Government affair business system log-based data security abnormal behavior identification alarm model

Abstract

The invention discloses a government affair service system log-based data security abnormal behavior identification alarm model, which comprises the following steps of: S1) setting a model input field, and obtaining original data based on a government affair service system log; s2) converting the original data into features, analyzing all the features by using an isolated forest algorithm, and returning an outlier as an abnormal point; s3) using a machine learning algorithm and a predefined rule to find out an abnormal behavior which seriously deviates from the baseline; and S4) giving an alarm for the source account or the source IP, setting a model exception output field, and detecting output exception operation, threat behavior, risk behavior or abnormal operation. According to the data security abnormal behavior identification alarm model based on the government affair business system log, business system data security behavior identification and anomaly detection can be realized, the compliance of data security protection is improved, and the anomaly detection and security prediction capability is improved.

Description

Technical Field

[0001] The present invention relates to a data security abnormal behavior recognition and warning model, and particularly to a data security abnormal behavior recognition and warning model based on the logs of government affairs business systems. Background Art

[0002] In recent years, the security of government affairs business systems still faces severe security risks, and the security protection work of government affairs business systems has become an important part of the government's informatization process. During the security audit of the logs of government affairs business systems, especially when analyzing the logs of access to and operations on government affairs business systems and data, there is an urgent need for an abnormal behavior recognition and warning model to improve the recognition and warning capabilities of abnormal behaviors and ensure the security of government affairs business data.

[0003] In the existing analysis of the logs of government affairs business systems, due to the lack of recognition and warning of abnormalities in behaviors such as access to and operations on government affairs business systems through log analysis, security operation personnel cannot timely discover hidden threats and subtle abnormal changes in network activities, nor can they recognize abnormal behaviors of internal users accessing assets and business systems, thus resulting in the failure to discover security risks and the risk of possible data leakage. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a data security abnormal behavior recognition and warning model based on the logs of government affairs business systems, which can realize the recognition of data security behaviors and abnormal detection of business systems, improve the compliance of data security protection, and enhance the abnormal detection and security prediction capabilities.

[0005] The technical solution adopted by the present invention to solve the above technical problem is to provide a data security abnormal behavior recognition and warning model based on the logs of government affairs business systems, including the following steps: S1) Set the model input fields and obtain the original data based on the logs of government affairs business systems; S2) Convert the original data into features, analyze all features using the Isolation Forest algorithm, and return the outliers as abnormal points; S3) Use machine learning algorithms and predefined rules to find abnormal behaviors that deviate significantly from the baseline; S4) Alarm for the source account or source IP, set the model abnormal output fields, and detect and output abnormal operations, threat behaviors, risk behaviors, or abnormal operations.

[0006] Further, the model input fields in step S1 include the source account, source natural person uuid, source device uuid, target device uuid, target device ip, target device port number, commands executed by the user, Linux commands / database commands, table names of database operations, session id of the operation, and operation time.

[0007] Further, the features in step S2 include the number of operating systems, the number of accessed devices, the number of instruction operations, the number of database instruction operations, the number of types of Linux operation instructions, the number of types of operation tables, the number of sessions, the total number of sensitive operations, the number of types of sensitive operations, the average operation duration of each user on each target device IP, and the average operation duration of each user on each session.

[0008] Further, in step S2, the Isolation Forest algorithm is used to repeatedly cut the feature space of sample points until there is only one sample in each subspace.

[0009] Further, the algorithm formula in step S2 is as follows: ; is the number of cuts required for the isolated sample point x, is the average number of cuts for all samples. When the s value of a sample point approaches 1, it is an outlier; if the s value of a certain point approaches 0, it is determined to be a normal point; if the s values of all sample points approach 0.5, it is determined that all sample points are normal points.

[0010] Further, the content of abnormal behaviors in step S3 covers: account, authentication, authorization, operation audit, and access; the dimensions of abnormal behaviors cover: access source, account, amount of accessed data, accessed data object, access frequency, and access time.

[0011] Further, the abnormal output fields in step S4 include abnormal type, abnormal description, abnormal summary, start time, end time, abnormal classification method, first-level classification, abnormal score, abnormal score composition structure, unique identifier of the source user, unique identifier of the source device, unique identifier of the target device, and unique identifier of the target application.

[0012] Further, the abnormal summary includes important abnormal features and the contribution degree of these features to the abnormality, and the important abnormal features are obtained by screening features with higher weight scores.

[0013] The present invention has the following beneficial effects compared with the prior art: The data security abnormal behavior recognition and warning model based on the logs of the government affairs business system provided by the present invention can detect all attacks through behavior analysis, abnormal dimension analysis, attack recognition analysis, and warning, efficiently analyze and handle security warnings, can realize the recognition and abnormal detection of the data security behavior of the business system, improve the compliance of data security protection, and enhance the abnormal detection and security prediction capabilities. Description of the Drawings

[0014] Figure 1This is the flowchart of the data security abnormal behavior recognition and alarm model based on the logs of the government affairs business system of the present invention. Detailed implementation manners

[0015] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0016] The improvement of the attack detection effect is essentially based on a deep understanding of attack behaviors and data; mainly through behavior analysis, abnormal dimension analysis, attack recognition analysis and alarm, all attacks are detected as much as possible, and security alarms are analyzed and disposed of efficiently. Please refer to Figure 1 , the data security abnormal behavior recognition and alarm model based on the logs of the government affairs business system provided by the present invention includes: I. Definition of model input fields: 1) Field contents to be included: netflow_flags, dst_account, src_person_uuid, src_device_uuid, dst_device_uuid, dst_device_ip, dst_port, process_cmdline, resource_name, database_table_name, session_id, generic_create_time 2) Data contents of each field:

[0017] II. Model detection logic: 1) Feature engineering operate_cnt: Number of operating systems.

[0018] device_cnt: Number of accessed devices. Calculate the number of unique (dst_device_ip - dst_port) pairs that appear simultaneously in each user record.

[0019] shell_opt_cnt: Number of shell instruction operations. Calculate the number of rows corresponding to resource_name = '2' in each user record.

[0020] database_opt_cnt: Number of database instruction operations. Calculate the number of rows corresponding to resource_name = '3' in each user record.

[0021] shell_cmd_cnt: The number of types of Linux operation commands. Calculate the number of different process_cmdline in the records where resource_name = '2'.

[0022] table_cnt: The number of types of operation tables. Calculate the number of different database_table_name in the records where resource_name = '3'.

[0023] session_cnt: The number of sessions. Calculate the number of different session_id in each user's record.

[0024] point_key_cnt: The total number of sensitive operations.

[0025] point_key_dst: The number of types of sensitive operations.

[0026] duration_device: Calculate the average operation duration of each user on each target device IP.

[0027] duration_session: Calculate the average operation duration of each user in each session.

[0028] 2) Detection algorithm or rule This model uses the Isolation Forest algorithm to analyze the features listed in the previous subsection and returns the outlier points as anomalies. The Isolation Forest algorithm repeatedly partitions the feature space of the sample points until there is only one sample in each subspace, that is, the isolation of the sample is completed. For outlier points, because its value is different from that of normal points, it only requires fewer partitioning times to isolate it during partitioning. Calculate the anomaly score of each point through the following formula: ; where is the number of partitioning times required to isolate the sample point x, is the average number of partitioning times of all samples. Therefore, ,

[0029]

[0030] When the s value of a sample point approaches 1, it is an outlier. If the s values of all sample points approach 0.5, it is very likely that all sample points are normal points. If the s value of a certain point approaches 0, it must be a normal point.

[0031] III. Model Output: Definition of Abnormal Alarm Object: Alarm for source account / source IP alarm.

[0032] IV. Model Operation Configuration: Operation Time Range: Push one day forward from the current time.

[0033] Operation Frequency: Daily.

[0034] Repeated Alarm Configuration: Turned off.

[0035] V. Definition of Abnormal Output Fields:

[0036] The data security abnormal behavior recognition model of the government affairs business system log of the present invention is applied to log security analysis. The content of behavior analysis covers: account, authentication, authorization, operation audit, access; the abnormal dimensions cover: access source, account, access data volume, access data object, access frequency, access time.

[0037] The data security abnormal behavior recognition model of the government affairs business system log of the present invention realizes the recognition and abnormal detection of the data security behavior of the business system, improves the compliance of data security protection, and enhances the abnormal detection and security prediction capabilities. The model combines business system log analysis to achieve the ability of various behavior analysis and mining for multi-scene combinations of various algorithms, completes the mining of behavior associations between real-time and historical multi-source logs, realizes the recognition analysis and alarm of high-risk user behaviors in the government affairs business system, or discovers, analyzes and alarms the abnormal behaviors of internal users accessing assets and business systems.

[0038] Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications and improvements without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be defined by the claims.

Claims

1. A data security abnormal behavior recognition and warning model based on the logs of government affairs business systems, characterized in that, It includes the following steps: S1) Set the input fields of the alarm model and obtain the original data based on the logs of the government affairs business system; S2) Convert the original data into features, analyze all features using the Isolation Forest algorithm, and return the outliers as abnormal points; S3) Use machine learning algorithms and predefined rules to find abnormal behaviors that deviate significantly from the baseline; S4) Alarm for the source account or source IP, set the abnormal output fields of the alarm model, and detect abnormal operations, threat behaviors, risk behaviors, or abnormal operations.

2. The data security abnormal behavior recognition and warning model based on the log of the government affairs business system according to claim 1, wherein The model input fields in step S1 include the source account, source natural person uuid, source device uuid, target device uuid, target device ip, target device port number, commands executed by the user, Linux commands / database commands, table names of database operations, session id of the operation, and operation time.

3. The data security abnormal behavior recognition and alarm model based on the government affairs business system log according to claim 1, characterized in that, The features in step S2 include the number of operating system times, number of accessed devices, number of instruction operations, number of database instruction operations, number of types of Linux operation instructions, number of types of operation tables, number of sessions, total number of sensitive operations, number of types of sensitive operations, average operation duration of each user on each target device ip, and average operation duration of each user on each session.

4. The data security abnormal behavior recognition and warning model based on the government affairs business system log according to claim 1, wherein, In step S2, the Isolation Forest algorithm is used to repeatedly cut the feature space of the sample points until there is only one sample in each subspace.

5. The data security abnormal behavior recognition and warning model based on the government affairs business system log according to claim 4, characterized in that, The algorithm formula in step S2 is as follows: ； is the number of cutting times required for the isolated sample point x, is the average number of cutting times for all samples. When the s value of the sample point approaches 1, it is an outlier; If the s value of a certain point approaches 0, it is determined to be a normal point; if the s values of all sample points approach 0.5, it is determined that all sample points are normal points.

6. The data security abnormal behavior recognition and warning model based on the government affairs business system log according to claim 1, characterized in that, The content of the abnormal behaviors in step S3 covers: accounts, authentication, authorization, operation auditing, and access; the dimensions of the abnormal behaviors cover: access source, account, amount of accessed data, accessed data object, access frequency, and access time.

7. The data security abnormal behavior recognition and warning model based on the government affairs business system log according to claim 1, characterized in that The abnormal output fields in step S4 include abnormal type, abnormal description, abnormal summary, start time, end time, abnormal classification method, first-level classification, abnormal score, abnormal score composition structure, unique identifier of the source user, unique identifier of the source device, unique identifier of the target device, and unique identifier of the target application.

8. The data security abnormal behavior recognition and warning model based on the government affairs business system log according to claim 7, wherein, The abnormal summary includes important abnormal features and the contribution degree of these features to the abnormality, and the important abnormal features are obtained by screening features with higher weight scores.

Images