] See also Figure 1 and Figure 2 As shown, an embodiment of the present invention discloses an abnormal behavior alarm method, including:

[0051] Step S11, preprocessing the acquired original data and / or historical data based on preset data preprocessing rules to obtain corresponding data to be analyzed; wherein the original data is unprocessed data obtained from a third party, and the historical data is data processed from the original data and stored within a preset time period.

[0052] In this embodiment, it should be noted that the original data and / or historical data may include information such as logs, alarms, activity lists, and assets. Specifically, the original data originates from a third-party platform. Such data is in an unprocessed state, has a messy format, contains noise and erroneous information, and cannot be directly used in subsequent analysis processes. The historical data is a collection of information stored according to a preset time period after the original data has been sorted and processed in the past. However, due to the passage of time and changes in business, redundant information will gradually accumulate in historical data, and historical data will have problems such as data aging and feature drift.

[0053] Therefore, in view of the current status of the original data and / or historical data, it is necessary to set data preprocessing rules to perform preprocessing operations on the original data and / or historical data. Among them, the preprocessing operations include but are not limited to data cleaning, data standardization, and data normalization. Specifically, data cleaning can remove erroneous data, supplement missing data, and correct erroneous data, thereby improving the quality and availability of data. Data standardization can reduce the impact of different dimensions or magnitudes on data analysis, making the comparison between different features more reasonable. Data normalization can eliminate the differences in dimensions and value ranges between data, making different indicators comparable. After preprocessing the data, the preprocessed data needs to be stored in a specific DB (i.e., Database) so that the data stored in the database can be used as the source of data, that is, as data to be analyzed.

[0054] Step S12: extracting entity objects from the data to be analyzed, and configuring the association relationships between the entity objects, so as to construct an analysis object library based on the entity objects and the association relationships.

[0055] In this embodiment, the data to be analyzed is first extracted from the above-mentioned database, and the data to be analyzed is filtered according to the preset data filtering rules, that is, the data that does not meet certain conditions is excluded from the data to be analyzed to improve the accuracy and efficiency of the analysis. Then, the entity object and the user object are extracted from the filtered data to be analyzed. It should be noted that each entity object has its own unique entity ID (i.e., Identity), such as a user account, process, IP (i.e., Internet Protocol) address, and domain name can all be used as an entity ID.

[0056] Configure the association between entity objects based on business needs and the data characteristics of the data to be analyzed to complete the relationship configuration operation. It should be noted that the association between entities is very different in different business scenarios, and the characteristics of data are also different in different business scenarios. Therefore, it is necessary to set the corresponding association according to business needs and data characteristics. Among them, the association relationship can include the login relationship between the user account and the system, the connection relationship between the process and the IP address, etc. Finally, the analysis object library is determined using user objects, entity objects, and association relationships, and the analysis object library can provide analysis objects for subsequent abnormal behavior alarm operations.

[0057] Step S13: Determine baseline data in the data to be analyzed based on historical data, and determine abnormal behavior information corresponding to the data to be analyzed using an offline model engine, a batch data processing model, baseline data, long-period data, and preset abnormal behavior detection rules.

[0058] In this embodiment, the baseline data is determined in the data to be analyzed based on the offline model engine, the baseline analysis model and the historical data. Among them, the offline model engine is a data processing and analysis tool that runs in a non-real-time environment and is not limited by the real-time data traffic. That is, the offline model engine can use non-real-time or non-peak hours to perform in-depth analysis on the stored historical data, thereby not affecting the performance of real-time monitoring, detection and response. The historical data is data about the past system operation status, user and entity behavior patterns, and contains a lot of regularity information. Therefore, the baseline data can reflect the data set of system operation, user and entity behavior patterns under normal conditions.

[0059] In addition, it should be emphasized that the long-period data in this embodiment is data whose time window duration corresponding to the offline model engine is greater than the preset time threshold, that is, data covering system operation, user behavior and various operation records over a longer time span in the data to be analyzed. The data time window corresponding to the real-time model can be about 5 minutes, and unlike the time window that the real-time model usually focuses on, the data time window corresponding to the offline model can be one day, and the long-period data can reflect trends and potential long-term abnormal patterns. Therefore, the offline model engine can conduct in-depth mining of such long-period data, complement and verify it with the baseline data, and use tools such as batch data processing models to comprehensively and accurately identify abnormal behavior information hidden in long-term data fluctuations.

[0060] It can be understood that in this embodiment, the abnormal indicators are determined according to the business scenario and data analysis requirements, and the abnormal indicators are configured with corresponding risk scores; wherein the abnormal indicators can be login frequency, access behavior, login location, login time, etc., which can identify and evaluate potential abnormal behaviors. And for the risk score, when the preset abnormal behavior detection rule is triggered, the corresponding user object and entity object will be recorded with the risk score. In addition, it should be emphasized that when analyzing user objects and entity objects, UEBA (i.e., User and Entity BehaviorAnalytics) technology needs to be used. Specifically, this technology can monitor, analyze and evaluate the network behavior of users and entities such as machines, devices, and applications, aiming to identify abnormal behavior patterns and thus discover potential security threats. Moreover, after analyzing the user objects and entity objects, the recorded risk scores can be set accordingly according to the severity of the abnormal behavior.

[0061] Furthermore, a preset abnormal behavior detection rule corresponding to the abnormal indicator is determined based on the preset static detection threshold, the preset dynamic detection threshold, and the configuration information of the associated entity; wherein the associated entity is an entity object associated by an entity ID. It is understandable that by associating entities, the context of abnormal behavior can be captured more comprehensively. For example, associating a user account with its commonly used devices, IP addresses, etc.

[0062] Specifically, for the preset static detection threshold, a fixed threshold can be set for each abnormal indicator based on business experience and security requirements. For example, if the normal login frequency of a company is less than 50 times, then 50 is the preset static detection threshold in this scenario. If the login frequency exceeds 50 times, the corresponding login behavior will be regarded as abnormal behavior.

[0063] The preset dynamic detection threshold can be set according to the real-time changes and statistical distribution of the data. For example, the dynamic detection threshold is set based on the historical login frequency distribution of a certain user. If it is detected that the working time of the user deviates from the normal working time in the past, it is considered an abnormal behavior. If it is detected that the login location of the user deviates from the usual location when logging in in the past, it is also considered an abnormal behavior.

[0064] It should be noted that, in this embodiment, the abnormal behavior information in the data to be analyzed is determined using an offline model engine, a batch data processing model, baseline data, long-period data, and preset abnormal behavior detection rules. It should be noted that the batch data processing model may include a rule model, a statistical model, and an association model. The offline model engine can coordinate and schedule the batch data processing model, and combine the baseline data with the preset abnormal behavior detection rules to drive them to analyze the batch data to be analyzed, and can accurately and comprehensively determine the abnormal behavior information in the data to be analyzed, providing a key basis for subsequent warnings for abnormal behavior information and proper handling of abnormal conditions.

[0065] Step S14: Use the analysis object library, abnormal behavior information and real-time model engine to trigger corresponding security alarm operations.

[0066] In this embodiment, it is first necessary to understand that the security alarm operation may include an alarm strategy and an alarm triggering mechanism. Among them, the alarm strategy may be an alarm combination rule when multiple abnormal indicators are triggered at the same time. For example, if the same user has multiple failed login attempts and abnormal data access behaviors in a short period of time, a high-level alarm will be triggered. The alarm triggering mechanism can be understood as generating a comprehensive alarm when multiple abnormal indicators are triggered at the same time, continuously triggered within a certain time window, or triggered before and after, so as to improve the accuracy and severity assessment of the alarm. It should be noted that the real-time model engine is a tool that can process data in real time, perform model calculations and analysis, and output results in a timely manner, and the real-time model engine uses real-time analysis technology, which is a technology for real-time processing and analysis of data streams, and can process and respond to the generated data immediately after the data is generated.

[0067] After locking the abnormal behavior information, the risk scores of the user object and the entity object are calculated based on the analysis object library, the real-time model engine, the triggering frequency of the current abnormal indicator, the severity of each abnormal behavior, and the total abnormal score to obtain the risk scores of the user object and the entity object. It can be understood that the triggering frequency of the abnormal indicator can intuitively reflect the frequency of abnormal situations. Therefore, in this embodiment, the risk scores of the user object and the entity object are calculated based on the frequency of the abnormal indicator triggering and the severity of each abnormal behavior. The higher the risk score, the more serious the abnormal behavior of the corresponding user object or entity object.

[0068] Further, the corresponding risk level is determined based on the risk score, so as to trigger the corresponding risk control operation based on the risk level. It should be noted that according to the risk score, the user object and the entity object can be divided into different risk levels. For example, the risk level can be low risk, medium risk and high risk. After determining the risk level, the corresponding risk control operation is taken according to the risk level. The risk control strategy includes but is not limited to restricting user behavior, strengthening monitoring, etc.

[0069] As can be seen from the above, this application pre-processes the third-party original data and the historical data that has been processed and stored in a preset time period based on preset rules to obtain the data to be analyzed. Entity objects are extracted from the data to be analyzed, and association relationships are configured to build an analysis object library. The baseline data is determined through historical data, and the abnormal behavior information of the data to be analyzed is determined by using an offline model engine, a batch processing model, baseline data, long-cycle data and anomaly detection rules. By combining the analysis object library, abnormal behavior information and the real-time model engine, a security alarm operation is triggered. In this way, the present application can improve the accuracy of abnormal behavior detection and issue an alarm for abnormal behavior to optimize the user experience.

[0070] See also Figure 3 and Figure 4As shown, in order to determine the value of the above-mentioned abnormal total score corresponding to the abnormal behavior, the embodiment of the present application further provides a specific abnormal behavior alarm method, including:

[0071] Step S21: Count the number of occurrences of each abnormal behavior in the current abnormal behavior information to complete the number counting operation; determine the behavior weight value corresponding to each abnormal behavior based on the target behavior weight coefficient, natural constant and the number of occurrences; wherein the target behavior weight coefficient is an adjustable weight coefficient that decreases exponentially with the score of the abnormal behavior. Determine the corresponding single behavior abnormality score based on the behavior weight value and the aggregate score of each abnormal behavior; wherein the aggregate score is the score calculated according to the preset behavior aggregation calculation formula and the number of occurrences.

[0072] In this embodiment, it should be noted that the behavior weight value is an explosion function that infinitely tends to 1. The calculation formula of the behavior weight value is as follows:

[0073] ;

[0074] In the formula, y is the behavior weight value, e is a natural constant, and , k is the target behavior weight coefficient, and k is an adjustable coefficient, and Ci is the number of occurrences of each abnormal behavior, where i corresponds to each abnormal event, that is, the abnormal behavior corresponding to the abnormal event.

[0075] After determining the behavior weight value, determine the corresponding single behavior anomaly score based on the behavior weight value and the aggregate score of each abnormal behavior. For example, the abnormal behavior can be taken as event A, and the aggregate score of event A is 60, and the number of occurrences corresponding to event A is 3 times. Substituting the upper aggregate score and the number of occurrences of event A into the above-mentioned behavior weight value calculation formula, the behavior weight value of event A can be obtained as 0.77, and the calculation formula of the single behavior anomaly score is: single behavior anomaly score = event aggregate score * behavior weight value. Therefore, substituting the behavior weight value of event A and the upper aggregate score of event A into the calculation formula of the single behavior anomaly score can obtain the single behavior anomaly score of event A = 60*0.77 = 46.61.

[0076] Step S22: Calculate based on the single behavior abnormality score and the preset daily incremental abnormality score calculation formula to obtain the daily incremental abnormality score; calculate based on the daily incremental abnormality score and the time decay index to obtain the total abnormality score of the abnormal behavior.

[0077] The determination of the daily incremental anomaly score can be illustrated by corresponding examples. For example, any three abnormal behaviors are taken as event B, event C, and event D. The single behavior anomaly score of event B, the single behavior anomaly score of event C, and the single behavior anomaly score of event D are set as Xb, Xc, and Xd respectively. Substituting Xb, Xc, and Xd into the preset daily incremental anomaly score calculation formula, the daily incremental anomaly score = Xa + (100-Xa) / 100*Xb + (100-Xb-Xa) / 100*Xc can be obtained.

[0078] After obtaining the daily incremental anomaly score, further, in this embodiment, the total anomaly score corresponding to the abnormal behavior is determined based on the daily incremental anomaly score and the time decay index. It should be noted that the score from 0:00 to the current time is calculated with 1 hour as the time slice. For example, when querying the anomaly score at 8:59, it is necessary to calculate is the score from 0:00 to 8:00; when querying the anomaly score at 9:01, calculate is the score from 0:00 to 9:00. Among them, d4 is Figure 4 Day4 (Toady4) in the monitoring process means that the current day is the fourth day. Indicates a time range.

[0079] As can be seen from the above, the embodiment of the present application first counts the number of abnormal behaviors, calculates the behavior weight value by combining the target behavior weight coefficient and the natural constant, and then determines the abnormal score of a single behavior, fully considering the impact of each abnormal behavior. Then, the preset daily incremental abnormal score calculation formula is used to integrate multiple single abnormal scores to calculate the daily incremental abnormal score, and the time decay index is superimposed to obtain the total abnormal score, taking into account recent and historical abnormal situations, so that the total abnormal score fluctuates reasonably over time. In this way, the total abnormal score can fully reflect the severity of the abnormality, laying a solid foundation for subsequent graded alarms and customized risk control strategies.

[0080] Accordingly, see Figure 5 As shown, the present application provides an abnormal behavior alarm device, comprising:

[0081] The data processing module 11 is used to pre-process the acquired original data and / or historical data based on preset data pre-processing rules to obtain corresponding data to be analyzed; wherein the original data is unprocessed data obtained from a third party, and the historical data is data processed from the original data and stored within a preset time period;

[0082] An object library construction module 12 is used to extract entity objects from the data to be analyzed, and configure association relationships between entity objects to construct an analysis object library based on the entity objects and the association relationships;

[0083] The abnormality determination module 13 is used to determine the baseline data in the data to be analyzed based on the historical data, and determine the abnormal behavior information corresponding to the data to be analyzed by using the offline model engine, the batch data processing model, the baseline data, the long-period data and the preset abnormal behavior detection rules; wherein the long-period data is the data whose time window duration corresponding to the offline model engine is greater than the preset time duration threshold;

[0084] The security alarm module 14 is used to trigger corresponding security alarm operations using the analysis object library, the abnormal behavior information and the real-time model engine.

[0085] As can be seen from the above, this application pre-processes the third-party original data and the historical data that has been processed and stored in a preset time period based on preset rules to obtain the data to be analyzed. Entity objects are extracted from the data to be analyzed, and association relationships are configured to build an analysis object library. The baseline data is determined through historical data, and the abnormal behavior information of the data to be analyzed is determined using an offline model engine, a batch processing model, baseline data, long-cycle data and anomaly detection rules. By combining the analysis object library, abnormal behavior information and the real-time model engine, a security alarm operation is triggered. In this way, the present application can improve the accuracy of abnormal behavior detection and issue an alarm for abnormal behavior to optimize the user experience.

[0086] In a specific implementation, the object library construction module 12 specifically includes:

[0087] An object extraction unit, configured to filter the data to be analyzed according to a preset data filtering rule, and extract entity objects and user objects from the filtered data to be analyzed;

[0088] A relationship configuration unit, configured to configure the association relationship between the entity objects based on business requirements and data characteristics of the data to be analyzed, so as to complete the relationship configuration operation;

[0089] The object library determining unit is used to determine the analysis object library by using the user object, the entity object and the association relationship.

[0090] In a specific implementation, the abnormality determination module 13 specifically includes:

[0091] A data determination unit is used to determine baseline data in the data to be analyzed based on the offline model engine, the baseline analysis model and the historical data.

[0092] In a specific implementation, the abnormality determination module 13 specifically includes:

[0093] A score determination unit, used to determine abnormal indicators according to business scenarios and data analysis requirements, and configure corresponding risk scores for the abnormal indicators;

[0094] A rule determination unit, configured to determine a preset abnormal behavior detection rule corresponding to the abnormal indicator based on a preset static detection threshold, a preset dynamic detection threshold, and configuration information of an associated entity; wherein the associated entity is an entity object associated through entity identity information;

[0095] The information determination unit is used to determine the abnormal behavior information in the data to be analyzed by using the offline model engine, the batch data processing model, the baseline data and the preset abnormal behavior detection rules.

[0096] In a specific implementation, the abnormality determination module 13 further includes:

[0097] A frequency counting unit is used to count the number of occurrences of each abnormal behavior in the current abnormal behavior information to complete the frequency counting operation;

[0098] A weight value determination unit, used to determine the behavior weight value corresponding to each abnormal behavior based on the target behavior weight coefficient, the natural constant and the number of occurrences; wherein the target behavior weight coefficient is an adjustable weight coefficient that decreases exponentially with the score of the abnormal behavior;

[0099] The first score determination unit is used to determine the corresponding single behavior abnormality score based on the behavior weight value and the aggregate score of each abnormal behavior; wherein the aggregate score is a score calculated according to a preset behavior aggregation calculation formula and the number of occurrences.

[0100] In a specific implementation, the object library construction module 13 specifically includes:

[0101] A second score determination unit, configured to calculate based on the single behavior abnormality score and a preset daily incremental abnormality score calculation formula to obtain a daily incremental abnormality score;

[0102] The total score determination unit is used to calculate based on the daily incremental abnormal score and the time decay index to obtain the abnormal total score of the abnormal behavior.

[0103] In a specific implementation, the security warning module 14 specifically includes:

[0104] A score determination unit, configured to calculate based on the analysis object library, the real-time model engine, the trigger frequency of the current abnormal indicator, the severity of each abnormal behavior and the total abnormal score to obtain the risk score of each of the user object and the entity object;

[0105] An operation triggering unit is used to determine a corresponding risk level based on the risk score, so as to trigger a corresponding risk control operation based on the risk level.

[0106] Furthermore, the present application also discloses an electronic device. Figure 6 It is a structural diagram of an electronic device 20 shown according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input and output interface 25 and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the abnormal behavior alarm method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0107] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0108] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0109] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the abnormal behavior alarm method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0110] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the abnormal behavior alarm method disclosed above. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0111] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0112] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0113] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0114] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0115] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An abnormal behavior alarm method, characterized in that: include: Preprocessing the acquired raw data and / or historical data based on preset data preprocessing rules to obtain corresponding data to be analyzed; wherein the raw data is unprocessed data acquired from a third party, and the historical data is data processed from the raw data and stored within a preset time period; Extracting entity objects from the data to be analyzed, and configuring association relationships between the entity objects, so as to construct an analysis object library based on the entity objects and the association relationships; Determine baseline data in the data to be analyzed based on the historical data, and determine abnormal behavior information corresponding to the data to be analyzed using an offline model engine, a batch data processing model, the baseline data, long-period data, and preset abnormal behavior detection rules; wherein the long-period data is data whose time window duration corresponding to the offline model engine is greater than a preset time duration threshold; The analysis object library, the abnormal behavior information and the real-time model engine are used to trigger corresponding security alarm operations.

2. The abnormal behavior alarm method according to claim 1, characterized in that: The extracting entity objects from the data to be analyzed and configuring the association relationships between the entity objects to construct an analysis object library based on the entity objects and the association relationships includes: Filtering the data to be analyzed according to preset data filtering rules, and extracting entity objects and user objects from the filtered data to be analyzed; Configuring the association relationship between the entity objects based on business requirements and data characteristics of the data to be analyzed to complete the relationship configuration operation; An analysis object library is determined using the user object, the entity object, and the association relationship.

3. The abnormal behavior alarm method according to claim 1, characterized in that: The determining of baseline data in the data to be analyzed based on the historical data includes: Baseline data is determined in the data to be analyzed based on the offline model engine, the baseline analysis model and the historical data.

4. The abnormal behavior alarm method according to claim 1, characterized in that: The method of using the offline model engine, the batch data processing model, the baseline data, the long-period data, and the preset abnormal behavior detection rules to determine the abnormal behavior information corresponding to the data to be analyzed includes: Determine abnormal indicators based on business scenarios and data analysis requirements, and configure corresponding risk scores for the abnormal indicators; Determining a preset abnormal behavior detection rule corresponding to the abnormal indicator based on a preset static detection threshold, a preset dynamic detection threshold, and configuration information of an associated entity; wherein the associated entity is an entity object associated through entity identity information; The abnormal behavior information in the data to be analyzed is determined by using an offline model engine, a batch data processing model, the baseline data, the long-period data, and the preset abnormal behavior detection rules.

5. The abnormal behavior alarm method according to any one of claims 1 to 4, characterized in that: The method of using the offline model engine, the batch data processing model, the baseline data, the long-period data and the preset abnormal behavior detection rules to determine the abnormal behavior information corresponding to the data to be analyzed also includes: Count the number of occurrences of each abnormal behavior in the current abnormal behavior information to complete the number counting operation; Determine the behavior weight value corresponding to each abnormal behavior based on the target behavior weight coefficient, the natural constant and the number of occurrences; wherein the target behavior weight coefficient is an adjustable weight coefficient that decreases exponentially with the score of the abnormal behavior; The corresponding single behavior abnormality score is determined based on the behavior weight value and the aggregate score of each abnormal behavior; wherein the aggregate score is a score calculated according to a preset behavior aggregation calculation formula and the number of occurrences.

6. The abnormal behavior alarm method according to claim 5, characterized in that: The determining of a corresponding single behavior abnormality score based on the behavior weight value and the aggregate score of each abnormal behavior further includes: Calculate based on the single behavior abnormality score and the preset daily incremental abnormality score calculation formula to obtain the daily incremental abnormality score; A calculation is performed based on the daily incremental anomaly score and the time decay index to obtain a total anomaly score of the abnormal behavior.

7. The abnormal behavior alarm method according to claim 6, characterized in that: The using of the analysis object library, the abnormal behavior information and the real-time model engine to trigger a corresponding security warning operation includes: Calculate based on the analysis object library, the real-time model engine, the trigger frequency of the current abnormal indicator, the severity of each abnormal behavior and the total abnormal score to obtain the risk score of each of the user object and the entity object; A corresponding risk level is determined based on the risk score, so as to trigger a corresponding risk control operation based on the risk level.

8. An abnormal behavior alarm device, characterized in that: include: A data processing module, used to pre-process the acquired original data and / or historical data based on preset data pre-processing rules to obtain corresponding data to be analyzed; wherein the original data is unprocessed data obtained from a third party, and the historical data is data processed from the original data and stored within a preset time period; An object library construction module, used to extract entity objects from the data to be analyzed, and configure association relationships between entity objects, so as to construct an analysis object library based on the entity objects and the association relationships; An abnormality determination module, used to determine baseline data in the data to be analyzed based on the historical data, and determine abnormal behavior information corresponding to the data to be analyzed using an offline model engine, a batch data processing model, the baseline data, long-period data, and preset abnormal behavior detection rules; wherein the long-period data is data whose time window duration corresponding to the offline model engine is greater than a preset time duration threshold; The security alarm module is used to trigger corresponding security alarm operations using the analysis object library, the abnormal behavior information and the real-time model engine.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the abnormal behavior alarm method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the abnormal behavior alarm method according to any one of claims 1 to 7 is implemented.

Images