Abnormal login detection method and device based on time ring coordinate system

Abstract

The present invention discloses an abnormal login detection method and device based on a time ring coordinate system, which relates to the field of network security technology. The method includes: collecting historical login events of the target host, extracting the login time of each historical login event to form a historical login time series; marking the historical login time series as a number of coordinate points on the time ring coordinate system; dividing the coordinate points on the circumference into a number of adjacent point clusters, and calculating the weight of each adjacent point cluster according to the weight of each coordinate point in the adjacent point cluster; by comparing the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located with a preset weight threshold, it is determined whether the current login event is an abnormal login. The present invention can automatically detect abnormal logins by learning the time pattern of login events through an algorithm without relying on manually configured detection rules.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for detecting abnormal logins based on a time ring coordinate system. Background Art

[0002] Login events generated by normal user logins are normal logins. Login events generated by attackers logging into the compromised host through remote desktop (RDP) or SSH are abnormal logins. Abnormal logins are common in real-world intrusion activities.

[0003] Traditional abnormal login detection relies primarily on manually configured detection rules. The abnormal login detection feature of security products provides a user interface for configuring detection rules. Administrators who deploy and use the security product configure detection rules that suit their specific circumstances based on their understanding of their network environment. Detection rules generally include fields such as the login account name, login source IP address, and login time. The login time field is typically further broken down into sections such as the day of the week, hour, and minute. The abnormal login detection feature of some security products supports the configuration of normal login rules, where qualifying login events are considered normal, while non-qualifying login events are considered abnormal. It also supports the configuration of abnormal login rules, where qualifying login events are considered abnormal, while non-qualifying login events are considered normal. It may also support the configuration of multiple different types of rules to comprehensively determine whether a login event is an abnormal login.

[0004] When configuring rules, it's relatively simple to configure the login account name and source IP address. This information is easily accessible and rarely changes. However, configuring login time is more difficult. Security product administrators often struggle to accurately define which time periods are considered normal logins and which are considered abnormal logins. This is because relying on manually configured rules to detect abnormal logins has several inherent flaws:

[0005] (1) Due to limited resources, manually configured detection rules are often applied to a large number of servers in batches. However, even in the same network environment, the login situations of different servers are not exactly the same. For example, a security product administrator may configure the logins between 18:00 and 08:30 the next day as abnormal logins. However, a department in the company may often work overtime, and the department's servers may still have a large number of login events at 23:00, resulting in a large number of false positives.

[0006] (2) After the rules are manually configured, they are often not modified. However, in reality, the login situation of the same server will change over time. For example, when a server is just online, the operation and maintenance personnel will log in to the server more frequently, and a large number of normal logins will be generated during working hours from Monday to Friday. The security product administrator may configure the normal login time range to be Monday to Friday working hours based on this situation, and logins outside the normal login time are abnormal logins. As the service runs stably, the server is no longer logged in frequently, and is only logged in during inspections every Wednesday morning. However, the security product administrator often cannot adjust the configuration in time. At this time, the originally configured normal login time range is too wide, which easily misses abnormal login events.

[0007] Therefore, the existing technology urgently needs to solve the problem that it is difficult to accurately configure the time field in the abnormal login detection rules manually. Summary of the Invention

[0008] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a method and device for detecting abnormal logins based on a time ring coordinate system to solve the technical problems mentioned in the background technology.

[0009] One aspect of the present invention provides a method for detecting abnormal logins based on a time-annular coordinate system, comprising:

[0010] Collect historical login events of the target host and extract the login time of each historical login event to form a historical login time series;

[0011] Mark the historical login time series as a number of coordinate points on a time ring coordinate system. The coordinate points on the time ring coordinate system are sequentially distributed on a circumference. The length of the circumference represents the time period for measuring user login activities. The scale values ​​of the coordinate points on the circumference represent the user login time. The order of the coordinate points on the circumference represents the direction of time passage.

[0012] The coordinate points on the circumference are divided into a number of adjacent point clusters, and the weight of each adjacent point cluster is calculated based on the weight of each coordinate point in the adjacent point cluster; wherein each adjacent point cluster includes directly adjacent coordinate points and indirectly adjacent coordinate points; the directly adjacent coordinate points represent two adjacent coordinate points whose distance between each other is less than a distance threshold; the indirectly adjacent coordinate points represent two coordinate points that are not in a direct adjacent relationship, but are formed through a point pair formed by a direct adjacent relationship between the two coordinate points and at least one intermediate point;

[0013] By comparing the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located with the preset weight threshold, it is determined whether the current login event is an abnormal login.

[0014] Another aspect of the present invention further provides an abnormal login detection device based on a time ring coordinate system, comprising:

[0015] A data collection module is configured to collect historical login events of the target host and extract the login time of each historical login event to form a historical login time series;

[0016] a marking module configured to mark the historical login time series as a plurality of coordinate points on a time annular coordinate system, wherein the coordinate points on the time annular coordinate system are sequentially distributed on a circumference, wherein the length of the circumference represents a time period for measuring user login activities, the scale values ​​of the coordinate points on the circumference represent user login times, and the order of the coordinate points on the circumference represents a direction of time passage;

[0017] a weight calculation module configured to divide the coordinate points on the circumference into a plurality of adjacent point clusters, and calculate the weight of each adjacent point cluster based on the weight of each coordinate point in the adjacent point cluster; wherein each adjacent point cluster includes directly adjacent coordinate points and indirectly adjacent coordinate points; the directly adjacent coordinate points represent two adjacent coordinate points whose distance between them is less than a distance threshold; the indirectly adjacent coordinate points represent two coordinate points that are not directly adjacent to each other but form a point pair through a direct adjacent relationship between the two coordinate points and at least one intermediate point;

[0018] The detection module is configured to determine whether the current login event is an abnormal login by comparing the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located with a preset weight threshold.

[0019] The present invention provides a method and device for detecting abnormal logins based on a time ring coordinate system. These methods can automatically learn the time patterns of normal logins and automatically detect abnormal logins without manually configuring any rules. The method and device do not involve any complex machine learning algorithms, have low computational complexity, and low performance overhead. The results are highly interpretable, and can visually present why a login event is a normal login or an abnormal login in a visual manner through the time ring coordinate system. A historical login event expiration mechanism is designed to gradually adapt to changes in the login patterns of the same host and the same log-in service over time. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0021] Figure 1 This is a flow chart of an abnormal login detection method based on a time ring coordinate system provided by an embodiment of the present application;

[0022] Figure 2is a schematic diagram of a time annular coordinate system provided by an embodiment of the present application;

[0023] Figure 3 is a schematic diagram of a neighboring point cluster provided by an embodiment of the present application;

[0024] Figure 4 This is a curve showing how the weight of a login event changes with the time of occurrence of the login event, provided by an embodiment of the present application;

[0025] Figure 5-Figure 9 This is a schematic diagram of the entire abnormal login detection process provided by another embodiment of the present application in the time ring coordinate system;

[0026] Figure 10 It is a structural diagram of an abnormal login detection device based on a time ring coordinate system provided by another embodiment of the present application. DETAILED DESCRIPTION

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0028] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings.

[0029] It should be understood that although the terms first, second, third, etc. may be used to describe the acquisition modules in the embodiments of the present invention, the acquisition modules should not be limited to these terms. These terms are only used to distinguish the acquisition modules from each other.

[0030] The word "if," as used herein, may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to the determination" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)," depending on the context.

[0031] It should be noted that the directional terms such as "upper," "lower," "left," and "right" described in the embodiments of the present invention are described from the perspectives shown in the accompanying drawings and should not be construed as limiting the embodiments of the present invention. Furthermore, in the context, it should be understood that when an element is referred to as being formed "on" or "under" another element, it can be formed not only directly "on" or "under" the other element, but also indirectly "on" or "under" the other element through an intermediate element.

[0032] One embodiment of the present application provides a method for detecting abnormal logins based on a time-based circular coordinate system. This method is applicable to, but not limited to, solving the following technical problem: a large number of login events from the same account, logged into the same host, and originating from the same source IP address. These login events differ only in the login time; all other fields are the same. Technicians need a detection rule that does not rely on manually configured rules. Instead, an algorithm learns the temporal patterns of login events and automatically detects abnormal logins in these login events.

[0033] See also Figure 1 The abnormal login detection method based on the time ring coordinate system of this embodiment includes the following steps:

[0034] Step S101 : collecting historical login events of a target host, and extracting the login time of each historical login event to form a historical login time series.

[0035] Specifically, we deploy an agent on the computer where abnormal logins need to be detected. This agent parses existing login logs to obtain historical login events and monitors new login logs to obtain the latest login events in real time. The agent can collect both failed and successful login logs, but this embodiment focuses only on successful login logs. Failed login logs are typically used by brute force detection algorithms. Since this embodiment focuses only on the login time field in login events, theoretically any login event with a login time field can serve as input for this embodiment. However, based on the design principles of this embodiment, when the algorithm runs on Windows, the agent should at least support parsing Remote Desktop (RDP) login logs. When the algorithm runs on Linux, the agent should at least support parsing SSH login logs. After the agent is deployed, the historical login events and the latest login events obtained through subsequent real-time monitoring are grouped by fields such as the login source IP address and login account name. Each group of login events shares all fields except the login time field. Login times can be extracted from this group of login events and represented as a login time sequence t1, t2, t3, ..., tn. Each item in the sequence is the login time of a login event, with units accurate to the second. Each time a login event occurs, a new item is added to the login time sequence for the corresponding group (grouped by fields such as login source IP address and login account name).

[0036] Step S102: Mark the historical login time series as a number of coordinate points on a time ring coordinate system. The coordinate points on the time ring coordinate system are distributed in order on the circumference. The length of the circumference represents the time period for measuring the user's login activities. The scale values ​​of the coordinate points on the circumference represent the user's login time. The arrangement order of the coordinate points on the circumference represents the direction of time passage.

[0037] Since network maintenance personnel generally work on a weekly basis, this embodiment uses the weekly circular coordinate system as an example. However, the circular coordinate system can also be adapted to a year, month, day, or other period, and can be adjusted based on specific work scenarios. Subsequent algorithms will use this circular coordinate system to learn the time patterns of normal logins.

[0038] For example, draw a circle on a plane and divide it into seven equal parts. Label each arc segment in order: Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, and Sunday. Divide each of these seven equal parts into 86,400 equal parts (i.e., 60 x 60 x 24, the number of seconds in a day), with each smaller arc segment representing one second. This creates a circular coordinate system for the week, accurate to the second.

[0039] Any login time in the historical login time series can be marked into the weekly circular coordinate system. For example, marking the login time "Monday 20:45:12" into the weekly circular coordinate system will produce the following result: Figure 2 As shown (due to drawing accuracy issues, Figure 2 The scale in the figure only marks the equal points of the week, that is, 00:00:00 every day). For ease of understanding, Figure 2 The corresponding points of "Monday 00:00:00" and "Tuesday 00:00:00" in the weekly circular coordinate system are also marked.

[0040] from Figure 2 It can also be seen that in the weekly circular coordinate system, any two points can be connected by two arcs. This embodiment defines the length of the shorter of these two arcs as the distance between the two points, and the distance between the two points represents the length of a period of time. The length of the entire circle represents the time period of user login activity. In the weekly circular coordinate system, the length of the circle is one week.

[0041] from Figure 2 It can also be found that the weekly circular coordinate system designed in this embodiment can better reflect the time in the real world compared to other coordinate systems for expressing time:

[0042] (1) The distances between times (coordinate points) in the weekly circular coordinate system are consistent with real-world experience. For example, the distance between 00:00:00 on Sunday and 00:00:00 on Monday is the same as the distance between 00:00:00 on Monday and 00:00:00 on Tuesday. If, on a traditional number axis, 1, 2, ..., 7 represent Monday, Tuesday, ..., and Sunday, respectively, then the distance between Sunday and Monday on the axis would be very far, inconsistent with real-world experience.

[0043] (2) In the weekly circular coordinate system, the continuity of time is consistent with real-world experience. For example, the distance between 23:59:59 on Sunday and 00:00:00 on Monday is a small equally divided arc segment, that is, 1 second, and the two coordinate points are adjacent. If, in a plane rectangular coordinate system, the X-axis represents the day of the week, 1, 2, ..., 7 represent Monday, Tuesday, ..., Sunday respectively, and the Y-axis represents the time of day, with a value range of 0 to 86400-1 (that is, the time scale unit is seconds), then the distance between 23:59:59 on Sunday and 00:00:00 on Monday will be very far, which is inconsistent with real-world experience.

[0044] from Figure 2 It can also be seen that the coordinate points on the weekly circular coordinate system are distributed on the circumference in chronological order, so the arrangement order of the coordinate points on the circumference represents the direction of time passage.

[0045] Step S103: divide the coordinate points on the circumference into several adjacent point clusters, and calculate the weight of each adjacent point cluster based on the weight of each coordinate point in the adjacent point cluster; wherein each adjacent point cluster includes directly adjacent coordinate points and indirectly adjacent coordinate points; the directly adjacent coordinate points represent two adjacent coordinate points whose distance between each other is less than a distance threshold; the indirectly adjacent coordinate points represent two coordinate points that are not in a direct adjacent relationship, but are a point pair formed by the direct adjacent relationship between the two coordinate points and at least one intermediate point.

[0046] This example introduces the concept of adjacent point clusters. We set the maximum adjacent distance threshold to t, then the following relationship holds in the weekly circular coordinate system:

[0047] (1) If the distance between A and B is less than or equal to t, A and B are considered to be directly adjacent;

[0048] (2) If A and B are directly adjacent, B and C are directly adjacent, and A and C are not directly adjacent, then A and C are considered to be indirectly adjacent;

[0049] (3) If A and B are indirectly adjacent, B and C are indirectly adjacent, and A and C are not directly adjacent, then A and C are considered to be indirectly adjacent;

[0050] (4) If there are N points, and any two of these N points are directly or indirectly adjacent, then these N points form an adjacent point cluster.

[0051] (5) If the distance between A and other points is greater than t, then A itself forms an adjacent point cluster containing only one point.

[0052] Figure 3 This is a schematic diagram of some adjacent point clusters in the weekly circular coordinate system. The coordinate points represented by triangles and the punctuation points represented by circles form two adjacent point clusters respectively.

[0053] In addition, it is easy to see from the adjacent point clusters that the points in the weekly circular coordinate system always form several adjacent point clusters, and a certain point in the weekly circular coordinate system must belong to and only belongs to a certain adjacent point cluster.

[0054] Furthermore, the more recent the login event is, the more helpful it is in determining whether the current login event is a normal login or an abnormal login. To give an extreme and intuitive example, a very old login event, such as a login event one year ago, is almost meaningless in determining the current login event. Therefore, this embodiment introduces login event weights, and defines a basic weight for each login event. , the initial value can be 1. Basic weight Under certain conditions, changes may occur, such as manual verification to confirm that a login event is a normal login event, and the basic weight It will be raised.

[0055] The following describes how this embodiment determines the weight of each coordinate point in the adjacent point cluster. of.

[0056] This embodiment defines a constant k representing the length of a period of time, with a default value of 4 weeks. Based on practical experience in some real-world scenarios, it is found that login events within 2 times k, that is, within 8 weeks, have a strong reference value for current normal logins. Within this time range, the weight should remain unchanged. Login events within 2 times k to 4 times k, that is, from 8 weeks ago to 16 weeks ago, have a certain reference value for current normal login patterns, but the further back in time, the smaller the reference value. Login events outside of 4 times k, that is, 16 weeks ago, are too old and have no reference value for current normal login patterns. If you continue to refer to login events so long ago, it will lead to the omission of some abnormal login events. This embodiment needs to design a function formula, or find a function curve, which can express the law of change of weights over time.

[0057] Specifically, this embodiment sets a login event Login time is , the current time is , Is the default initial weight, the initial default value is 1, is the current time Login Event (i.e. the first For the convenience of description, we make:

[0058]

[0059] Indicates how long ago the login event occurred. Obviously, The value range of is [0,+∞).

[0060] Then order:

[0061]

[0062] Indicates that the weight of the login event changes over time (i.e., as Obviously, The value range of should be [0, 1]. When it is 1, it means that the weight has not been reduced. When it is 0, it means that the weight is reduced to 0. The goal of this embodiment is to find a function ,when hour, Follow The changing pattern of meets the requirements of this embodiment.

[0063] The value range is [0, 1], it is easy to think of the function It should be a fractional function, the numerator is never greater than the denominator. When it is 0, the numerator and denominator are the same. It is 1.

[0064] The simplest fractional function is:

[0065]

[0066] The default value of is 4 weeks, but for the convenience of discussion, when drawing the function graph in this embodiment, 1, observe When is several times k, the weight decreases. When it is 1, although it satisfies The range of values ​​is [0, 1] ( Greater than 0), but there are two problems:

[0067] First, It is never 0, that is: When it is very big, It just approaches 0, but is not 0;

[0068] Second, the function curve drops too fast at the beginning, but this embodiment hopes to When I was younger, The value is very close to 1.

[0069] For the first question, since ,want to After being greater than a certain value If it is 0, we have to let After being greater than a certain value is 0. When it is greater than a certain value, It is very difficult to always be equal to 0, so this embodiment takes the second best approach and stipulates that if is less than 0, then let is equal to 0, which can be expressed as:

[0070]

[0071] So, just ensure When it is greater than 0 and less than a specific value, The value of is in [0, 1]; When it is equal to a specific value, =0; When it is greater than a certain value, Less than 0.

[0072] It is a fractional function, the denominator cannot be 0. Equal to 0, we can only make the numerator 0. So the original for:

[0073]

[0074] The numerator in the above formula is a constant, so as long as the numerator is adjusted to , it can be achieved when equal hour, is 0, when Greater than hour, Less than 0. It becomes:

[0075]

[0076] Since this embodiment expects More than 4 times The weight drops to 0 when . Therefore, the numerator is adjusted to After this adjustment, when When it is 0, It is 4, not satisfied The condition is 1. Therefore, the synchronous adjustment denominator is .

[0077] so It becomes:

[0078]

[0079] The value range of the above function meets the requirements of this embodiment, but the shape of the function curve still does not meet the requirements because the above function drops too fast at the beginning and needs further adjustment. The above function drops too fast at the beginning because: When it increases, the numerator decreases and the denominator increases. The value of drops rapidly. This embodiment should try to make When starting to increase from 0, the numerator does not decrease quickly at first, and the denominator does not increase quickly at first.

[0080] Therefore, this embodiment is Do an algebraic transformation and divide both the numerator and denominator by :

[0081]

[0082] For the above formula, this embodiment must ensure that When it is relatively small, the function decreases slowly. When it is relatively large, the function decreases faster. Therefore, this embodiment mainly considers The value range is [0, ], the shape of the function curve, In this value range, The value range of is [0, 1]. In addition, it is easy to think of the curve of the quadratic function. When it is relatively small (close to 0), it grows slowly. As the value of is further increased, the curve grows faster and faster. In the numerator and denominator of Add the quadratic power, so becomes:

[0083]

[0084] The rate of decrease of the above function curve has obviously slowed down, but it is still not slow enough for the ultimate goal of this embodiment. As we all know, the fourth power of 0.1 is smaller than the second power of 0.1, so the larger the power, the slower the growth when starting from 0. Therefore, we try again to change the second power to the fourth power. becomes:

[0085]

[0086] The decline rate of the above function curve is obviously slower, but There is a significant decrease when it is approximately equal to 1. In this embodiment, it is hoped that When it is about equal to 2, there is a significant drop again, so we try to change the fourth power to the eighth power again. becomes:

[0087]

[0088] The curve of the above function is very consistent with the requirements of this embodiment. It only shows a significant decrease when it is approximately equal to 2. Perform an algebraic transformation and multiply both the numerator and denominator by , and we get the following function:

[0089] = =

[0090] According to the above reasoning, we can know that:

[0091] We put Substituting into the above formula, we get:

[0092]

[0093] According to the above reasoning, we can know that:

[0094]

[0095] From this we get:

[0096]

[0097] According to the above reasoning, we can know that:

[0098]

[0099] From this we get:

[0100]

[0101] Performing algebraic transformation on the above formula, we get the final weight calculation formula:

[0102]

[0103] in, Indicates the Coordinate points (login event )’s base weight; Represents the shortest learning time constant, used to represent a week's time; Indicates the current time; Indicates the Coordinate points (login event ) corresponding login time;

[0104] Furthermore, we need to meet certain prerequisites before we start detecting abnormal logins, so that we can obtain more accurate judgment results. This is because the process of calculating the weights of adjacent point clusters is actually the process of the algorithm learning the login patterns of historical login events. If the learning time of the login patterns is too short, for example, there were three login events between 9 am and 12 am on Wednesday in a random week. These three events may be accidental normal logins. Since the oldest login event is only one week old, the above-mentioned accidental events can easily be mistaken for normal login patterns, which will lead to deviations in the judgment of abnormal logins, that is, the abnormal logins in the above-mentioned time period will be mistaken for normal logins. Therefore, this embodiment more preferably needs to set a minimum learning time constant. , which is the weight of the coordinate point In the formula , abnormal login detection will only begin after the minimum learning time is reached.

[0105] When the basic weight is 1, When it is 1, the weight of the coordinate point Follow (i.e., how long ago the login event occurred) The curve chart of the change is as follows Figure 4 As shown. Figure 4 It can be seen that when When it is smaller (less than 2 ), the weight of the coordinate point Almost equal to , which indicates that more recent login events have higher weights. Further increase (greater than 2 Less than 4 ), the weight of the coordinate point This indicates that login events farther away have lower weights. Further increase (greater than 4 ), the weight of the coordinate point drops to 0, indicating that very distant login events are no longer considered.

[0106] Furthermore, the weight of each coordinate point in the adjacent point cluster is By summing them up, we can get the weight of the adjacent point cluster.

[0107] Furthermore, the shortest learning time constant of this embodiment is The preferred value of is 4, which means 4 weeks. According to the weight calculation formula, it can be seen that when At 4 o'clock:

[0108] (1) The weight of login events within 2 months (2 times 4 weeks, i.e. 56 days) remains basically unchanged;

[0109] (2) 4 times 4 weeks, that is, 112 days, the weight of login events within about 4 months gradually decreases;

[0110] (3) 4 times 4 weeks, that is, 112 days. Login events from about 4 months ago are weighted down to 0 and are no longer considered.

[0111] Furthermore, the distance threshold for determining whether coordinate points are directly adjacent is preferably 30 minutes, that is, two login events within a distance of 30 minutes are considered to be directly adjacent. The adjacent point cluster obtained in this way can bring more accurate abnormal login identification results.

[0112] Step S104 , determining whether the current login event is an abnormal login by comparing the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located with a preset weight threshold.

[0113] Specifically, if the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located is greater than the preset weight threshold, it means that there are a large number of login events in this adjacent time period, which is likely to be the normal login behavior and login pattern of the network maintenance engineer. At this time, the current login event is judged to be a normal login; if the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located is less than or equal to the preset weight threshold, it means that there are fewer login events in this adjacent time period, that is, the staff rarely logs in to the host in this adjacent time period, then the current login event is more likely to be an abnormal login.

[0114] More preferably, this embodiment sets the weight threshold w for the neighboring point cluster to 4. A larger weight for a neighboring point cluster indicates more recent login events and a higher likelihood of normal logins. Conversely, a smaller weight for a neighboring point cluster indicates fewer recent login events and a higher likelihood of abnormal logins. Setting the weight threshold to 4 in this embodiment yields more accurate abnormal login identification results.

[0115] Furthermore, before determining whether the current login event is an abnormal login, the following steps are also included: if the current time The interval between the earliest login time corresponding to the coordinate point on the time ring coordinate system is greater than If the number of weeks is greater than 1, the system will enter the detection mode to determine whether the current login event is an abnormal login; otherwise, the system will enter the learning mode without making any judgment on whether the current login event is an abnormal login.

[0116] Furthermore, based on the historical login events, when a new login event occurs, the new login time corresponding to the new login event is marked as a new coordinate point on the time ring coordinate system; if the current mode is learning, the current time is determined. Is the interval between the earliest login time corresponding to the coordinate point on the time ring coordinate system greater than If it is a week, it means that you have studied for a long time and can enter the detection mode, otherwise continue to study mode; after entering the detection mode, traverse the login time corresponding to each coordinate point in the time ring coordinate system, and then combine it with the current time , update the weight of each coordinate point according to the coordinate point weight formula , if the weight of a coordinate point If it is 0, the coordinate point is deleted from the time ring coordinate system; the weight of the adjacent point cluster where the new coordinate point is located is calculated. If the weight of the adjacent point cluster is greater than the preset weight threshold, the new login event is judged to be a normal login, otherwise it is an abnormal login.

[0117] Furthermore, if the algorithm identifies an abnormal login, an abnormal event alarm is generated. After that, the algorithm receives the manual verification result. After receiving the manual verification result of an abnormal login event, the following process is carried out: If the manual verification result is a "false alarm", the coordinate point corresponding to the login event (i.e. login time) is retained in the weekly circular coordinate system, and the basic weight of the coordinate point is adjusted. If the manual verification result is "confirmed to be an abnormal login event", the coordinate point corresponding to the abnormal event will be directly deleted from the weekly circular coordinate system.

[0118] See also Figure 5 The following describes the entire abnormal login identification process through a specific embodiment:

[0119] Assume that the agent required by this algorithm has been deployed on a Windows server. After deployment, the agent reads and parses historical login logs, obtaining 10 login events. In the real world, the source IP addresses and account names of login events on a single host are typically not identical, so they must first be grouped by source IP address and account name. For simplicity, this example assumes that the source IP addresses and account names of these login events are identical, and that the oldest login event occurred three weeks ago.

[0120] The algorithm constants take the following values:

[0121] Minimum learning time constant : 4 weeks. That is, learn the login time patterns for at least 4 weeks before starting to detect abnormal logins.

[0122] Coordinate point distance threshold t: 30 minutes. When calculating adjacent point clusters, two login events within a 30-minute interval are considered to be directly adjacent.

[0123] Neighborhood cluster weight threshold w: 4. A newly added login event must have a neighbor cluster weight greater than or equal to 4 to be considered a normal login.

[0124] The specific process is as follows:

[0125] After parsing the existing historical login events, these historical login events need to be marked in a weekly circular coordinate system. When marking, the weight of each login event (i.e., the coordinate point weight) is calculated. Assuming that the weight is greater than 0, the login event will not be deleted, and all 10 login events will be marked in the weekly circular coordinate system. For example, Figure 5 shown.

[0126] Since the oldest event occurred 3 weeks ago, it is less than 4 weeks (the shortest learning time constant ). To avoid too many false positives, detection will not start yet. The current state is learning mode. The learning mode will be maintained for the next week. Assume that two login events are generated in this week, and they will also be marked in the weekly circular coordinate system. The result is as follows Figure 6 As shown (the solid triangle symbol in the figure represents a newly added login event).

[0127] After 4 weeks of learning, any login events that occur will trigger a mode change, that is, from learning mode to detection mode. In detection mode, new login events will be detected to see if they are abnormal logins. Assume that a new login event is generated and marked in the weekly circular coordinate system, represented by a solid triangle symbol. Traverse all points in the weekly circular coordinate system and calculate the weight of each point. It is found that all are greater than 0, so no point is deleted. Calculate the adjacent point cluster where the new login event is located and represent it with a dotted box. The result is as follows Figure 7 shown.

[0128] Calculate the weight of the adjacent point cluster where the new login event is located. Assume that the result is 4.5 (there are 5 points in the adjacent point cluster, but as time goes by, the weights of some points have decreased and are less than 1). This is greater than the weight threshold of 3, so this login event is a normal login, not an abnormal login.

[0129] Suppose a new login event occurs and is marked in the weekly circular coordinate system, represented by a solid triangle. Traverse all points in the weekly circular coordinate system and calculate the weight of each point. A login event on Friday is found. Since it is too old, its weight drops to 0, so it is deleted and represented by a dotted triangle. Calculate the adjacent point cluster where the new login event is located and represent it with a dotted box. The result is as follows Figure 8 shown.

[0130] Calculate the weight of the adjacent point cluster where the new login event is located. Assuming the result is 2, which is less than the weight threshold of 3, the login event is an abnormal login. An abnormal login alarm will be generated. After manual verification, it is confirmed that the above login event is indeed an abnormal login and the login event is deleted from the weekly circular coordinate system. After deleting expired login events and abnormal login events, the weekly circular coordinate system is as follows: Figure 9 shown.

[0131] See also Figure 10 Another embodiment of the present invention further provides an abnormal login detection device 200 based on a time annular coordinate system, comprising a data acquisition module 201, a marking module 202, a weight calculation module 203, and a detection module 204. The device 200 can execute the abnormal login detection method based on a time annular coordinate system in the method embodiment.

[0132] Specifically, the abnormal login detection device 200 based on the time ring coordinate system includes:

[0133] The data collection module 201 is configured to collect historical login events of the target host and extract the login time of each historical login event to form a historical login time series;

[0134] The marking module 202 is configured to mark the historical login time series as a plurality of coordinate points on a time annular coordinate system, wherein the coordinate points on the time annular coordinate system are sequentially distributed on a circumference, wherein the length of the circumference represents a time period for measuring user login activities, the scale values ​​of the coordinate points on the circumference represent user login times, and the order of the coordinate points on the circumference represents the direction of time passage;

[0135] The weight calculation module 203 is configured to divide the coordinate points on the circumference into a plurality of adjacent point clusters, and calculate the weight of each adjacent point cluster based on the weight of each coordinate point in the adjacent point cluster; wherein each adjacent point cluster includes directly adjacent coordinate points and indirectly adjacent coordinate points; the directly adjacent coordinate points represent two adjacent coordinate points whose distance between them is less than a distance threshold; the indirectly adjacent coordinate points represent two coordinate points that are not directly adjacent to each other, but are formed through a direct adjacent relationship between the two coordinate points and at least one intermediate point.

[0136] The detection module 204 is configured to determine whether the current login event is an abnormal login by comparing the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located with a preset weight threshold.

[0137] It should be noted that the abnormal login detection device 200 based on the time ring coordinate system provided in this embodiment corresponds to a technical solution that can be used to execute each method embodiment. Its implementation principle and technical effect are similar to the method and will not be repeated here.

[0138] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of the present invention is not limited to technical solutions formed by specific combinations of the above-mentioned technical features. It also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents, without departing from the above-mentioned disclosure. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A method for detecting abnormal logins based on a time-based annular coordinate system, characterized in that: The steps include: Collect historical login events of the target host and extract the login time of each historical login event to form a historical login time series; Mark the historical login time series as a number of coordinate points on a time ring coordinate system. The coordinate points on the time ring coordinate system are sequentially distributed on a circumference. The length of the circumference represents the time period for measuring user login activities. The scale values ​​of the coordinate points on the circumference represent the user login time. The order of the coordinate points on the circumference represents the direction of time passage. The coordinate points on the circumference are divided into a number of adjacent point clusters, and the weight of each adjacent point cluster is calculated based on the weight of each coordinate point in the adjacent point cluster; wherein each adjacent point cluster includes directly adjacent coordinate points and indirectly adjacent coordinate points; the directly adjacent coordinate points represent two adjacent coordinate points whose distance between each other is less than a distance threshold; the indirectly adjacent coordinate points represent two coordinate points that are not in a direct adjacent relationship, but are formed through a point pair formed by a direct adjacent relationship between the two coordinate points and at least one intermediate point; By comparing the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located with the preset weight threshold, it is determined whether the current login event is an abnormal login; The step of calculating the weight of each adjacent point cluster according to the weight of each coordinate point in the adjacent point cluster comprises: The weight of each coordinate point in the adjacent point cluster is calculated according to the following formula : in, Indicates the The basic weight of the coordinate points; represents the shortest learning time constant; Indicates the current time; Indicates the The login time corresponding to the coordinate point; The weight of each coordinate point in the adjacent point cluster Sum and get the weight of the adjacent point cluster; The step of judging whether the current login event is an abnormal login by comparing the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located with a preset weight threshold includes: if the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located is greater than the preset weight threshold, then the current login event is judged to be a normal login, otherwise it is an abnormal login.

2. The abnormal login detection method based on a time ring coordinate system according to claim 1 is characterized in that: Before determining whether the current login event is an abnormal login, the following steps are also included: If the current time The interval between the earliest login time corresponding to the coordinate point on the time ring coordinate system is greater than If the time corresponding to times the circumference length is less than 100%, the system enters the detection mode to determine whether the current login event is an abnormal login; otherwise, the system enters the learning mode without making any judgment on whether the current login event is an abnormal login.

3. The abnormal login detection method based on a time ring coordinate system according to claim 2 is characterized in that: Also includes: When a new login event is generated, the new login time corresponding to the new login event is marked as a new coordinate point on the time ring coordinate system; If the current mode is learning, then determine the current time Is the interval between the earliest login time corresponding to the coordinate point on the time ring coordinate system greater than If the time is equal to times the circumference length, the system will enter the detection mode, otherwise it will continue to the learning mode. After entering the detection mode, traverse the login time corresponding to each coordinate point in the time ring coordinate system, and then combine it with the current time , update the weight of each coordinate point , if the weight of a coordinate point If it is 0, the coordinate point will be deleted from the time ring coordinate system; The weight of the adjacent point cluster where the new coordinate point is located is calculated. If the weight of the adjacent point cluster is greater than a preset weight threshold, the new login event is determined to be a normal login, otherwise it is an abnormal login.

4. An abnormal login detection device based on a time ring coordinate system, characterized in that: include: A data collection module is configured to collect historical login events of the target host and extract the login time of each historical login event to form a historical login time series; a marking module configured to mark the historical login time series as a plurality of coordinate points on a time annular coordinate system, wherein the coordinate points on the time annular coordinate system are sequentially distributed on a circumference, wherein the length of the circumference represents a time period for measuring user login activities, the scale values ​​of the coordinate points on the circumference represent user login times, and the order of the coordinate points on the circumference represents a direction of time passage; a weight calculation module configured to divide the coordinate points on the circumference into a plurality of adjacent point clusters, and calculate the weight of each adjacent point cluster based on the weight of each coordinate point in the adjacent point cluster; wherein each adjacent point cluster includes directly adjacent coordinate points and indirectly adjacent coordinate points; the directly adjacent coordinate points represent two adjacent coordinate points whose distance between them is less than a distance threshold; the indirectly adjacent coordinate points represent two coordinate points that are not directly adjacent to each other but form a point pair through a direct adjacent relationship between the two coordinate points and at least one intermediate point; a detection module configured to determine whether the current login event is an abnormal login by comparing the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located with a preset weight threshold; The weight calculation module is further configured to: The weight of each coordinate point in the adjacent point cluster is calculated according to the following formula : in, Indicates the The basic weight of the coordinate points; represents the shortest learning time constant; Indicates the current time; Indicates the The login time corresponding to the coordinate point; The weight of each coordinate point in the adjacent point cluster Sum and get the weight of the adjacent point cluster; The detection module is further configured to: if the weight of the adjacent point cluster where the coordinate point of the current login event on the time ring coordinate system is located is greater than a preset weight threshold, then determine that the current login event is a normal login, otherwise it is an abnormal login.

5. The abnormal login detection device based on a time ring coordinate system according to claim 4 is characterized in that: Also includes: Mode switching module, is configured to The interval between the earliest login time corresponding to the coordinate point on the time ring coordinate system is greater than If the time corresponding to times the circumference length is exceeded, the system enters the detection mode to determine whether the current login event is an abnormal login; Otherwise, the system enters learning mode and does not determine whether the current login event is an abnormal login.

6. The abnormal login detection device based on a time annular coordinate system according to claim 5, characterized in that: The marking module is further configured to: when a new login event is generated, mark the new login time corresponding to the new login event as a new coordinate point on the time ring coordinate system; The mode switching module is further configured to: if the current mode is learning mode, determine the current time Is the interval between the earliest login time corresponding to the coordinate point on the time ring coordinate system greater than If the time is equal to times the circumference length, the system will enter the detection mode, otherwise it will continue to the learning mode. The weight calculation module is further configured to: after entering the detection mode, traverse the login time corresponding to each coordinate point in the time ring coordinate system, and then combine the current time , update the weight of each coordinate point , if the weight of a coordinate point If it is 0, the coordinate point is deleted from the time ring coordinate system; the weight of the adjacent point cluster where the new coordinate point is located is calculated; The detection module is further configured to: if the weight of the adjacent point cluster is greater than a preset weight threshold, determine that the new login event is a normal login; otherwise, it is an abnormal login.

Images