Risk assessment method and device for user behaviors and storage medium

Abstract

The invention discloses a risk assessment method and device for user behaviors and a storage medium. The method comprises the steps of obtaining behavior data of a to-be-analyzed object; under the condition that the behavior data deviates from a behavior baseline, multiple behavior characteristics corresponding to the behavior data are determined, and the behavior baseline refers to a reference value of the behavior data corresponding to the non-risk behavior; inputting the plurality of behavior characteristics into a risk scoring model, the risk scoring model being constructed by analyzing historical behavior data of different objects; the risk scoring model determines a first risk score corresponding to each behavior feature according to each influence weight; the risk scoring model sums all the first risk scores to obtain a second risk score corresponding to the to-be-analyzed object; the risk scoring model outputs a risk level corresponding to the second risk score; and determining whether alarm information is generated according to the risk level. According to the scheme, the problem can be misreported, and the safety auditing efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device and storage medium for risk assessment of user behavior. Background Art

[0002] As cyber attacks become more and more diverse, enterprises are facing increasingly complex cybersecurity challenges. Although traditional security defense measures have protected the information security of enterprises to a certain extent, they seem powerless in the face of persistent threats and risky behaviors of insiders. In response to the challenge, user and entity behavior analysis (UEBA) technology has emerged as an emerging security technology. By analyzing the normal behavior patterns of users and identifying abnormal activities, UEBA can provide an additional layer of protection for enterprises when potential security incidents occur at an early stage. However, the existing detection technology that relies solely on UEBA fixed rule sets still has certain limitations. Due to the lack of contextual understanding and deep learning capabilities, when the user's behavior pattern changes, the UEBA system will generate a high false alarm rate, resulting in an increased workload for administrators. At the same time, the system takes a long time to reapply new situations, and new security issues may also arise during this period. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a method, device and storage medium for risk assessment of user behavior, so as to solve the technical problem of false positives in user behavior assessment in the prior art.

[0004] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a risk assessment method for user behavior, the method comprising:

[0005] Obtaining behavioral data of the object to be analyzed;

[0006] In the case where the behavior data deviates from the behavior baseline, determining multiple behavior features corresponding to the behavior data, the behavior baseline being a reference value of the behavior data corresponding to the non-risk behavior;

[0007] Inputting multiple behavioral features into a risk scoring model, wherein the risk scoring model is constructed by analyzing historical behavioral data of different objects;

[0008] The risk scoring model determines a first risk score corresponding to each behavior feature according to each impact weight;

[0009] The risk scoring model sums all first risk scores to obtain a second risk score corresponding to the object to be analyzed;

[0010] The risk scoring model outputs a risk level corresponding to the second risk score;

[0011] Determine whether to generate an alarm message based on the risk level.

[0012] In an embodiment of the present application, the risk scoring model sums all first risk scores to obtain a second risk score corresponding to the object to be analyzed, including: the risk scoring model determines the time decay degree of multiple behavioral characteristics; determines the time decay factor according to the time decay degree; the risk scoring model sums all first risk scores to obtain a summed result; and determines the second risk score corresponding to the object to be analyzed according to the summed result and the time decay factor.

[0013] In an embodiment of the present application, the method also includes: obtaining historical behavior data of multiple objects; analyzing the historical behavior data to obtain risk factors; and constructing a risk scoring model based on the risk factors, wherein the risk scoring model is provided with an influence weight of the risk factor on each behavior feature.

[0014] In an embodiment of the present application, the risk factors include at least one of abnormal login location, abnormal access time, abnormal access frequency, and historical alarm behavior.

[0015] In an embodiment of the present application, the behavior characteristics include at least one of login time, login method, login frequency, operation time, access system, and execution operation.

[0016] In an embodiment of the present application, when the behavior data deviates from the behavior baseline, determining multiple behavior features corresponding to the behavior data includes: determining the degree of deviation of the behavior data based on the behavior baseline; when the degree of deviation is greater than a preset threshold, analyzing the behavior data to extract multiple behavior features of the behavior data.

[0017] In an embodiment of the present application, the method also includes: obtaining feedback data from experts regarding risk levels; determining a comparison result between the feedback data and the risk level; and updating the impact weight corresponding to each behavioral feature in the risk scoring model and / or updating the baseline value of the behavioral baseline based on the comparison result.

[0018] A second aspect of the present application provides a risk assessment device for user behavior, comprising:

[0019] a memory configured to store instructions;

[0020] The processor is configured to call instructions from the memory and implement the risk assessment method for user behavior according to the above when executing the instructions.

[0021] A third aspect of the present application provides a machine-readable storage medium having instructions stored thereon, the instructions being used to enable a machine to execute the above-mentioned risk assessment method for user behavior.

[0022] A fourth aspect of the present application provides a computer program product, which implements the above-mentioned risk assessment method for user behavior when executed by a processor.

[0023] Through the above technical solution, a risk assessment mechanism is introduced and a dynamic scoring mechanism is implemented to more accurately identify real abnormal behaviors, thereby dealing with false alarms caused by certain sudden changes in normal behaviors and helping to improve the work efficiency of system security team members.

[0024] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0026] Figure 1 A schematic diagram of a process flow of a method for risk assessment of user behavior according to an embodiment of the present application is schematically shown;

[0027] Figure 2 A schematic diagram of a process flow of a method for risk assessment of user behavior according to a specific embodiment of the present application is shown;

[0028] Figure 3 A structural block diagram of a device for risk assessment of user behavior according to an embodiment of the present application is schematically shown;

[0029] Figure 4 A structural block diagram of a risk assessment system for user behavior according to an embodiment of the present application is schematically shown;

[0030] Figure 5 The schematic diagram shows a structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0032] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components in a certain specific posture. If the specific posture changes, the directional indication will also change accordingly.

[0033] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0034] Figure 1 The following schematically shows a flow chart of a method for risk assessment of user behavior according to an embodiment of the present application. Figure 1 As shown, an embodiment of the present application provides a risk assessment method for user behavior, which may include the following steps.

[0035] S102, obtaining behavior data of the object to be analyzed.

[0036] It is understood that the objects to be analyzed refer to users and entities. The behavior data includes network logs of the behaviors of users and entities, user operation activity logs, etc. The processor can collect the behavior data of users and entities from multiple different data sources.

[0037] S104, when the behavior data deviates from the behavior baseline, determining a plurality of behavior features corresponding to the behavior data, where the behavior baseline refers to a reference value of the behavior data corresponding to the non-risky behavior.

[0038] It can be understood that a behavioral baseline refers to a typical behavior pattern exhibited by an individual or group under normal circumstances in a specific environment. In an embodiment of the present application, a behavioral baseline refers to a baseline value of behavioral data corresponding to non-risky behaviors. If the behavioral data of a user and an entity deviates from the behavioral baseline, it can be preliminarily considered that the behavioral data may contain abnormal risky behaviors. Then, the behavioral characteristics corresponding to the behavioral data can be further determined. In an embodiment of the present application, the behavioral characteristics include at least one of login time, login method, login frequency, operation time, access system, and execution of operations.

[0039] S106, inputting the plurality of behavior features into a risk scoring model, wherein the risk scoring model is constructed by analyzing historical behavior data of different objects.

[0040] S108: The risk scoring model determines a first risk score corresponding to each behavior feature according to each impact weight.

[0041] S110: The risk scoring model sums all first risk scores to obtain a second risk score corresponding to the object to be analyzed.

[0042] S112: The risk scoring model outputs a risk level corresponding to the second risk score.

[0043] S114: Determine whether to generate warning information according to the risk level.

[0044] It can be understood that for the construction of the risk scoring model, the historical behavior data of different users and entities can be obtained, and the behavior characteristics of users and entities can be scored according to the behavior patterns and risk factors of users and entities. Among them, different behavior characteristics bring different risk consequences, so different impact weights can be set for different behavior characteristics to calculate the first risk score corresponding to each behavior characteristic. All first risk scores are summed to obtain the second risk score corresponding to the object to be analyzed, and the risk scoring model outputs the risk level corresponding to the second risk score. The risk scores of different risk levels are set according to the experience of the technicians, and an alarm message is generated when the risk level exceeds the warning level.

[0045] Through the above technical solution, a risk assessment mechanism is introduced and a dynamic scoring mechanism is implemented to more accurately identify real abnormal behaviors, thereby dealing with false alarms caused by certain sudden changes in normal behaviors and helping to improve the work efficiency of system security team members.

[0046] In an embodiment of the present application, the risk scoring model sums all first risk scores to obtain a second risk score corresponding to the object to be analyzed, including: the risk scoring model determines the time decay degree of multiple behavioral characteristics; determines the time decay factor according to the time decay degree; the risk scoring model sums all first risk scores to obtain a summed result; and determines the second risk score corresponding to the object to be analyzed according to the summed result and the time decay factor.

[0047] It can be understood that the degree of time decay refers to the degree to which the behavioral characteristics reduce their impact on risk assessment over time. The time decay factor is a numerical value that characterizes the degree of time decay. The time decay factor can be calculated using linear decay, exponential decay, or logarithmic decay. The time decay factor of each behavioral characteristic is calculated based on the current time, the time when the behavioral data is generated, and the degree of time decay of each behavioral characteristic. After the risk scoring model sums up all the first risk scores to obtain the sum result, the sum of the time decay factors of all behavioral characteristics is calculated, and the second risk score corresponding to the object to be analyzed is determined based on the sum result and the sum of all time decay factors. Considering the risk assessment results after the attenuation of the impact of the time dimension on different behavioral characteristics can improve the accuracy of risk assessment.

[0048] In an embodiment of the present application, the method also includes: obtaining historical behavior data of multiple objects; analyzing the historical behavior data to obtain risk factors; and constructing a risk scoring model based on the risk factors, wherein the risk scoring model is provided with an influence weight of the risk factor on each behavior feature.

[0049] It can be understood that for historical behavior data, analysis can be performed based on the impact caused by different behaviors to derive risk factors. Specifically, risk factors include at least one of abnormal login locations, abnormal access times, abnormal access frequencies, and historical alarm behaviors. Among them, abnormal login locations, abnormal access times, abnormal access frequencies, and historical alarm behaviors can all be determined based on the frequency of occurrence of data corresponding to different behaviors in historical behavior data. For example, if an employee logs in to the company 20 times in a month, then login locations other than the company can be considered abnormal login locations. The risk scoring model is set with the impact weight of risk factors on each behavior feature. Specifically, for behavior features with a high degree of correlation with risk factors, a higher impact weight can be set, and for behavior features with a low degree of correlation with risk factors, a lower impact weight can be set. For example, if the login behavior has a high degree of correlation with the abnormal login location, a higher impact weight can be set for the login behavior.

[0050] In a specific embodiment, the second risk score is calculated according to the following formula (1):

[0051] S=ΣiA i +∑t i

[0052] Among them, S refers to the second risk score, i refers to the i-th behavior feature, and A i refers to the influence weight corresponding to the i-th behavior feature, t i It refers to the time decay factor corresponding to the i-th behavior feature.

[0053] In an embodiment of the present application, when the behavior data deviates from the behavior baseline, determining multiple behavior features corresponding to the behavior data includes: determining the degree of deviation of the behavior data based on the behavior baseline; when the degree of deviation is greater than a preset threshold, analyzing the behavior data to extract multiple behavior features of the behavior data.

[0054] It can be understood that the behavioral baseline of users and entities can be determined through UEBA (User and Entity Behavior Analytics). UEBA (User and Entity Behavior Analytics) is a network security technology that is mainly used to detect abnormal behaviors of users and entities in the network and identify potential security threats through machine learning algorithms. UEBA establishes a behavioral baseline for users and entities by collecting and analyzing a large amount of data, and then monitors their behavioral deviations in real time to determine normal or abnormal behavior. When the behavioral data deviates from the behavioral baseline, the degree of deviation of the behavioral data from the behavioral baseline is determined. If the degree of deviation is greater than the preset threshold, the behavioral data is further analyzed to extract multiple behavioral features of the behavioral data for analysis, and the risk level of the behavioral data of the object to be analyzed is evaluated through the risk scoring model.

[0055] In an embodiment of the present application, the method also includes: obtaining feedback data from experts regarding risk levels; determining a comparison result between the feedback data and the risk level; and updating the impact weight corresponding to each behavioral feature in the risk scoring model and / or updating the baseline value of the behavioral baseline based on the comparison result.

[0056] It is understandable that technical experts can score or correct based on the derived risk level, determine the comparison results of the feedback data and the risk level, and update the impact weight corresponding to each behavioral feature in the risk scoring model and / or update the baseline value of the behavioral baseline based on the comparison results. Through this continuous learning and adaptation to normal behavioral changes of users and entities, the phenomenon of false alarms can be reduced.

[0057] Figure 2 The following schematically shows a flow chart of a method for risk assessment of user behavior according to an embodiment of the present application. Figure 2 As shown, in the embodiment of the present application, the method can be applied to data security audit scenarios, such as large enterprises with a large number of employees and sensitive systems. The enterprise needs an effective way to monitor and evaluate the behavior of these employees to ensure data security. The specific process is as follows:

[0058] 1. Data source integration: Before the system starts, it is necessary to collect behavioral data about users and entities (such as user accounts, devices, applications, etc.). Behavioral data includes login time, access IP, physical location, accessed applications and data, whether it is a sensitive system, performed operations, operation results, etc.

[0059] 2. Baseline establishment: The system uses machine learning algorithms to analyze this data, set subjects and objects according to the scenario, and select related features to establish a normal behavior baseline for each user and entity. For example, an employee usually goes to work around 9 a.m. on a weekday, connects to the company network, checks emails, and uses internal company communication tools. His login location is usually in the company's office.

[0060] 3. Real-time monitoring of user and entity behavior analysis: Once the behavior baseline is established, the system will continuously monitor the employee's behavior data in the company, compare it with the established baseline, and calculate the degree of deviation. For example, if an employee goes to work at around 10 o'clock on a weekday, the system will detect the degree of deviation of these characteristics. If the degree of deviation of the login time is within the preset range, no alarm will be issued. If an employee logs in to the VPN at home at 9 o'clock on the weekend, due to the large deviation of the login location, it will flow to the next step for further judgment.

[0061] 4. Statistical analysis and risk score calculation: Conduct in-depth statistical analysis on the data collected from users to obtain multiple characteristics such as the user's login time, login method, login frequency, operation time, access system, execution operation, and alarm within a recent period of time. The behavioral characteristics are input into the risk scoring model. The model will calculate the risk score based on the degree of deviation of user and entity behavior based on these behavioral characteristics and the influence weights of risk factors. If an employee accesses a non-sensitive system at home at 9 o'clock on the weekend, the model will conclude that the risk is low, and this operation caused by a change in operating habits is judged not to be a threat. If a sensitive system is accessed, the risk derived by the model is high, and it will be judged as a threat, thus generating an alarm.

[0062] 5. Real-time alarm handling: When the risk level exceeds the preset level, the system will trigger a real-time alarm and send relevant information to the security team for handling.

[0063] 6. Adaptive learning and baseline and scoring model adjustment: The system will update the employee's behavioral baseline and risk scoring model based on the results of this incident, and learn from it to improve future security threat detection. For example, in this incident, the system updated the employee's behavioral model, trying to consider weekends and non-company work locations as potential reasonable factors. At the same time, the weight of the office location is automatically adjusted and the scoring model is updated. The system will also continue to learn and adapt to normal behavioral changes of employees to reduce false positives.

[0064] Through the above technical solutions, by introducing machine learning and dynamic risk scoring mechanisms, the risk scoring model can be quickly adjusted according to changes in user behavior, and combined with baseline analysis, the accuracy of behavior detection can be improved. Implementing a dynamic scoring mechanism can reduce users' abnormal but reasonable behavior caused by sudden baseline deviations due to various reasons, reduce false alarms, and help improve the work efficiency of system security team members. Continuously monitoring and adjusting baselines and scoring mechanisms, quickly identifying potential risks and abnormal activities, can more effectively identify and respond to potential security threats and reduce false alarm rates.

[0065] Figure 1 FIG. 1 is a flow chart of a method for risk assessment of user behavior in one embodiment. It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0066] Figure 3 The structure block diagram of a device for risk assessment of user behavior according to an embodiment of the present application is schematically shown. Figure 3 As shown, an embodiment of the present application provides a risk assessment device for user behavior, which may include:

[0067] a memory configured to store instructions;

[0068] The processor is configured to call instructions from the memory and implement the above-mentioned risk assessment method for user behavior when executing the instructions.

[0069] Specifically, in the embodiment of the present application, the processor may be configured to:

[0070] Obtaining behavioral data of the object to be analyzed;

[0071] In the case where the behavior data deviates from the behavior baseline, determining multiple behavior features corresponding to the behavior data, the behavior baseline being a reference value of the behavior data corresponding to the non-risk behavior;

[0072] Inputting multiple behavioral features into a risk scoring model, wherein the risk scoring model is constructed by analyzing historical behavioral data of different objects;

[0073] The risk scoring model determines a first risk score corresponding to each behavior feature according to each impact weight;

[0074] The risk scoring model sums all first risk scores to obtain a second risk score corresponding to the object to be analyzed;

[0075] The risk scoring model outputs a risk level corresponding to the second risk score;

[0076] Determine whether to generate an alarm message based on the risk level.

[0077] In an embodiment of the present application, the processor may also be configured to:

[0078] The risk scoring model sums up all the first risk scores to obtain a second risk score corresponding to the object to be analyzed, including: the risk scoring model determines the time decay degree of multiple behavioral characteristics; determines the time decay factor according to the time decay degree; the risk scoring model sums up all the first risk scores to obtain a sum result; and determines the second risk score corresponding to the object to be analyzed according to the sum result and the time decay factor.

[0079] In an embodiment of the present application, the processor may also be configured to:

[0080] Acquire historical behavior data of multiple objects; analyze the historical behavior data to obtain risk factors; and construct a risk scoring model based on the risk factors, wherein the risk scoring model is provided with an influence weight of the risk factor on each behavior feature.

[0081] In an embodiment of the present application, the risk factors include at least one of abnormal login location, abnormal access time, abnormal access frequency, and historical alarm behavior.

[0082] In an embodiment of the present application, the behavior characteristics include at least one of login time, login method, login frequency, operation time, access system, and execution operation.

[0083] In an embodiment of the present application, the processor may also be configured to:

[0084] When the behavior data deviates from the behavior baseline, determining multiple behavior features corresponding to the behavior data includes: determining the degree of deviation of the behavior data according to the behavior baseline; when the degree of deviation is greater than a preset threshold, analyzing the behavior data to extract multiple behavior features of the behavior data.

[0085] In an embodiment of the present application, the processor may also be configured to:

[0086] Obtain expert feedback data on risk levels; determine the comparison results between the feedback data and the risk levels; and update the impact weights corresponding to each behavioral feature in the risk scoring model and / or update the benchmark value of the behavioral baseline based on the comparison results.

[0087] The present application also provides a risk assessment system for user behavior, which may include:

[0088] Data collection module (1): Data source integration, collecting historical behavior data of users and entities.

[0089] UEBA behavior baseline analysis module (2): establishes a behavior baseline and analyzes behavior data.

[0090] Real-time monitoring module (3): monitors the behavior data of users and entities.

[0091] Risk score calculation module (4): calculates the risk score.

[0092] Alert generation module (5): generates an alert when the risk score is judged to be a security threat

[0093] Dynamic adjustment module (6): When the risk score is judged not to be a security threat, feedback is provided to adjust the behavior baseline and risk score algorithm.

[0094] An embodiment of the present application also provides a machine-readable storage medium having instructions stored thereon, the instructions being used to enable a machine to execute the above-mentioned risk assessment method for user behavior.

[0095] An embodiment of the present application also provides a computer program product, which implements the above-mentioned risk assessment method for user behavior when executed by a processor.

[0096] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected via a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database of the computer device is used to store risk assessment data for user behavior. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program B02 is executed by the processor A01, a risk assessment method for user behavior is implemented.

[0097] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0098] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0099] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0100] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0101] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0102] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0103] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0104] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0105] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0106] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A risk assessment method for user behavior, characterized in that: The method comprises: Obtaining behavioral data of the object to be analyzed; In the case where the behavior data deviates from a behavior baseline, determining a plurality of behavior features corresponding to the behavior data, wherein the behavior baseline refers to a reference value of the behavior data corresponding to the non-risk behavior; Inputting the plurality of behavioral features into a risk scoring model, wherein the risk scoring model is constructed by analyzing historical behavioral data of different objects; The risk scoring model determines a first risk score corresponding to each behavior feature according to each impact weight; The risk scoring model sums all first risk scores to obtain a second risk score corresponding to the object to be analyzed; The risk scoring model outputs a risk level corresponding to the second risk score; Determine whether to generate warning information according to the risk level.

2. The risk assessment method for user behavior according to claim 1, characterized in that: The risk scoring model sums up all the first risk scores to obtain a second risk score corresponding to the object to be analyzed, including: The risk scoring model determines the time decay degree of the plurality of behavioral features; Determining a time decay factor according to the time decay degree; The risk scoring model sums all first risk scores to obtain a sum result; A second risk score corresponding to the object to be analyzed is determined according to the summation result and the time decay factor.

3. The risk assessment method for user behavior according to claim 1, characterized in that: The method further comprises: Get historical behavior data of multiple objects; Analyze the historical behavior data to obtain risk factors; The risk scoring model is constructed according to the risk factors, wherein the risk scoring model is provided with an influence weight of the risk factors on each behavior feature.

4. The risk assessment method for user behavior according to claim 3, characterized in that: The risk factors include at least one of abnormal login location, abnormal access time, abnormal access frequency, and historical alarm behavior.

5. The method for risk assessment of user behavior according to claim 1, characterized in that: The behavior characteristics include at least one of login time, login method, login frequency, operation time, access system, and execution operation.

6. The risk assessment method for user behavior according to claim 1, characterized in that: In the case where the behavior data deviates from the behavior baseline, determining a plurality of behavior features corresponding to the behavior data includes: determining a degree of deviation of the behavioral data according to the behavioral baseline; When the degree of deviation is greater than a preset threshold, the behavior data is analyzed to extract a plurality of behavior features of the behavior data.

7. The method for risk assessment of user behavior according to claim 1, characterized in that: The method further comprises: Obtaining expert feedback data on the risk level; Determining a comparison result between the feedback data and the risk level; The influence weight corresponding to each behavior feature in the risk scoring model is updated according to the comparison result and / or the reference value of the behavior baseline is updated.

8. A risk assessment device for user behavior, characterized in that: include: a memory configured to store instructions; A processor is configured to call the instructions from the memory and implement the risk assessment method for user behavior according to any one of claims 1 to 7 when executing the instructions.

9. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions for causing a machine to execute the risk assessment method for user behavior according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program is executed by a processor, the computer program implements the risk assessment method for user behavior according to any one of claims 1 to 7.

Images