Security scoring system based on user behavior analysis

Abstract

The present invention relates to the field of network security, and in particular to a security scoring system based on user behavior analysis, comprising: a monitoring and analysis module for responding to a status determination condition to determine the personnel access status of each platform access personnel, and responding to a personnel analysis condition to determine the abnormal analysis strategy of each platform access personnel; a reference analysis module for responding to a fluctuation assessment condition to determine whether the platform access personnel are deemed to have access behavior risks; a correlation analysis module for responding to an association analysis condition to determine a personnel access analysis method; a security assessment module for evaluating the determination condition to determine the security assessment method; and a risk response module for responding to a personnel verification condition to determine whether risk verification is performed on the target assessment personnel. The present invention improves the accuracy of abnormal behavior monitoring results for platform access personnel.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a security scoring system based on user behavior analysis. Background Art

[0002] Conducting user behavior analysis on platform access users to obtain a security score for user behavior, and then verifying or warning users with abnormal behavior can effectively ensure the security of platform data during the access process. However, existing security scoring systems for user behavior often determine whether a user has abnormal behavior based on whether there is a large difference between the access behavior during the access process and the historical records. However, if the access behavior of platform access personnel is less regular, the effectiveness of the results on whether there is abnormal behavior is low. Therefore, how to ensure the accuracy of the judgment results on whether there is abnormal behavior when there are differences in the reference capabilities of access data of platform access personnel in actual scenarios is a problem that needs to be urgently solved by technical personnel in this field.

[0003] Chinese patent publication number CN114238959A discloses a user access behavior assessment method based on a zero-trust security system, which obtains the user's access behavior; performs risk assessment and credit assessment on the user login action set and each action item in the user access action set, and obtains the behavior score corresponding to the action item and the total behavior score of the user's access behavior; screens the user's high-risk behavior according to the total behavior score, a preset user risk threshold and a user trust threshold; and performs restriction operations on the user's high-risk behavior. However, the above scheme has the following problems: it fails to determine a targeted user behavior analysis method based on the reference capability of the access data of platform access personnel in actual scenarios, resulting in low accuracy of the monitoring results of abnormal user behavior. Summary of the Invention

[0004] To this end, the present invention provides a security scoring system based on user behavior analysis to overcome the problem in the prior art that the system fails to determine a targeted user behavior analysis method based on the reference capability of access data of platform access personnel in actual scenarios, resulting in low accuracy of monitoring results for abnormal user behavior.

[0005] To achieve the above objectives, the present invention provides a security scoring system based on user behavior analysis, comprising:

[0006] A monitoring and analysis module, which is used to determine the access status of each platform access personnel in response to the status determination conditions, and to determine the abnormal analysis strategy for each platform access personnel in response to the personnel analysis conditions. The abnormal analysis strategy is to perform data reference analysis or access-related trend analysis on the platform access personnel;

[0007] A reference analysis module, connected to the monitoring and analysis module, is used to determine reference access behavior parameters based on the behavioral reference degree of each category of access behavior parameters, and respond to fluctuation assessment conditions to determine whether a platform access person has access behavior risks;

[0008] A correlation analysis module, connected to the monitoring and analysis module, is used to respond to the correlation analysis conditions to determine the personnel access analysis method, which is to analyze the access rules of each related page set or to analyze the access pattern of each platform access page;

[0009] A security assessment module, which is connected to the reference analysis module and the correlation analysis module respectively, and is used to evaluate the judgment conditions to determine the security assessment method. The security assessment method is to determine the personnel security assessment coefficient of the target assessment personnel based on the parameter difference of each access behavior parameter or the number of abnormal visits to the access page of each platform;

[0010] A risk response module is connected to the security assessment module and is used to respond to personnel verification conditions to determine whether to perform risk verification on the target assessment personnel.

[0011] Furthermore, the monitoring and analysis module responds to the status determination condition to determine the personnel access status of the personnel accessing each platform;

[0012] For users accessing a single platform,

[0013] If the status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is greater than the preset access cycle stability coefficient or the access field overlap coefficient is greater than the preset access field overlap coefficient, then it is determined that the platform access person is in the first preset access state;

[0014] The status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is less than or equal to the preset access cycle stability coefficient and the access field overlap coefficient is less than or equal to the preset access field overlap coefficient, then it is determined that the platform visitor is in the second preset access state.

[0015] Furthermore, the monitoring and analysis module responds to the personnel analysis conditions to determine an abnormal analysis strategy for personnel accessing each platform;

[0016] The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a first preset access state, and then it is determined to perform data reference analysis on the platform access person;

[0017] The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a second preset access state, and then it is determined to perform access-related trend analysis on the platform access person.

[0018] Furthermore, the reference analysis module responds to the first analysis condition and determines the reference access behavior parameter according to the behavior reference degree of each category of access behavior parameter;

[0019] If the parameter evaluation condition responded by the reference analysis module is that the behavior reference degree of the access behavior parameter is greater than the preset behavior reference degree, the access behavior parameter is recorded as the reference access behavior parameter;

[0020] The behavior reference degree of each category of access behavior parameters is determined based on the parameter difference coefficient and the reference persistence index of the access behavior parameters. The behavior reference degree is negatively correlated with the parameter difference coefficient, and the behavior reference degree is positively correlated with the reference persistence index.

[0021] The first analysis condition is that the monitoring and analysis module determines to perform data reference analysis on platform access personnel.

[0022] Furthermore, the reference analysis module detects the parameter fluctuation index of each reference access behavior parameter in response to the evaluation and determination conditions, and determines whether the platform access person has an access behavior risk in response to the fluctuation evaluation conditions;

[0023] If the fluctuation assessment condition responded by the reference analysis module is that the fluctuation reference ratio is greater than the preset fluctuation reference ratio, then it is determined that the platform access person has access behavior risks;

[0024] The evaluation and judgment conditions are determined by referring to the access behavior parameters of the platform access personnel.

[0025] Furthermore, the correlation analysis module responds to the second analysis condition, performs page correlation division on the platform pages visited by the platform visitor, and determines the personnel access analysis method according to the percentage of related pages and the page correlation coefficient;

[0026] If the percentage of associated pages of the associated analysis condition responded by the correlation analysis module is greater than the preset percentage of associated pages or the page correlation coefficient is greater than the preset page correlation coefficient, it is determined that the correlation analysis module performs access regularity analysis on each associated page set;

[0027] If the correlation analysis condition responded by the correlation analysis module has a correlation page ratio less than or equal to a preset correlation page ratio and a page correlation coefficient less than or equal to a preset page correlation coefficient, the correlation analysis module is determined to perform access pattern analysis on access pages on each platform.

[0028] The second analysis condition is that the monitoring and analysis module determines to perform access-related trend analysis on platform visitors.

[0029] Furthermore, the correlation analysis module responds to the regularity analysis condition, determines an access conflict coefficient based on the access matching coefficient of each associated page set and the prospective page matching degree of each platform access page in each associated page set, and records the associated page set having an access conflict coefficient greater than a preset access conflict coefficient as an access conflict set;

[0030] Determine whether the platform access personnel have access behavior risks based on the proportion of access conflict sets;

[0031] The rule analysis condition is that the relevant analysis module determines to perform access rule analysis on each associated page set.

[0032] Furthermore, the correlation analysis module responds to the pattern analysis condition, determines the risk interaction index of each platform visitor according to the page access coefficient and the page operation coefficient, and determines whether the platform visitor has access behavior risk according to the risk interaction index;

[0033] The page operation coefficient is determined based on the access frequency difference value and the key access ratio;

[0034] The regularity analysis condition is that the relevant analysis module determines to perform access pattern analysis on access pages of each platform.

[0035] Furthermore, the security assessment module responds to the assessment conditions and determines a security assessment method based on an abnormality analysis strategy of the target access personnel;

[0036] The assessment judgment condition responded by the security assessment module is to determine whether the target assessment personnel has access risk behavior through data reference analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference of each access behavior parameter;

[0037] The assessment judgment condition responded by the security assessment module is to determine whether the target assessment personnel has access risk behavior through access-related trend analysis, and determine the personnel security assessment coefficient of the target assessment personnel based on the number of abnormal accesses to the access pages of each platform;

[0038] The evaluation condition is that there is a target evaluator, and the target evaluator is a platform visitor with access behavior risks.

[0039] Further, the risk response module responds to the personnel verification condition to determine whether to perform risk verification on the target assessment personnel;

[0040] The personnel verification condition responded by the risk response module is that if the personnel safety assessment coefficient of the target assessment personnel is greater than the preset personnel safety assessment coefficient, it is determined to perform risk verification on the target assessment personnel, and the access restriction method is determined according to the verification execution coefficient.

[0041] Compared with the existing technology, the beneficial effect of the present invention lies in that the technical solution of the present invention determines the personnel access status based on the access cycle stability coefficient and access field overlap coefficient of each platform access personnel, and determines a targeted abnormal analysis strategy based on the personnel access status to determine whether the platform access personnel has access behavior risks, so that the abnormal analysis strategy is more in line with the actual work scenario, avoiding the low accuracy of the abnormal behavior monitoring results of the platform access personnel due to the fact that the past access records of the platform access personnel have no reference value.

[0042] Furthermore, in the present invention, when the platform visitor is in the first preset access state, data reference analysis is performed on the platform visitor. The past access records of such platform visitors have a large regularity. The reference access behavior parameters are determined according to the behavioral reference degree of the access behavior parameters of each category, and the behavioral risk of the platform visitor is evaluated based on whether the reference access behavior parameters fluctuate during the current access process, thereby improving the data processing efficiency of the user abnormal behavior analysis.

[0043] Furthermore, in the present invention, when the platform visitor is in the second preset access state, an access-related trend analysis is performed on the platform visitor, and the personnel access analysis method is determined based on the proportion of associated pages and the page correlation coefficient. The proportion of associated pages and the page correlation coefficient are used to characterize whether the pages visited by the platform visitor are correlated, and then a targeted personnel access analysis method is determined, which is more in line with actual work scenarios. The present invention improves the accuracy of the abnormal behavior monitoring results of platform visitors.

[0044] Furthermore, in the present invention, when the correlation between platform access pages is relatively large, the access patterns of each associated page set are analyzed to see if there is any conflict with the behavior monitoring records, and this is used to determine whether the platform access personnel have access behavior risks. When the page correlation is relatively poor, the efficiency of analyzing the page access patterns is relatively poor, and the risk interaction index of each platform access personnel is determined by the page access coefficient and the page operation coefficient to determine whether the platform access personnel are deemed to have access behavior risks. In the present invention, while ensuring the accuracy of the abnormal behavior monitoring results for platform access personnel, the data processing efficiency for user abnormal behavior analysis is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a module connection diagram of the security scoring system based on user behavior analysis of the present invention;

[0046] Figure 2 A flow chart of the monitoring and analysis module of the present invention responding to a status determination condition to determine the personnel access status of personnel accessing each platform;

[0047] Figure 3A flow chart of the monitoring and analysis module of the present invention responding to personnel analysis conditions to determine an abnormal analysis strategy for personnel accessing each platform;

[0048] Figure 4 This is a flow chart of the present invention for determining a personnel access analysis method based on the proportion of associated pages and the page association coefficient. DETAILED DESCRIPTION

[0049] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention.

[0050] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0051] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside", and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. This is only for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0052] Furthermore, it should be noted that, in the description of the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; mechanical connections or electrical connections; direct connections or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0053] See also Figures 1 to 4 As shown, the present invention provides a security scoring system based on user behavior analysis, comprising:

[0054] A monitoring and analysis module, which is used to determine the access status of each platform access personnel in response to the status determination conditions, and to determine the abnormal analysis strategy for each platform access personnel in response to the personnel analysis conditions. The abnormal analysis strategy is to perform data reference analysis or access-related trend analysis on the platform access personnel;

[0055] A reference analysis module, connected to the monitoring and analysis module, is used to determine reference access behavior parameters based on the behavioral reference degree of each category of access behavior parameters, and respond to fluctuation assessment conditions to determine whether a platform access person has access behavior risks;

[0056] A correlation analysis module, connected to the monitoring and analysis module, is used to respond to the correlation analysis conditions to determine the personnel access analysis method, which is to analyze the access rules of each related page set or to analyze the access pattern of each platform access page;

[0057] A security assessment module, which is connected to the reference analysis module and the correlation analysis module respectively, and is used to evaluate the judgment conditions to determine the security assessment method. The security assessment method is to determine the personnel security assessment coefficient of the target assessment personnel based on the parameter difference of each access behavior parameter or the number of abnormal visits to the access page of each platform;

[0058] A risk response module is connected to the security assessment module and is used to respond to personnel verification conditions to determine whether to perform risk verification on the target assessment personnel.

[0059] Among them, the application scenario of the present invention is to monitor the abnormal behavior of users on a network platform, record the network platform where the abnormal behavior of users is monitored as the target monitoring platform, record the users who perform abnormal behavior monitoring as platform visitors, and record the page of the network platform visited by a platform visitor as the platform access page of the platform visitor. There is a corresponding domain label phrase in each platform access page, and users can set the content of the domain label phrase according to the actual work scenario. However, it is worth noting that the domain label phrase needs to reflect the function and main content of the platform access page. This is easy for technical personnel in this field to understand and will not be elaborated here.

[0060] The present invention applies several behavior monitoring records, and any behavior monitoring record records the number of platform access pages with key field phrases, access field overlap coefficient, behavior reference degree, parameter fluctuation index, fluctuation reference ratio, field label overlap, associated page ratio, page association coefficient, access conflict coefficient, access conflict set ratio, risk interaction index, parameter difference and personnel safety assessment coefficient in at least one platform access behavior monitoring process for a platform visitor. Each behavior monitoring record corresponds to a qualified mark, which records whether the accuracy of the abnormal behavior monitoring results for the platform visitor meets the user requirements. It can be understood that the user can determine whether the accuracy of the abnormal behavior monitoring results for the platform visitor meets the requirements based on self-set indicators.

[0061] Specifically, the monitoring and analysis module responds to the status determination conditions to determine the personnel access status of each platform access personnel;

[0062] For users accessing a single platform,

[0063] If the status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is greater than the preset access cycle stability coefficient or the access field overlap coefficient is greater than the preset access field overlap coefficient, then it is determined that the platform access person is in the first preset access state;

[0064] The status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is less than or equal to the preset access cycle stability coefficient and the access field overlap coefficient is less than or equal to the preset access field overlap coefficient, then it is determined that the platform visitor is in the second preset access state.

[0065] Among them, for a single platform visitor, the access cycle stability coefficient n is the number of times the platform visitor visits the target monitoring platform during the status evaluation period, ti is the duration of the i-th visit interval during the status evaluation period, t0 is the average duration of each visit interval during the status evaluation period, the visit interval duration is the duration between two consecutive visits to the target monitoring platform by the platform visitor during the status evaluation period, the access field overlap coefficient is the number of key field phrases contained in each platform access page during the status evaluation period, if the number of platform access pages containing a field label phrase is greater than the preset number of visits, then the field label phrase is recorded as the key field phrase, the end time of the status evaluation period is the current time, and the duration of the status evaluation period is taken as The value can be set by the user according to the actual work scenario, and a value of the duration of the status evaluation cycle is provided. The value of the duration of the status evaluation cycle is 30 days. The value of the preset number of visits can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor, the smaller the value of the preset number of visits. A method for determining the value of the preset number of visits is provided, and the average value of the number of platform visit pages containing key field phrases in the behavior monitoring records that meet the user's higher requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset number of visits;

[0066] The values ​​of the preset access cycle stability coefficient and the preset access field overlap coefficient can be determined by the user according to the actual work scenario. For example, the user can set them according to the behavior monitoring record. A method for determining the value of the preset access cycle stability coefficient is provided, and the behavior monitoring record of the platform visitor in the second preset access state is recorded as the state reference record. The maximum value of the access cycle stability coefficient in the state reference record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset access cycle stability coefficient. A method for determining the value of the preset access field overlap coefficient is provided, and the maximum value of the access field overlap coefficient in the state reference record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset access field overlap coefficient.

[0067] Specifically, the monitoring and analysis module responds to the personnel analysis conditions to determine the abnormal analysis strategy for personnel accessing each platform;

[0068] The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a first preset access state, and then it is determined to perform data reference analysis on the platform access person;

[0069] The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a second preset access state, and then it is determined to perform access-related trend analysis on the platform access person.

[0070] Specifically, the reference analysis module responds to the first analysis condition and determines the reference access behavior parameters according to the behavior reference degree of each category of access behavior parameters;

[0071] If the parameter evaluation condition responded by the reference analysis module is that the behavior reference degree of the access behavior parameter is greater than the preset behavior reference degree, the access behavior parameter is recorded as the reference access behavior parameter;

[0072] The behavior reference degree of each category of access behavior parameters is determined based on the parameter difference coefficient and the reference persistence index of the access behavior parameters. The behavior reference degree is negatively correlated with the parameter difference coefficient, and the behavior reference degree is positively correlated with the reference persistence index.

[0073] The first analysis condition is that the monitoring and analysis module determines to perform data reference analysis on platform access personnel.

[0074] Among them, for the access behavior parameters of a single category, the behavior reference degree = ln (reference persistence index / parameter difference coefficient), the reference persistence index is the number of visits in which the parameter difference value is less than the preset parameter difference value in the status evaluation cycle, and for a single visit process of a platform visitor, the parameter difference value is the absolute value of the difference between the value of the access behavior parameter at the time of the visit and the average value of the access behavior parameter of the category during each visit to the target monitoring platform during the status evaluation cycle, and the parameter difference coefficient is m is the number of times the platform visitor visits the target monitoring platform during the status assessment period, yv is the value of the access behavior parameter of this category during the vth visit to the target monitoring platform during the status assessment period, and y0 is the average value of the access behavior parameter of this category during each visit to the target monitoring platform during the status assessment period;

[0075] The values ​​of the preset parameter difference value and the preset behavior reference degree can be determined by the user according to the actual work scenario. For example, the user can set them according to the behavior monitoring record. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitors, the smaller the value of the preset parameter difference value and the larger the value of the preset behavior reference degree. A value of the preset parameter difference value is provided, and 5% of the average value of the numerical value of the access behavior parameter during each visit to the target monitoring platform within the status assessment period is recorded as the preset parameter difference value. A method for determining the value of the preset behavior reference degree is provided, and the minimum value of the behavior reference degree in the behavior monitoring record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitors is recorded as the preset behavior reference degree.

[0076] Specifically, the reference analysis module detects the parameter fluctuation index of each reference access behavior parameter in response to the evaluation and determination conditions, and determines whether the platform access person has access behavior risks in response to the fluctuation evaluation conditions;

[0077] If the fluctuation assessment condition responded by the reference analysis module is that the fluctuation reference ratio is greater than the preset fluctuation reference ratio, then it is determined that the platform access person has access behavior risks;

[0078] The evaluation and judgment conditions are determined by referring to the access behavior parameters of the platform access personnel.

[0079] Among them, for a single reference access behavior parameter, the parameter fluctuation index = (the absolute value of the difference between the value of the reference access behavior parameter during the platform access personnel's current access to the target monitoring platform and the average value of the reference access behavior parameter during each visit to the target monitoring platform within the status assessment period) / the average value of the reference access behavior parameter during each visit to the target monitoring platform within the status assessment period; the fluctuation reference proportion = the number of fluctuating reference behavior parameters / the number of reference access behavior parameters, and the fluctuating reference behavior parameter is a reference access behavior parameter whose parameter fluctuation index is greater than the preset parameter fluctuation index;

[0080] The values ​​of the preset fluctuation reference ratio and the preset parameter fluctuation index can be determined by the user according to the actual work scenario. For example, the user can set them according to the behavior monitoring records. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitors, the smaller the value of the preset fluctuation reference ratio and the smaller the value of the preset parameter fluctuation index. A method for determining the value of the preset parameter fluctuation index is provided, and the minimum value of the parameter fluctuation index of the fluctuation reference behavior parameter in the behavior monitoring records that meet the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitors is recorded as the preset parameter fluctuation index. A value of the preset fluctuation reference ratio is provided, and the behavior monitoring records for data reference analysis of the platform visitors are recorded as reference reference records. The average value of the fluctuation reference ratio of the platform visitors with access behavior risks in the reference reference records that meet the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitors is recorded as the preset fluctuation reference ratio.

[0081] Specifically, the correlation analysis module responds to the second analysis condition, divides the platform pages visited by the platform visitor into page correlations, and determines the personnel access analysis method according to the percentage of related pages and the page correlation coefficient;

[0082] If the percentage of associated pages of the associated analysis condition responded by the correlation analysis module is greater than the preset percentage of associated pages or the page correlation coefficient is greater than the preset page correlation coefficient, it is determined that the correlation analysis module performs access regularity analysis on each associated page set;

[0083] If the correlation analysis condition responded by the correlation analysis module has a correlation page ratio less than or equal to a preset correlation page ratio and a page correlation coefficient less than or equal to a preset page correlation coefficient, the correlation analysis module is determined to perform access pattern analysis on access pages on each platform.

[0084] The second analysis condition is that the monitoring and analysis module determines to perform access-related trend analysis on platform visitors.

[0085] Among them, when analyzing the visit-related trend of a single platform visitor, the page association is divided according to the domain label phrases contained in the visit pages of each platform. The domain label overlap of any associated page set is greater than the preset domain label overlap. The domain label phrases in the text content of the visit pages of each platform are extracted. For a single associated page set, the domain label overlap = the number of overlapping domain label phrases / the average number of domain label phrases of the visit pages of each platform contained in the associated page set. If each platform visit page in the associated page set contains a domain label phrase, it is determined that the domain label phrases are overlapped. The domain tag phrase is the overlapping domain tag of the associated page set. The value of the preset domain tag overlap can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor, the greater the value of the preset domain tag overlap. A method for determining the value of the preset domain tag overlap is provided, and the minimum value of the domain tag overlap of the associated page set in the behavior monitoring record that meets the user's requirements for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset domain tag overlap;

[0086] For a single platform visitor, the associated page ratio = the number of associated visit pages of the platform visitor / the number of platform visit pages of the platform visitor. The associated visitor is a platform visit page that exists in any associated page set. The page association coefficient is the number of associated page sets of the platform visitor. The preset associated page ratio and the value of the preset page association coefficient can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor, the larger the value of the preset associated page ratio and the larger the value of the preset page association coefficient. A method for determining the value of the preset associated page ratio is provided. The behavior monitoring record for access pattern analysis of each platform visit page is recorded as an associated reference record. The maximum value of the associated page ratio in the associated reference record that meets the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset associated page ratio. A method for determining the value of the preset page association coefficient is provided. The maximum value of the page association coefficient in the associated reference record that meets the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset page association coefficient.

[0087] Specifically, the correlation analysis module responds to the regularity analysis condition, detects the access matching coefficient of each associated page set and the prospective page matching degree of each platform access page in each associated page set, determines the access conflict coefficient based on the access matching coefficient and the prospective page matching degree, and records the associated page set whose access conflict coefficient is greater than the preset access conflict coefficient as an access conflict set;

[0088] Determine whether the platform access personnel have access behavior risks based on the proportion of access conflict sets;

[0089] The rule analysis condition is that the relevant analysis module determines to perform access rule analysis on each associated page set.

[0090] Among them, for a single associated page set, the access conflict coefficient is the product of the access matching coefficient and the reference prospective page matching degree, the access matching coefficient = the number of combined access pages in the combined access set contained in the associated page set / the number of platform access pages in the associated page set. If there are several platform access pages that coexist in the same access process of the platform access person currently undergoing behavior monitoring to the target monitoring platform, then the set of the above several platform access pages is recorded as a combined access set, and the above several platform access pages are collectively recorded as a combined access page. The reference prospective page matching degree is the average of the prospective page matching degrees of each platform access page in the associated page set. For a single platform access page, the prospective page matching degree is the number of times the prospective page of the platform access page is used as the prospective page of the platform access page in the status evaluation cycle;

[0091] The value of the preset access conflict coefficient can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset access conflict coefficient. A method for determining the value of the preset access conflict coefficient is provided, in which the behavior monitoring records for the access pattern analysis of each associated page set are recorded as the pattern reference records, and the average value of the access conflict coefficients of the access conflict set in the pattern reference records that meet the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset access conflict coefficient;

[0092] For a single platform access personnel, if the access conflict set ratio is greater than the preset access conflict set ratio, it is determined that the platform access personnel has an access behavior risk. The access conflict set ratio = the number of access conflict sets / the number of associated page sets. The value of the preset access conflict set ratio can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset access conflict set ratio. A method for determining the value of the preset access conflict set ratio is provided, and the minimum value of the access conflict set ratio of the platform access personnel with access behavior risks in the regular reference record that meets the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset access conflict set ratio.

[0093] Specifically, the correlation analysis module responds to the pattern analysis conditions, determines the risk interaction index of each platform visitor based on the page access coefficient and the page operation coefficient, and determines whether the platform visitor has access behavior risk based on the risk interaction index;

[0094] The page operation coefficient is determined based on the access frequency difference value and the key access ratio;

[0095] The regularity analysis condition is that the relevant analysis module determines to perform access pattern analysis on access pages of each platform.

[0096] Among them, for a single platform visitor, the risk interaction value is the product of the page access coefficient and the page operation coefficient. The page access coefficient is the number of times the platform visitor visits the platform page during the current visit to the target monitoring platform. The page operation coefficient = 1 / (access frequency difference value + key access ratio), the access frequency difference value m is the number of platform access pages visited by the platform visitor during the current visit to the target monitoring platform, fj is the number of visits to the j-th platform access page by the platform visitor during the current visit to the target monitoring platform, f0 is the average number of visits to each platform access page by the platform visitor during the current visit to the target monitoring platform, key visit ratio = (number of key visit pages / number of platform access pages visited by the platform visitor during the current visit to the target monitoring platform) × 100%, and the key visit page is the platform access page whose number of visits by the platform visitor during the current visit to the target monitoring platform is greater than the average number of visits to each platform access page by the platform visitor during the current visit to the target monitoring platform;

[0097] For a single platform visitor, if the risk interaction index is greater than the preset risk interaction index, it is determined that the platform visitor has an access behavior risk. The value of the preset risk interaction index can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor, the smaller the value of the preset risk interaction index. A method for determining the value of the preset risk interaction index is provided, and the behavior monitoring records for access pattern analysis of each platform access page are recorded as access reference records. The minimum value of the risk interaction index of the platform visitor with access behavior risk in the access reference records that meet the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform visitor is recorded as the preset risk interaction index.

[0098] Specifically, the security assessment module responds to the assessment conditions and determines the security assessment method based on the abnormal analysis strategy of the target access personnel;

[0099] The assessment judgment condition responded by the security assessment module is to determine whether the target assessment personnel has access risk behavior through data reference analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference of each access behavior parameter;

[0100] The assessment judgment condition responded by the security assessment module is to determine whether the target assessment personnel has access risk behavior through access-related trend analysis, and determine the personnel security assessment coefficient of the target assessment personnel based on the number of abnormal accesses to the access pages of each platform;

[0101] The evaluation condition is that there is a target evaluator, and the target evaluator is a platform visitor with access behavior risks.

[0102] Among them, the target assessment personnel is determined to have access risk behavior through data reference analysis, and the personnel safety assessment coefficient = ln (the number of differential access parameters × the sum of the parameter difference degrees of each differential access parameter), and the differential access parameter is an access behavior parameter with a parameter difference degree greater than a preset parameter difference degree. For a single category of access behavior parameters, the parameter difference degree = the absolute value of the difference between the access behavior parameter of the category of the target assessment personnel during the current access to the target monitoring platform and the reference behavior parameter of the access behavior parameter of the category / the reference behavior parameter of the access behavior parameter of the category. For a single category of access behavior parameters, the reference behavior parameter is the average value of the access behavior parameter of the category when the target assessment personnel visits the target monitoring platform each time within the status assessment cycle. The categories of access behavior parameters analyzed in the present invention include but are not limited to: visit duration, page views, page dwell time, and visit frequency;

[0103] The value of the preset parameter difference can be determined by the user according to the actual working scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset parameter difference. A method for determining the value of the preset parameter difference is provided, and the minimum value of the parameter difference of the differential access parameter in the behavior monitoring record that meets the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset parameter difference.

[0104] When it is determined through access-related trend analysis that the target assessment personnel has access risk behavior, the personnel safety assessment coefficient = ln (number of key access pages × number of abnormal access times), where the number of abnormal access times is the sum of the number of times the target assessment personnel visits each key access page during the current visit to the target monitoring platform.

[0105] Specifically, the risk response module responds to the personnel verification condition to determine whether to perform risk verification on the target assessment personnel;

[0106] The personnel verification condition responded by the risk response module is that the personnel safety assessment coefficient of the target assessment personnel is greater than the preset personnel safety assessment coefficient, and then it is determined to perform risk verification on the target assessment personnel.

[0107] Among them, the value of the preset personnel safety assessment coefficient can be determined by the user according to the actual work scenario. For example, the user can set it according to the behavior monitoring record. The higher the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel, the smaller the value of the preset personnel safety assessment coefficient. A method for determining the value of the preset personnel safety assessment coefficient is provided, and the minimum value of the personnel safety assessment coefficient of the target assessment personnel for risk verification in the behavior monitoring record that meets the user's requirement for the accuracy of the abnormal behavior monitoring results of the platform access personnel is recorded as the preset personnel safety assessment coefficient; if the personnel safety assessment coefficient of the target assessment personnel is greater than the preset personnel safety assessment coefficient, risk verification is performed on the target assessment personnel, and the user can determine the risk verification method according to the personnel safety assessment coefficient. The risk verification methods in the present invention include but are not limited to: SMS verification code, email authentication and face recognition. How to perform risk verification is easy to understand for technicians in this field and will not be elaborated here.

[0108] Thus far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art may make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present invention.

[0109] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that the present invention is susceptible to various modifications and variations. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A security scoring system based on user behavior analysis, characterized in that: include: A monitoring and analysis module, which is used to determine the access status of each platform access personnel in response to the status determination conditions, and to determine the abnormal analysis strategy for each platform access personnel in response to the personnel analysis conditions. The abnormal analysis strategy is to perform data reference analysis or access-related trend analysis on the platform access personnel; A reference analysis module, connected to the monitoring and analysis module, is used to determine reference access behavior parameters based on the behavioral reference degree of each category of access behavior parameters, and respond to fluctuation assessment conditions to determine whether a platform access person has access behavior risks; A correlation analysis module, connected to the monitoring and analysis module, is used to respond to the correlation analysis conditions to determine a personnel access analysis method, wherein the personnel access analysis method is to analyze the access regularity of each related page set, or to analyze the access pattern of each platform access page; A security assessment module, which is connected to the reference analysis module and the correlation analysis module respectively, and is used to evaluate the judgment conditions to determine the security assessment method. The security assessment method is to determine the personnel security assessment coefficient of the target assessment personnel based on the parameter difference of each access behavior parameter or the number of abnormal visits to the access page of each platform; a risk response module, connected to the security assessment module, for responding to personnel verification conditions to determine whether to perform risk verification on a target assessment personnel; The monitoring and analysis module responds to the status determination condition to determine the personnel access status of each platform access personnel; For users accessing a single platform, If the status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is greater than the preset access cycle stability coefficient or the access field overlap coefficient is greater than the preset access field overlap coefficient, then it is determined that the platform access person is in the first preset access state; If the status determination condition responded by the monitoring and analysis module is that the access cycle stability coefficient is less than or equal to the preset access cycle stability coefficient and the access field overlap coefficient is less than or equal to the preset access field overlap coefficient, then it is determined that the platform access person is in the second preset access state; The monitoring and analysis module responds to the personnel analysis conditions to determine the abnormal analysis strategy of the personnel accessing each platform; The personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a first preset access state, and then it is determined to perform data reference analysis on the platform access person; If the personnel analysis condition responded by the monitoring and analysis module is that a platform access person is in a second preset access state, it is determined to perform access-related trend analysis on the platform access person; The categories of visit behavior parameters analyzed include but are not limited to: visit duration, page views, page dwell time, and visit frequency; The number of abnormal visits is the sum of the number of visits made by the target assessor to each key access page during the current visit to the target monitoring platform.

2. The security scoring system based on user behavior analysis according to claim 1 is characterized in that: The reference analysis module responds to the first analysis condition and determines the reference access behavior parameters according to the behavior reference degree of each category of access behavior parameters; If the parameter evaluation condition responded by the reference analysis module is that the behavior reference degree of the access behavior parameter is greater than the preset behavior reference degree, the access behavior parameter is recorded as the reference access behavior parameter; The behavior reference degree of each category of access behavior parameters is determined based on the parameter difference coefficient and the reference persistence index of the access behavior parameters. The behavior reference degree is negatively correlated with the parameter difference coefficient, and the behavior reference degree is positively correlated with the reference persistence index. The first analysis condition is that the monitoring and analysis module determines to perform data reference analysis on platform access personnel.

3. The security scoring system based on user behavior analysis according to claim 2 is characterized in that: The reference analysis module detects the parameter fluctuation index of each reference access behavior parameter in response to the evaluation and judgment conditions, and determines whether the platform access person has an access behavior risk in response to the fluctuation evaluation conditions; If the fluctuation assessment condition responded by the reference analysis module is that the fluctuation reference ratio is greater than the preset fluctuation reference ratio, then it is determined that the platform access person has access behavior risks; The evaluation and judgment conditions are determined by referring to the access behavior parameters of the platform access personnel.

4. The security scoring system based on user behavior analysis according to claim 3 is characterized in that: The correlation analysis module, in response to the second analysis condition, divides the platform pages visited by the platform visitor into page associations, and determines a personnel visit analysis method based on the percentage of associated pages and the page association coefficient; If the percentage of associated pages of the associated analysis condition responded by the correlation analysis module is greater than the preset percentage of associated pages or the page correlation coefficient is greater than the preset page correlation coefficient, it is determined that the correlation analysis module performs access regularity analysis on each associated page set; If the percentage of associated pages of the associated analysis condition responded by the correlation analysis module is less than or equal to the preset percentage of associated pages and the page correlation coefficient is less than or equal to the preset page correlation coefficient, it is determined that the correlation analysis module performs access pattern analysis on the access pages of each platform; The second analysis condition is that the monitoring and analysis module determines to perform access-related trend analysis on platform visitors.

5. The security scoring system based on user behavior analysis according to claim 4 is characterized in that: The correlation analysis module responds to the regularity analysis condition, determines the access conflict coefficient based on the access matching coefficient of each associated page set and the prospective page matching degree of each platform access page in each associated page set, and records the associated page set with an access conflict coefficient greater than the preset access conflict coefficient as an access conflict set; Determine whether the platform access personnel have access behavior risks based on the proportion of access conflict sets; The rule analysis condition is that the relevant analysis module determines to perform access rule analysis on each associated page set.

6. The security scoring system based on user behavior analysis according to claim 5 is characterized in that: The correlation analysis module responds to the pattern analysis conditions, determines the risk interaction index of each platform visitor based on the page access coefficient and the page operation coefficient, and determines whether the platform visitor has access behavior risk based on the risk interaction index; The page operation coefficient is determined based on the access frequency difference value and the key access ratio; The regularity analysis condition is that the relevant analysis module determines to perform access pattern analysis on access pages of each platform.

7. The security scoring system based on user behavior analysis according to claim 6 is characterized in that: The security assessment module responds to the assessment conditions and determines the security assessment method according to the abnormal analysis strategy of the target access personnel; The assessment judgment condition responded by the security assessment module is to determine whether the target assessment personnel has access risk behavior through data reference analysis, and determine the personnel security assessment coefficient of the target assessment personnel according to the parameter difference of each access behavior parameter; The assessment judgment condition responded by the security assessment module is to determine whether the target assessment personnel has access risk behavior through access-related trend analysis, and determine the personnel security assessment coefficient of the target assessment personnel based on the number of abnormal accesses to the access pages of each platform; The evaluation condition is that there is a target evaluator, and the target evaluator is a platform visitor with access behavior risks.

8. The security scoring system based on user behavior analysis according to claim 7 is characterized in that: The risk response module responds to the personnel verification condition to determine whether to perform risk verification on the target assessment personnel; The personnel verification condition responded by the risk response module is that if the personnel safety assessment coefficient of the target assessment personnel is greater than the preset personnel safety assessment coefficient, it is determined to perform risk verification on the target assessment personnel, and the access restriction method is determined according to the verification execution coefficient.

Images