Safety scoring system based on user behavior analysis

Abstract

The invention relates to the field of network security, in particular to a security scoring system based on user behavior analysis, and the system comprises a monitoring analysis module which is used for responding to a state judgment condition so as to determine a personnel access state of each platform access personnel, and responding to a personnel analysis condition so as to determine an abnormity analysis strategy of each platform access personnel; the reference analysis module is used for responding to the fluctuation evaluation condition to determine whether the access behavior risk exists in the platform access personnel or not; the correlation analysis module is used for responding to the correlation analysis condition to determine a personnel access analysis mode; the safety evaluation module is used for evaluating the judgment condition to determine a safety evaluation mode; the risk response module is used for responding to the personnel verification condition to determine whether risk verification is carried out on the target evaluation personnel, and the accuracy of the abnormal behavior monitoring result of the platform access personnel is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a security scoring system based on user behavior analysis. Background Art

[0002] Conducting user behavior analysis on platform access users to obtain a security score for user behavior, and then verifying or warning users with abnormal behavior can effectively ensure the security of platform data during the access process. However, existing security scoring systems for user behavior often determine whether a user has abnormal behavior based on whether there is a large difference between the access behavior during the access process and the access behavior recorded in the historical records. However, if the regularity of the access behavior of platform access personnel is poor, the effectiveness of the results on whether there is abnormal behavior is low. Therefore, how to ensure the accuracy of the judgment results on whether there is abnormal behavior when there are differences in the reference ability of access data of platform access personnel in actual scenarios is a problem that needs to be urgently solved by technical personnel in this field.

[0003] Chinese Patent Publication No. CN114238959A discloses a user access behavior assessment method based on a zero-trust security system, which obtains the user's access behavior; performs risk assessment and credit assessment on the user login action set and each action item in the user access action set, and obtains the behavior score corresponding to the action item and the total behavior score of the user's access behavior; screens the user's high-risk behavior according to the total behavior score, a preset user risk threshold and a user trust threshold; and performs restriction operations on the user's high-risk behavior. However, the above scheme has the following problems: it fails to determine a targeted user behavior analysis method based on the reference capability of the access data of the platform access personnel in the actual scenario, resulting in low accuracy of the monitoring results of abnormal user behavior. Summary of the invention

[0004] To this end, the present invention provides a security scoring system based on user behavior analysis to overcome the problem in the prior art that a targeted user behavior analysis method is not determined based on the reference capability of access data of platform access personnel in actual scenarios, resulting in low accuracy of monitoring results for user abnormal behavior.

[0005] To achieve the above object, the present invention provides a safety scoring system based on user behavior analysis, comprising:

[0006] A monitoring and analysis module, which is used to respond to the status determination conditions to determine the personnel access status of each platform access personnel, and respond to the personnel analysis conditions to determine the abnormal analysis strategy of each platform access personnel, the abnormal analysis strategy is to perform data reference analysis or access-related trend analysis on the platform access personnel;

[0007] A reference analysis module, which is connected to the monitoring and analysis module, is used to determine reference access behavior parameters according to the behavioral reference degree of each category of access behavior parameters, and respond to the fluctuation assessment conditions to determine whether the platform access personnel have access behavior risks;

[0008] A related analysis module, which is connected to the monitoring and analysis module, and is used to respond to the related analysis conditions to determine the personnel access analysis method, which is to perform access regularity analysis on each related page set, or to perform access pattern analysis on each platform access page;

[0009] A security assessment module, which is connected to the reference analysis module and the related analysis module respectively, and is used to evaluate the judgment conditions to determine the security assessment method, wherein the security assessment method is to determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference degree of each access behavior parameter or the abnormal access coefficient of each platform access page;

[0010] A risk response module is connected to the security assessment module and is used to respond to personnel verification conditions to determine whether to perform risk verification on the target assessment personnel.

[0011] Further, the monitoring and analysis module responds to the status determination condition to determine the personnel access status of each platform access personnel;

[0012] For single platform access personnel,

[0013] If the status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is greater than the preset access cycle stability coefficient or the access field overlap coefficient is greater than the preset access field overlap coefficient, it is determined that the platform access person is in the first preset access state;

[0014] The status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is less than or equal to the preset access cycle stability coefficient and the access field overlap coefficient is less than or equal to the preset access field overlap coefficient, then it is determined that the platform visitor is in the second preset access state.

[0015] Further, the monitoring and analysis module responds to the personnel analysis conditions to determine the abnormal analysis strategy of the personnel accessing each platform;

[0016] The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a first preset access state, and then it is determined to perform data reference analysis on the platform access person;

[0017] The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a second preset access state, and then it is determined to perform access-related trend analysis on the platform access person.

[0018] Furthermore, the reference analysis module responds to the first analysis condition and determines the reference access behavior parameters according to the behavior reference degree of each category of access behavior parameters;

[0019] If the parameter evaluation condition responded by the reference analysis module is that the behavior reference degree of the access behavior parameter is greater than the preset behavior reference degree, the access behavior parameter is recorded as the reference access behavior parameter;

[0020] The behavior reference degree of each category of access behavior parameters is determined according to the parameter difference coefficient of the access behavior parameters and the reference continuity index, wherein the behavior reference degree is negatively correlated with the parameter difference coefficient, and the behavior reference degree is positively correlated with the reference continuity index;

[0021] The first analysis condition is that the monitoring and analysis module determines to perform data reference analysis on platform access personnel.

[0022] Further, the reference analysis module detects the parameter fluctuation index of each reference access behavior parameter in response to the evaluation judgment condition, and responds to the fluctuation evaluation condition to determine whether the platform access personnel are deemed to have access behavior risks;

[0023] If the fluctuation assessment condition responded by the reference analysis module is that the fluctuation reference ratio is greater than the preset fluctuation reference ratio, it is determined that the platform access personnel have access behavior risks;

[0024] The evaluation and determination conditions are determined by reference to the access behavior parameters of the platform access personnel.

[0025] Furthermore, the correlation analysis module responds to the second analysis condition, performs page association division on the platform access pages of the platform access personnel, and determines the personnel access analysis method according to the percentage of associated pages and the page association coefficient;

[0026] If the percentage of associated pages of the associated analysis condition responded by the associated analysis module is greater than the preset percentage of associated pages or the page association coefficient is greater than the preset page association coefficient, it is determined that the associated analysis module performs access regularity analysis on each associated page set;

[0027] If the correlation analysis condition's correlation analysis condition ratio of the correlation analysis module is less than or equal to the preset correlation page ratio and the page correlation coefficient is less than or equal to the preset page correlation coefficient, it is determined that the correlation analysis module performs access pattern analysis on the access pages of each platform.

[0028] The second analysis condition is that the monitoring and analysis module determines to perform access-related trend analysis on platform access personnel.

[0029] Further, the correlation analysis module responds to the regularity analysis condition, determines the access conflict coefficient according to the access matching coefficient and the forward-looking page matching degree of each platform access page in each associated page set, and records the associated page set whose access conflict coefficient is greater than the preset access conflict coefficient as the access conflict set;

[0030] Determine whether the platform access personnel have access behavior risks based on the proportion of access conflict sets;

[0031] The rule analysis condition is that the relevant analysis module determines to perform access rule analysis on each associated page set.

[0032] Furthermore, the correlation analysis module responds to the pattern analysis condition, determines the risk interaction index of each platform visitor according to the page access coefficient and the page operation coefficient, and determines whether to identify the platform visitor as having access behavior risk according to the risk interaction index;

[0033] The page operation coefficient is determined according to the access frequency difference value and the key access proportion;

[0034] The regularity analysis condition is that the relevant analysis module determines to perform access pattern analysis on access pages of each platform.

[0035] Further, the security assessment module responds to the assessment conditions and determines the security assessment method according to the abnormal analysis strategy of the target access personnel;

[0036] The evaluation judgment condition responded by the security assessment module is to determine whether the target assessment personnel have access risk behavior through data reference analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference of each access behavior parameter;

[0037] The evaluation judgment condition responded by the security assessment module is to determine whether the target assessment personnel have access risk behavior through access-related trend analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the abnormal access coefficient of the access page of each platform;

[0038] The evaluation condition is that there is a target evaluator, and the target evaluator is a platform visitor with access behavior risks.

[0039] Further, the risk response module responds to the personnel verification condition to determine whether to perform risk verification on the target assessment personnel;

[0040] The personnel verification condition responded by the risk response module is that if the personnel safety assessment coefficient of the target assessment personnel is greater than the preset personnel safety assessment coefficient, it is determined to perform risk verification on the target assessment personnel, and the access restriction method is determined according to the verification execution coefficient.

[0041] Compared with the prior art, the beneficial effect of the present invention lies in that the technical scheme of the present invention determines the access status of personnel according to the access cycle stability coefficient and the access field overlap coefficient of each platform access personnel, and determines a targeted abnormal analysis strategy according to the access status of the personnel to determine whether the platform access personnel has access behavior risks, so that the abnormal analysis strategy is more in line with the actual work scenario, avoiding the low accuracy of the abnormal behavior monitoring results of the platform access personnel due to the fact that the past access records of the platform access personnel have no reference value.

[0042] Furthermore, in the present invention, when the platform visitor is in the first preset access state, data reference analysis is performed on the platform visitor. The past access records of such platform visitor have great regularity. The reference access behavior parameters are determined according to the behavior reference degree of each category of access behavior parameters, and the behavior risk of the platform visitor is evaluated based on whether the reference access behavior parameters fluctuate during the current access process, thereby improving the data processing efficiency for abnormal user behavior analysis.

[0043] Furthermore, in the present invention, when the platform visitor is in the second preset access state, an access-related trend analysis is performed on the platform visitor, and the personnel access analysis method is determined according to the proportion of associated pages and the page correlation coefficient. The proportion of associated pages and the page correlation coefficient are used to characterize whether there is any correlation between the pages visited by the platform visitor, and then a targeted personnel access analysis method is determined, which is more in line with the actual work scenario. The present invention improves the accuracy of the abnormal behavior monitoring results of the platform visitor.

[0044] Furthermore, when the correlation of platform access pages is relatively large in the present invention, the access rules of each associated page set are analyzed to see if there is a conflict with the behavior monitoring records, and this is used to determine whether the platform access personnel has access behavior risks. When the page correlation is relatively poor, the efficiency of analyzing the page access rules is relatively poor, and the risk interaction index of each platform access personnel is determined by the page access coefficient and the page operation coefficient, so as to determine whether the platform access personnel is deemed to have access behavior risks. The present invention improves the data processing efficiency for user abnormal behavior analysis while ensuring the accuracy of the abnormal behavior monitoring results for platform access personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A module connection diagram of the security scoring system based on user behavior analysis of the present invention;

[0046] Figure 2 A flow chart of the monitoring and analysis module of the present invention responding to the status determination condition to determine the personnel access status of each platform access personnel;

[0047] Figure 3A flow chart of the monitoring and analysis module of the present invention responding to personnel analysis conditions to determine abnormal analysis strategies for personnel accessing each platform;

[0048] Figure 4 The present invention is a flow chart of determining a personnel access analysis method according to a proportion of associated pages and a page association coefficient. DETAILED DESCRIPTION

[0049] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0050] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0051] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0052] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0053] See also Figures 1 to 4 As shown, the present invention provides a security scoring system based on user behavior analysis, comprising:

[0054] A monitoring and analysis module, which is used to respond to the status determination conditions to determine the personnel access status of each platform access personnel, and respond to the personnel analysis conditions to determine the abnormal analysis strategy of each platform access personnel, the abnormal analysis strategy is to perform data reference analysis or access-related trend analysis on the platform access personnel;

[0055] A reference analysis module, which is connected to the monitoring and analysis module, is used to determine reference access behavior parameters according to the behavioral reference degree of each category of access behavior parameters, and respond to the fluctuation assessment conditions to determine whether the platform access personnel have access behavior risks;

[0056] A related analysis module, which is connected to the monitoring and analysis module, and is used to respond to the related analysis conditions to determine the personnel access analysis method, which is to perform access regularity analysis on each related page set, or to perform access pattern analysis on each platform access page;

[0057] A security assessment module, which is connected to the reference analysis module and the related analysis module respectively, and is used to evaluate the judgment conditions to determine the security assessment method, wherein the security assessment method is to determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference degree of each access behavior parameter or the abnormal access coefficient of each platform access page;

[0058] A risk response module is connected to the security assessment module and is used to respond to personnel verification conditions to determine whether to perform risk verification on the target assessment personnel.

[0059] Among them, the application scenario of the present invention is to monitor the abnormal behavior of users on a network platform. The network platform for monitoring the abnormal behavior of users is recorded as the target monitoring platform, the users for monitoring the abnormal behavior are recorded as platform visitors, and the page of the network platform visited by a platform visitor is recorded as the platform access page of the platform visitor. There is a corresponding domain label phrase in each platform access page, and the user can set the content of the domain label phrase according to the actual work scenario. However, it is worth noting that the domain label phrase needs to reflect the function and main content of the platform access page, which is easy for technicians in this field to understand and will not be elaborated here.

[0060] The present invention applies several behavior monitoring records, and any behavior monitoring record records the number of platform access pages with key field phrases, access field overlap coefficient, behavior reference degree, parameter fluctuation index, fluctuation reference proportion, field label overlap degree, associated page proportion, page association coefficient, access conflict coefficient, access conflict set proportion, risk interaction index, parameter difference degree and personnel safety assessment coefficient during at least one platform access behavior monitoring process for a platform visitor. And each behavior monitoring record corresponds to a qualified mark, and the qualified mark records whether the accuracy of the abnormal behavior monitoring results for the platform visitor meets the user requirements. It can be understood that the user can determine whether the accuracy of the abnormal behavior monitoring results for the platform visitor meets the requirements based on self-set indicators.

[0061] Specifically, the monitoring and analysis module responds to the status determination conditions to determine the personnel access status of each platform access personnel;

[0062] For single platform access personnel,

[0063] If the status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is greater than the preset access cycle stability coefficient or the access field overlap coefficient is greater than the preset access field overlap coefficient, it is determined that the platform access person is in the first preset access state;

[0064] The status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is less than or equal to the preset access cycle stability coefficient and the access field overlap coefficient is less than or equal to the preset access field overlap coefficient, then it is determined that the platform visitor is in the second preset access state.

[0065] Among them, for a single platform visitor, the access cycle stability coefficient n is the number of times the platform visitor visits the target monitoring platform within the status evaluation cycle, ti is the duration of the i-th visit interval within the status evaluation cycle, t0 is the average duration of each visit interval within the status evaluation cycle, the visit interval duration is the interval duration between two consecutive visits to the target monitoring platform by the platform visitor within the status evaluation cycle, the access domain overlap coefficient is the number of key domain phrases contained in each platform access page within the status evaluation cycle, if the number of platform access pages containing a domain label phrase is greater than the preset number of visits, then the domain label phrase is recorded as the key domain phrase, the end time of the status evaluation cycle is the current time, and the duration of the status evaluation cycle is taken as The value can be set by the user according to the actual work scenario, and a value of the duration of the status evaluation cycle is provided. The value of the duration of the status evaluation cycle is 30 days. The value of the preset number of visits can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor, the smaller the value of the preset number of visits. A method for setting the value of the preset number of visits is provided, and the average value of the number of platform visit pages with key field phrases in the behavior monitoring records that meet the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset number of visits;

[0066] The values ​​of the preset access cycle stability coefficient and the preset access field overlap coefficient can be determined by the user according to the actual work scenario. For example, the user can set them according to the behavior monitoring record, and a method for determining the value of the preset access cycle stability coefficient is provided, in which the behavior monitoring record of the platform visitor in the second preset access state is recorded as the state reference record, and the maximum value of the access cycle stability coefficient in the state reference record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset access cycle stability coefficient; a method for determining the value of the preset access field overlap coefficient is provided, in which the maximum value of the access field overlap coefficient in the state reference record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset access field overlap coefficient.

[0067] Specifically, the monitoring and analysis module responds to the personnel analysis conditions to determine the abnormal analysis strategy of the personnel accessing each platform;

[0068] The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a first preset access state, and then it is determined to perform data reference analysis on the platform access person;

[0069] The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a second preset access state, and then it is determined to perform access-related trend analysis on the platform access person.

[0070] Specifically, the reference analysis module responds to the first analysis condition and determines the reference access behavior parameters according to the behavior reference degree of each category of access behavior parameters;

[0071] If the parameter evaluation condition responded by the reference analysis module is that the behavior reference degree of the access behavior parameter is greater than the preset behavior reference degree, the access behavior parameter is recorded as the reference access behavior parameter;

[0072] The behavior reference degree of each category of access behavior parameters is determined according to the parameter difference coefficient of the access behavior parameters and the reference continuity index, wherein the behavior reference degree is negatively correlated with the parameter difference coefficient, and the behavior reference degree is positively correlated with the reference continuity index;

[0073] The first analysis condition is that the monitoring and analysis module determines to perform data reference analysis on platform access personnel.

[0074] Among them, for a single category of access behavior parameters, the behavior reference degree = ln (reference persistence index / parameter difference coefficient), the reference persistence index is the number of visits in which the parameter difference value is less than the preset parameter difference value in the status evaluation cycle, and for a single visit process of a platform visitor, the parameter difference value is the absolute value of the difference between the value of the access behavior parameter at the time of the visit and the average value of the access behavior parameter of the category during each visit to the target monitoring platform during the status evaluation cycle, and the parameter difference coefficient m is the number of times the platform visitor visits the target monitoring platform during the status assessment period, yv is the value of the access behavior parameter of this category during the vth visit to the target monitoring platform during the status assessment period, and y0 is the average value of the access behavior parameter of this category during each visit to the target monitoring platform during the status assessment period;

[0075] The values ​​of the preset parameter difference value and the preset behavior reference degree can be determined by the user according to the actual work scenario. For example, the user can set them according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset parameter difference value and the larger the value of the preset behavior reference degree. A value of the preset parameter difference value is provided, and 5% of the average value of the numerical value of the access behavior parameter during each visit to the target monitoring platform during the status assessment period is recorded as the preset parameter difference value. A method for taking the value of the preset behavior reference degree is provided, and the minimum value of the behavior reference degree in the behavior monitoring record that meets the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset behavior reference degree.

[0076] Specifically, the reference analysis module detects the parameter fluctuation index of each reference access behavior parameter in response to the evaluation judgment condition, and responds to the fluctuation evaluation condition to determine whether the platform access personnel have access behavior risks;

[0077] If the fluctuation assessment condition responded by the reference analysis module is that the fluctuation reference ratio is greater than the preset fluctuation reference ratio, it is determined that the platform access personnel have access behavior risks;

[0078] The evaluation and determination conditions are determined by reference to the access behavior parameters of the platform access personnel.

[0079] Among them, for a single reference access behavior parameter, the parameter fluctuation index = (the absolute value of the difference between the value of the reference access behavior parameter during the current access of the platform access personnel to the target monitoring platform and the average value of the reference access behavior parameter during each access to the target monitoring platform within the status assessment cycle) / the average value of the reference access behavior parameter during each access to the target monitoring platform within the status assessment cycle, the fluctuation reference proportion = the number of fluctuating reference behavior parameters / the number of reference access behavior parameters, the fluctuating reference behavior parameter is a reference access behavior parameter whose parameter fluctuation index is greater than the preset parameter fluctuation index;

[0080] The values ​​of the preset fluctuation reference ratio and the preset parameter fluctuation index can be determined by the user according to the actual working scenario. For example, the user can set them according to the behavior monitoring records. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitors, the smaller the value of the preset fluctuation reference ratio and the smaller the value of the preset parameter fluctuation index. A method for determining the value of the preset parameter fluctuation index is provided, and the minimum value of the parameter fluctuation index of the fluctuation reference behavior parameter in the behavior monitoring records that meet the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitors is recorded as the preset parameter fluctuation index. A value of a preset fluctuation reference ratio is provided, and the behavior monitoring records for data reference analysis of the platform visitors are recorded as reference reference records. The average value of the fluctuation reference ratio of the platform visitors with access behavior risks in the reference reference records that meet the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitors is recorded as the preset fluctuation reference ratio.

[0081] Specifically, the correlation analysis module responds to the second analysis condition, performs page correlation division on the platform access pages of the platform access personnel, and determines the personnel access analysis method according to the correlation page ratio and the page correlation coefficient;

[0082] If the percentage of associated pages of the associated analysis condition responded by the associated analysis module is greater than the preset percentage of associated pages or the page association coefficient is greater than the preset page association coefficient, it is determined that the associated analysis module performs access regularity analysis on each associated page set;

[0083] If the correlation analysis condition's correlation analysis condition ratio of the correlation analysis module is less than or equal to the preset correlation page ratio and the page correlation coefficient is less than or equal to the preset page correlation coefficient, it is determined that the correlation analysis module performs access pattern analysis on the access pages of each platform.

[0084] The second analysis condition is that the monitoring and analysis module determines to perform access-related trend analysis on platform access personnel.

[0085] Among them, when performing access-related trend analysis on a single platform visitor, the page association is divided according to the domain label phrases contained in the access pages of each platform. The domain label overlap of any associated page set is greater than the preset domain label overlap. The domain label phrases in the text content of the access pages of each platform are extracted. For a single associated page set, the domain label overlap = the number of overlapping domain label phrases / the average number of domain label phrases of the access pages of each platform contained in the associated page set. If each platform access page in the associated page set contains a domain label phrase, it is determined that the domain label phrase is the same as the domain label phrase in the text content of the access pages of each platform. The domain label phrase is the overlapping domain label of the associated page set. The value of the preset domain label overlap can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor, the greater the value of the preset domain label overlap. A method for determining the value of the preset domain label overlap is provided. The minimum value of the domain label overlap of the associated page set in the behavior monitoring record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset domain label overlap;

[0086] For a single platform visitor, the associated page ratio = the number of associated visit pages of the platform visitor / the number of platform visit pages of the platform visitor. The associated visitor is a platform visit page that exists in any associated page set. The page association coefficient is the number of associated page sets of the platform visitor. The values ​​of the preset associated page ratio and the preset page association coefficient can be determined by the user according to the actual work scenario. For example, the user can set them according to the behavior monitoring record. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor, the larger the value of the preset associated page ratio and the larger the value of the preset page association coefficient. A method for determining the preset associated page ratio is provided. The behavior monitoring record for access pattern analysis of each platform access page is recorded as an associated reference record. The maximum value of the associated page ratio in the associated reference record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset associated page ratio. A method for determining the preset page association coefficient is provided. The maximum value of the page association coefficient in the associated reference record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset page association coefficient.

[0087] Specifically, the correlation analysis module responds to the regularity analysis condition, detects the access matching coefficient of each associated page set and the prospective page matching degree of each platform access page in each associated page set, determines the access conflict coefficient according to the access matching coefficient and the prospective page matching degree, and records the associated page set whose access conflict coefficient is greater than the preset access conflict coefficient as the access conflict set;

[0088] Determine whether the platform access personnel have access behavior risks based on the proportion of access conflict sets;

[0089] The rule analysis condition is that the relevant analysis module determines to perform access rule analysis on each associated page set.

[0090] Wherein, for a single associated page set, the access conflict coefficient is the product of the access matching coefficient and the reference prospective page matching degree, the access matching coefficient = the number of combined access pages in the combined access set contained in the associated page set / the number of platform access pages in the associated page set, if there are several platform access pages that co-exist in the same access process of the platform access personnel currently performing behavior monitoring to the target monitoring platform, then the set of the several platform access pages is recorded as a combined access set, and the several platform access pages are collectively recorded as a combined access page, the reference prospective page matching degree is the average of the prospective page matching degrees of each platform access page in the associated page set, and for a single platform access page, the prospective page matching degree is the number of times the prospective page of the platform access page is used as the prospective page of the platform access page in the state evaluation cycle;

[0091] The value of the preset access conflict coefficient can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset access conflict coefficient. A method for setting the value of the preset access conflict coefficient is provided, and the behavior monitoring records for the access rule analysis of each associated page set are recorded as the rule reference records, and the average value of the access conflict coefficients of the access conflict set in the rule reference records that meet the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset access conflict coefficient;

[0092] For a single platform access personnel, if the access conflict set ratio is greater than the preset access conflict set ratio, it is determined that the platform access personnel has an access behavior risk, the access conflict set ratio = the number of access conflict sets / the number of associated page sets. The value of the preset access conflict set ratio can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset access conflict set ratio. A method for determining the value of the preset access conflict set ratio is provided, and the minimum value of the access conflict set ratio of the platform access personnel with access behavior risks in the regular reference record that meets the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset access conflict set ratio.

[0093] Specifically, the correlation analysis module responds to the pattern analysis condition, determines the risk interaction index of each platform visitor according to the page access coefficient and the page operation coefficient, and determines whether to identify the platform visitor as having access behavior risk according to the risk interaction index;

[0094] The page operation coefficient is determined according to the access frequency difference value and the key access proportion;

[0095] The regularity analysis condition is that the relevant analysis module determines to perform access pattern analysis on access pages of each platform.

[0096] Among them, for a single platform visitor, the risk interaction value is the product of the page access coefficient and the page operation coefficient. The page access coefficient is the number of times the platform visitor visits the platform access page during the current visit to the target monitoring platform. The page operation coefficient = 1 / (access frequency difference value + key access ratio), the access frequency difference value m is the number of platform access pages visited by the platform visitor during the current visit to the target monitoring platform, fj is the number of visits to the jth platform access page by the platform visitor during the current visit to the target monitoring platform, f0 is the average number of visits to each platform access page by the platform visitor during the current visit to the target monitoring platform, key access proportion = (number of key access pages / number of platform access pages visited by the platform visitor during the current visit to the target monitoring platform) × 100%, and the key access page is a platform access page whose number of visits by the platform visitor during the current visit to the target monitoring platform is greater than the average number of visits by the platform visitor to each platform access page during the current visit to the target monitoring platform;

[0097] For a single platform visitor, if the risk interaction index is greater than the preset risk interaction index, the platform visitor is deemed to have an access behavior risk. The value of the preset risk interaction index can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor, the smaller the value of the preset risk interaction index. A method for setting the value of the preset risk interaction index is provided, and the behavior monitoring records for access pattern analysis of each platform access page are recorded as access reference records. The minimum value of the risk interaction index of the platform visitor with access behavior risk in the access reference records that meet the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset risk interaction index.

[0098] Specifically, the security assessment module responds to the assessment conditions and determines the security assessment method according to the abnormal analysis strategy of the target access personnel;

[0099] The evaluation judgment condition responded by the security assessment module is to determine whether the target assessment personnel have access risk behavior through data reference analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference of each access behavior parameter;

[0100] The evaluation judgment condition responded by the security assessment module is to determine whether the target assessment personnel have access risk behavior through access-related trend analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the abnormal access coefficient of the access page of each platform;

[0101] The evaluation condition is that there is a target evaluator, and the target evaluator is a platform visitor with access behavior risks.

[0102] Among them, it is determined through data reference analysis that the target assessment personnel have access risk behavior, the personnel safety assessment coefficient = ln (the number of differential access parameters × the sum of the parameter difference degrees of each differential access parameter), the differential access parameter is an access behavior parameter whose parameter difference degree is greater than the preset parameter difference degree, for a single category of access behavior parameters, the parameter difference degree = the absolute value of the difference between the access behavior parameter of the category of the target assessment personnel during the current access to the target monitoring platform and the reference behavior parameter of the access behavior parameter of the category / the reference behavior parameter of the access behavior parameter of the category, for a single category of access behavior parameters, the reference behavior parameter is the average value of the access behavior parameter of the category when the target assessment personnel visits the target monitoring platform each time within the status assessment cycle, the categories of access behavior parameters analyzed in the present invention include but are not limited to: access duration, page views, page dwell time and access frequency;

[0103] The value of the preset parameter difference can be determined by the user according to the actual working scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset parameter difference is. A method for determining the value of the preset parameter difference is provided, and the minimum value of the parameter difference of the differential access parameter in the behavior monitoring record that meets the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset parameter difference;

[0104] When it is determined through access-related trend analysis that the target assessment personnel has access risk behavior, the personnel safety assessment coefficient = ln (number of key access pages × number of abnormal access times), and the number of abnormal access times is the sum of the number of times the target assessment personnel visits each key access page during the current visit to the target monitoring platform.

[0105] Specifically, the risk response module responds to the personnel verification condition to determine whether to perform risk verification on the target assessment personnel;

[0106] The personnel verification condition responded by the risk response module is that if the personnel safety assessment coefficient of the target assessment personnel is greater than the preset personnel safety assessment coefficient, it is determined that risk verification is to be performed on the target assessment personnel.

[0107] Among them, the value of the preset personnel safety assessment coefficient can be determined by the user according to the actual working scenario. For example, the user can set it according to the behavior monitoring records. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset personnel safety assessment coefficient. A method for determining the value of the preset personnel safety assessment coefficient is provided, and the minimum value of the personnel safety assessment coefficient of the target assessment personnel for risk verification in the behavior monitoring records that meet the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset personnel safety assessment coefficient; if the personnel safety assessment coefficient of the target assessment personnel is greater than the preset personnel safety assessment coefficient, risk verification is performed on the target assessment personnel, and the user can determine the risk verification method according to the personnel safety assessment coefficient. The risk verification methods in the present invention include but are not limited to: SMS verification code, email authentication, and face recognition. How to perform risk verification is easy for technicians in this field to understand and will not be elaborated here.

[0108] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0109] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security scoring system based on user behavior analysis, characterized in that: include: A monitoring and analysis module, which is used to respond to the status determination conditions to determine the personnel access status of each platform access personnel, and respond to the personnel analysis conditions to determine the abnormal analysis strategy of each platform access personnel, the abnormal analysis strategy is to perform data reference analysis or access-related trend analysis on the platform access personnel; A reference analysis module, which is connected to the monitoring and analysis module, is used to determine reference access behavior parameters according to the behavioral reference degree of each category of access behavior parameters, and respond to the fluctuation assessment conditions to determine whether the platform access personnel have access behavior risks; A related analysis module, which is connected to the monitoring and analysis module, and is used to respond to the related analysis conditions to determine the personnel access analysis method, which is to perform access regularity analysis on each related page set, or to perform access pattern analysis on each platform access page; A security assessment module, which is connected to the reference analysis module and the related analysis module respectively, and is used to evaluate the judgment conditions to determine the security assessment method, wherein the security assessment method is to determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference degree of each access behavior parameter or the abnormal access coefficient of each platform access page; A risk response module is connected to the security assessment module and is used to respond to personnel verification conditions to determine whether to perform risk verification on the target assessment personnel.

2. The security scoring system based on user behavior analysis according to claim 1 is characterized in that: The monitoring and analysis module responds to the status determination condition to determine the personnel access status of each platform access personnel; For single platform access personnel, If the status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is greater than the preset access cycle stability coefficient or the access field overlap coefficient is greater than the preset access field overlap coefficient, it is determined that the platform access person is in the first preset access state; The status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is less than or equal to the preset access cycle stability coefficient and the access field overlap coefficient is less than or equal to the preset access field overlap coefficient, then it is determined that the platform visitor is in the second preset access state.

3. The security scoring system based on user behavior analysis according to claim 2 is characterized in that: The monitoring and analysis module responds to the personnel analysis conditions to determine the abnormal analysis strategy of the personnel accessing each platform; The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a first preset access state, and then it is determined to perform data reference analysis on the platform access person; The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a second preset access state, and then it is determined to perform access-related trend analysis on the platform access person.

4. The security scoring system based on user behavior analysis according to claim 3 is characterized in that: The reference analysis module responds to the first analysis condition and determines the reference access behavior parameters according to the behavior reference degree of each category of access behavior parameters; If the parameter evaluation condition responded by the reference analysis module is that the behavior reference degree of the access behavior parameter is greater than the preset behavior reference degree, the access behavior parameter is recorded as the reference access behavior parameter; The behavior reference degree of each category of access behavior parameters is determined according to the parameter difference coefficient of the access behavior parameters and the reference continuity index, wherein the behavior reference degree is negatively correlated with the parameter difference coefficient, and the behavior reference degree is positively correlated with the reference continuity index; The first analysis condition is that the monitoring and analysis module determines to perform data reference analysis on platform access personnel.

5. The security scoring system based on user behavior analysis according to claim 4 is characterized in that: The reference analysis module detects the parameter fluctuation index of each reference access behavior parameter in response to the evaluation judgment condition, and responds to the fluctuation evaluation condition to determine whether the platform access person has an access behavior risk; If the fluctuation assessment condition responded by the reference analysis module is that the fluctuation reference ratio is greater than the preset fluctuation reference ratio, it is determined that the platform access personnel have access behavior risks; The evaluation and determination conditions are determined by reference to the access behavior parameters of the platform access personnel.

6. The security scoring system based on user behavior analysis according to claim 5 is characterized in that: The correlation analysis module responds to the second analysis condition, performs page association division on the platform access pages of the platform access personnel, and determines the personnel access analysis method according to the percentage of associated pages and the page association coefficient; If the percentage of associated pages of the associated analysis condition responded by the associated analysis module is greater than the preset percentage of associated pages or the page association coefficient is greater than the preset page association coefficient, it is determined that the associated analysis module performs access regularity analysis on each associated page set; If the correlation analysis condition's correlation analysis condition ratio of the correlation analysis module is less than or equal to the preset correlation page ratio and the page correlation coefficient is less than or equal to the preset page correlation coefficient, it is determined that the correlation analysis module performs access pattern analysis on the access pages of each platform. The second analysis condition is that the monitoring and analysis module determines to perform access-related trend analysis on platform access personnel.

7. The security scoring system based on user behavior analysis according to claim 6 is characterized in that: The correlation analysis module responds to the regularity analysis condition, determines the access conflict coefficient according to the access matching coefficient of each associated page set and the prospective page matching degree of each platform access page in each associated page set, and records the associated page set whose access conflict coefficient is greater than the preset access conflict coefficient as the access conflict set; Determine whether the platform access personnel have access behavior risks based on the proportion of access conflict sets; The rule analysis condition is that the relevant analysis module determines to perform access rule analysis on each associated page set.

8. The security scoring system based on user behavior analysis according to claim 7 is characterized in that: The correlation analysis module responds to the pattern analysis condition, determines the risk interaction index of each platform visitor according to the page access coefficient and the page operation coefficient, and determines whether to identify the platform visitor as having access behavior risk according to the risk interaction index; The page operation coefficient is determined according to the access frequency difference value and the key access proportion; The regularity analysis condition is that the relevant analysis module determines to perform access pattern analysis on access pages of each platform.

9. The security scoring system based on user behavior analysis according to claim 8 is characterized in that: The security assessment module responds to the assessment conditions and determines the security assessment method according to the abnormal analysis strategy of the target access personnel; The evaluation judgment condition responded by the security assessment module is to determine whether the target assessment personnel have access risk behavior through data reference analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference of each access behavior parameter; The evaluation judgment condition responded by the security assessment module is to determine whether the target assessment personnel have access risk behavior through access-related trend analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the abnormal access coefficient of the access page of each platform; The evaluation condition is that there is a target evaluator, and the target evaluator is a platform visitor with access behavior risks.

10. The security scoring system based on user behavior analysis according to claim 9 is characterized in that: The risk response module responds to the personnel verification condition to determine whether to perform risk verification on the target assessment personnel; The personnel verification condition responded by the risk response module is that if the personnel safety assessment coefficient of the target assessment personnel is greater than the preset personnel safety assessment coefficient, it is determined to perform risk verification on the target assessment personnel, and the access restriction method is determined according to the verification execution coefficient.

Images