Behavior analysis method and device, electronic equipment and storage medium

Abstract

The invention provides a behavior analysis method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining network access information generated by a network access behavior; based on historical network access information of an individual user, performing first behavior analysis on the network access information to obtain a first behavior analysis result for the network access information; wherein the first behavior analysis result represents whether the network access behavior deviates from a network access habit of an individual user; under the condition that the network access behavior deviates from the network access habit of an individual user, performing second behavior analysis on the network access information based on historical network access information of a department center to obtain a second behavior analysis result aiming at the network access information; wherein the second behavior analysis result represents whether the network access behavior deviates from the network access habit of the department center.

Description

Technical Field

[0001] The present application relates to the field of information security, and specifically to a behavior analysis method, device, electronic device, and storage medium. Background Art

[0002] In the field of information security, personal terminals can directly communicate with the external internet and connect to the enterprise's internal network. Therefore, they are easy targets for hacker attacks. In practice, attackers often use social engineering tactics to deceive users into obtaining sensitive information and infiltrating the intranet. For example, positions such as customer service, human resources, and sales often provide contact information and service details through public channels. Attackers can use this information to locate personnel in these positions and launch targeted phishing attacks.

[0003] Currently, most responses to phishing attempts are through account authorization, access address authorization, security product alerts, and continuous strengthening of employee information security awareness. However, this approach cannot determine whether the current user terminal has been compromised, or whether the user's account has become an attacker's, and it is even more impossible to proactively discover and alert to subsequent malicious access behaviors.

[0004] Therefore, how to analyze users' network access behaviors in order to discover suspicious network access behaviors has become a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0005] In order to solve the above technical problems, the present application proposes a behavior analysis method, device, electronic device and storage medium.

[0006] In order to achieve the above technical objectives, this application proposes the following technical solutions:

[0007] On one hand, the present application provides a behavior analysis method, comprising:

[0008] Obtain network access information generated by network access behavior;

[0009] Based on the historical network access information of the individual user, performing a first behavior analysis on the network access information to obtain a first behavior analysis result for the network access information; wherein the first behavior analysis result indicates whether the network access behavior deviates from the network access habits of the individual user;

[0010] In the case that the network access behavior deviates from the network access habits of individual users, a second behavior analysis is performed on the network access information based on the historical network access information of the department center to obtain a second behavior analysis result for the network access information; wherein, the second behavior analysis result indicates whether the network access behavior deviates from the network access habits of the department center.

[0011] In an optional implementation manner of the present application, performing a first behavior analysis on the network access information based on the historical network access information of the individual user to obtain a first behavior analysis result for the network access information includes:

[0012] Determining a first probability of occurrence of the network access behavior based on historical network access information of the individual user;

[0013] Determining whether the first probability is less than a preset first probability threshold;

[0014] When the first probability is less than the first probability threshold, determining that the network access behavior deviates from the network access habit of the individual user;

[0015] When the first probability is greater than or equal to the first probability threshold, it is determined that the network access behavior does not deviate from the network access habit of the individual user.

[0016] In an optional implementation manner of the present application, determining the first probability of occurrence of the network access behavior based on historical network access information of the individual user includes:

[0017] Using a pre-trained first behavior analysis model, performing a first behavior analysis on the network access information to determine a first probability of the network access behavior occurring;

[0018] The first behavior analysis model is trained based on the historical network access information of the individual user.

[0019] In an optional implementation manner of the present application, performing a second behavior analysis on the network access information based on the historical network access information of the department center to obtain a second behavior analysis result for the network access information includes:

[0020] Determining a second probability of occurrence of the network access behavior based on historical network access information of the department center;

[0021] Determining whether the second probability is less than a preset second probability threshold;

[0022] When the second probability is less than the second probability threshold, it is determined that the network access behavior deviates from the network access habit of the department center.

[0023] When the second probability is greater than or equal to the second probability threshold, it is determined that the network access behavior does not deviate from the network access habit of the department center.

[0024] In an optional implementation manner of the present application, determining the second probability of occurrence of the network access behavior based on historical network access information of the department center includes:

[0025] Using a pre-trained second behavior analysis model, performing a second behavior analysis on the network access information to determine a second probability of the network access behavior occurring;

[0026] The second behavior analysis model is trained based on the historical network access information of the department center.

[0027] In an optional embodiment of the present application, the first behavior analysis model is trained in the following manner:

[0028] Determining a first tag of the historical network access information of the individual user; the first tag is used to identify whether the historical network access behavior of the individual user deviates from the network access habits of the individual user;

[0029] The first behavior analysis model is trained using the historical network access information of the individual user and the first label as training samples.

[0030] In an optional embodiment of the present application, the second behavior analysis model is trained in the following manner:

[0031] Determine a second tag of the historical network access information of the department center; the second tag is used to indicate whether the historical network access behavior of the department center deviates from the network access habits of the department center;

[0032] The second behavior analysis model is trained using the historical network access information of the department center and the second label as training samples.

[0033] On one hand, the present application provides a behavior analysis device, comprising:

[0034] An acquisition unit, configured to acquire network access information generated by network access behavior;

[0035] a first analyzing unit configured to perform a first behavior analysis on the network access information based on the historical network access information of the individual user, to obtain a first behavior analysis result for the network access information; wherein the first behavior analysis result indicates whether the network access behavior deviates from the network access habits of the individual user;

[0036] The second analysis unit is used to perform a second behavior analysis on the network access information based on the historical network access information of the department center when the network access behavior deviates from the network access habits of individual users, so as to obtain a second behavior analysis result for the network access information; wherein the second behavior analysis result indicates whether the network access behavior deviates from the network access habits of the department center.

[0037] On one hand, the present application provides an electronic device, including:

[0038] processor;

[0039] a memory for storing instructions executable by the processor;

[0040] The processor is used to execute the above-mentioned behavior analysis method by running the instructions in the memory.

[0041] On one hand, the present application provides a computer storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned behavior analysis method is executed.

[0042] Compared with the prior art, this application has the following advantages:

[0043] The present application provides a behavior analysis method, device, electronic device and storage medium. The behavior analysis method includes: obtaining network access information generated by network access behavior; performing a first behavior analysis on the network access information based on the historical network access information of an individual user, and obtaining a first behavior analysis result for the network access information; wherein the first behavior analysis result indicates whether the network access behavior deviates from the network access habits of the individual user; if the network access behavior deviates from the network access habits of the individual user, performing a second behavior analysis on the network access information based on the historical network access information of a department center, and obtaining a second behavior analysis result for the network access information; wherein the second behavior analysis result indicates whether the network access behavior deviates from the network access habits of the department center.

[0044] The behavioral analysis method performs a first behavioral analysis on the network access information generated by the network access behavior, and when the first analysis result indicates that the network access behavior deviates from the network access habits of individual users, performs a second behavioral analysis on the network access information, and then determines whether the network access behavior deviates from the network access habits of the department center. This solution analyzes whether the network access behavior deviates from the network access habits of individual users and the network access habits of the department center in turn, and can more efficiently and accurately detect suspicious network access behavior, can effectively detect potential abnormal network behavior when accessing the internal system of the enterprise through a browser, and effectively reduce the false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0046] Figure 1 A flow chart of the first behavior analysis method provided in an embodiment of the present application;

[0047] Figure 2 A flow chart of the second behavior analysis method provided in an embodiment of the present application;

[0048] Figure 3 A schematic diagram of the structure of a behavior analysis device provided in an embodiment of the present application;

[0049] Figure 4 A schematic diagram of the electronic device structure provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In the field of information security, personal terminals can communicate directly with the external internet and connect to internal corporate networks, making them easy targets for hacker attacks. In practice, attackers often use social engineering tactics to deceive users into obtaining sensitive information and infiltrating internal networks. For example, positions such as customer service, human resources, and sales often provide contact information and services publicly available. Attackers can use this information to locate personnel and launch targeted phishing attacks.

[0051] Currently, most responses to phishing attempts are through account authorization, access address authorization, security product alerts, and continuous strengthening of employee information security awareness. However, this approach cannot determine whether the current user terminal has been compromised, or whether the user's account has become an attacker's, and it is even more impossible to proactively discover and alert to subsequent malicious access behaviors.

[0052] Therefore, how to analyze users' network access behaviors in order to discover suspicious network access behaviors has become a technical problem that those skilled in the art urgently need to solve.

[0053] To solve the above technical problems, the present application provides a behavior analysis method, device, electronic device, and storage medium. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0054] Exemplary Methods

[0055] The embodiment of the present application first provides a behavior analysis method, the core of which is to perform a first behavior analysis on the network access information generated by the network access behavior, and when the first analysis result indicates that the network access behavior deviates from the network access habits of individual users, perform a second behavior analysis on the network access information, and then determine whether the network access behavior deviates from the network access habits of the department center. This solution successively analyzes whether the network access behavior deviates from the network access habits of individual users and the network access habits of the department center, efficiently and accurately detects suspicious network access behavior, effectively detects potential abnormal network behavior when accessing the internal system of the enterprise through a browser, and reduces the false alarm rate.

[0056] In an optional embodiment of the present application, the implementation subject of the behavior analysis method can be various types of user terminals such as laptops, tablet computers, desktop computers, mobile devices (for example, mobile phones, portable music players, personal digital assistants, dedicated messaging devices), or a combination of any two or more of these data processing devices, or a server.

[0057] Please refer to Figure 1 , Figure 1 This is a flow chart of the first behavior analysis method provided in an embodiment of the present application.

[0058] like Figure 1 As shown, the behavior analysis method includes the following steps S101 to S103:

[0059] Step S101, obtaining network access information generated by network access behavior;

[0060] Network access behavior can be understood as the activities and actions of users on the Internet. In the embodiment of the present application, the network access behavior includes: users browsing web pages, visiting websites, searching for information, etc. on the Internet, users using search engines to search for keywords to obtain specific information or resources, users' shopping behavior on e-commerce platforms, users' application usage behavior of installing, opening, and using applications on terminal devices such as computers, tablets, and mobile phones, etc.

[0061] The network access information includes the user account used by the user to perform network access behavior, terminal device information, browser process information that initiates network access, etc. When high-risk groups such as customer service, human resources, and sales departments access the company's internal systems through a browser, the network access information also includes department center information and internal business system information accessed by the user (such as URL information or IP address and port information).

[0062] Specifically, as shown in Table 1 below, the network access information may include the following:

[0063] Table 1:

[0064]

[0065] Step S102: Based on the historical network access information of the individual user, a first behavior analysis is performed on the network access information to obtain a first behavior analysis result for the network access information; wherein the first behavior analysis result indicates whether the network access behavior deviates from the network access habits of the individual user.

[0066] The historical network access information of the individual user can be understood as the network access information generated when different users perform network access behaviors through browsers. In the embodiment of the present application, the historical network access information of the individual user can be obtained based on the network access behavior log of the individual user.

[0067] Furthermore, based on the historical network access information of the individual user, a first behavioral analysis is performed on the network access information. Obtaining the first behavioral analysis result for the network access information means using the historical network access information of the individual user to determine whether the current network access behavior is consistent with the user's network access habits, and then judging whether the current network access behavior is abnormal behavior.

[0068] In an optional implementation of the present application, the above step S102 includes the following steps S1 to S4:

[0069] Step S1, determining a first probability of occurrence of the network access behavior based on historical network access information of an individual user;

[0070] Step S2, determining whether the first probability is less than a preset first probability threshold;

[0071] Step S3: if the first probability is less than the first probability threshold, determining that the network access behavior deviates from the network access habit of the individual user;

[0072] Step S4: When the first probability is greater than or equal to the first probability threshold, determine that the network access behavior does not deviate from the network access habit of the individual user.

[0073] Specifically, the above steps S1 to S4 refer to determining whether the network access behavior is a risk event through a preset probability threshold and the probability of the network access behavior occurring in an individual user. That is, the lower the probability of the network access behavior occurring, the more the network access behavior deviates from the user's network access habits, and the higher the risk of this network access behavior.

[0074] In an optional implementation manner of the present application, it is assumed that the network access information of the network access behavior includes: i 、D i 、S i 、Proc i , that is, the user's network access behavior is user U i In Terminal D i Internal business system S i Access process Proc i ; At this time, the first probability can be expressed by the following formula (1):

[0075] P(L)=P(U i ,D i ,S i ,Proc i )

[0076] =P(U i )·P(D i |U i )·P(S i |D i ,U i )·P(Proc i |S i ,D i ,U i ) (1);

[0077] Wherein, P(L) represents the first probability; P(U i ) indicates account number U i The probability of initiating a network access request; P(D i │U i ) means through account U iWhen initiating a network access request, the access terminal used is D i The probability of P(S i |D i ,U i ) indicates account number U i Using Terminal D i When initiating a network access request, access the internal business system S i The probability of P(Proc i |S i ,D i ,U i ) means through account U i Access internal business systems i When the browser process used is Proc i probability.

[0078] Furthermore, suppose that a company has N employee accounts, where the i-th account is U i , in a period of time, account U i The total number of network access behaviors initiated is w i , then account number U i The probability of initiating network access behavior P(U i ) can be expressed by the following formula (2):

[0079]

[0080] Among them, w1+w2+...+w i +...+w N Indicates the total number of network access events initiated by all accounts.

[0081] Furthermore, in the known account U i The total number of network access behaviors initiated is w i In the case of i,d The network access event is account U i In Terminal D i If it is initiated on i When initiating a network access request, the access terminal used is D i The probability P(D i |U i ) can be expressed by the following formula (3):

[0082]

[0083] Furthermore, assuming that i,d Among the network access events, there are a total of w i,d,s The network access event of the file is to access the internal business system Si If the account number is U i Using Terminal D i When initiating a network access request, access the internal business system S i The probability P(S i |D i ,U i ) can be expressed by the following formula (4):

[0084]

[0085] Furthermore, assuming that i,d,s Among the network access events of the i,d,s,proc The network access event of the file is caused by the browser process Proc i Initiated by account U i Access internal business systems i When the browser process used is Proc i The probability P(Proc i |S i ,D i ,U i ) can be expressed by the following formula (5):

[0086]

[0087] Finally, based on the above formulas (2) to (5), P(L) in the above formula (1) can be expressed by the following formula (6):

[0088]

[0089] After obtaining the probability of occurrence of each of the network access behaviors, in order to improve the calculation efficiency of the first probability of subsequent network access behaviors, the network access information can be recorded corresponding to the first probability, so that after the same network access behavior occurs, it can be directly matched with the recorded network access information to obtain the corresponding first probability.

[0090] For example, please refer to Table 2, which is a first behavior analysis data table provided in the embodiment of this application:

[0091] Table 2:

[0092]

[0093]

[0094] As shown in Example 1, when the (account, terminal ID, department center, internal business system, browser process name) in the network access information is (001, 1, A, 8080, chrome), the probability of the network access behavior that generates the network access information is 0.01. When the current network access behavior is the same as it, the probability of the current network access behavior occurring is also determined to be 0.01.

[0095] If the corresponding network access information cannot be matched, or the first probability is less than a preset second probability threshold, step S103 is further performed.

[0096] In another optional embodiment of the present application, the above-mentioned step S1 can also be implemented through a pre-trained first analysis model, that is, using the pre-trained first behavior analysis model, the network access information is subjected to a first behavior analysis process to determine the first probability of the network access behavior occurring; wherein, the first behavior analysis model is trained based on the historical network access information of the individual user.

[0097] The first behavior analysis model can be understood as a neural network. In specific applications, it can be trained using machine learning (ML). Machine learning (a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, algorithmic complexity theory, and other disciplines) is dedicated to studying how to acquire new knowledge or skills through training samples, reorganize existing knowledge structures, and continuously improve its own performance. Machine learning typically includes technologies such as artificial neural networks, belief networks, reinforcement learning, transfer learning, and inductive learning, and is a branch of artificial intelligence (AI).

[0098] In this embodiment of the present application, the first behavior analysis model can be trained in the following manner:

[0099] Determine a first label for the personal user's historical network access information; the first label is used to identify whether the personal user's historical network access behavior deviates from the personal user's network access habits; use the personal user's historical network access information and the first label as training samples to train the first behavior analysis model.

[0100] The first label can be understood as a label that categorizes an individual user's historical network access information to identify whether the historical network access information deviates from the individual user's network access habits. In actual application, the first label can be represented by 0 or 1, where 0 indicates that the historical network access information deviates from the individual user's network access habits, and 1 indicates that the historical network access information does not deviate from the individual user's network access habits.

[0101] After the first behavior analysis model is obtained through training, the network access information corresponding to the network access information can be input into the first behavior analysis model, so that the first behavior analysis model outputs a first probability of occurrence of the network access behavior corresponding to the network access information.

[0102] In an optional embodiment of the present application, the training of the first behavior analysis model can be periodic. For example, the network access information of different users is recorded every day as historical network access information, and during non-working hours, the first behavior analysis model is trained in combination with the network access information of the day and its corresponding first label.

[0103] Furthermore, after obtaining the first probability, the above step S2 is performed to determine whether the network access behavior deviates from the network access habits of the individual user.

[0104] In an optional implementation of the present application, the first probability threshold of the above-mentioned step S2 can be set to the minimum value of the probability of all network access events occurring among individual users, or the corresponding probability threshold can be set according to the actual situation of different network access events (for example, the corresponding probability threshold can be set based on information such as the category of different network access events). This application does not impose any restrictions on this.

[0105] In the case that the network access behavior does not deviate from the network access habits of individual users, it can be considered that the risk level of the network access behavior is low. In this case, an alarm will no longer be issued for the network access behavior.

[0106] In the case that the network access behavior deviates from the network access habits of individual users, the following step S103 is executed to further analyze the network access behavior in combination with the network access habits of the department center.

[0107] Step S103, when the network access behavior deviates from the network access habits of individual users, a second behavior analysis is performed on the network access information based on the historical network access information of the department center to obtain a second behavior analysis result for the network access information; wherein, the second behavior analysis result indicates whether the network access behavior deviates from the network access habits of the department center.

[0108] The historical network access information of the department center can be understood as network access information generated by users performing network access behaviors through a group browser within the enterprise.

[0109] In an optional implementation of the present application, performing a second behavior analysis on the network access information to obtain a second behavior analysis result for the book search network access information includes the following steps S5 to S8:

[0110] Step S5, determining a second probability of the network access behavior occurring based on the historical network access information of the department center;

[0111] Step S6, determining whether the second probability is less than a preset second probability threshold;

[0112] Step S7: If the second probability is less than the second probability threshold, determining that the network access behavior deviates from the network access habit of the department center

[0113] Step S8: When the second probability is greater than or equal to the second probability threshold, determine that the network access behavior does not deviate from the network access habits of the department center.

[0114] Specifically, the above steps S5 to S8 refer to re-evaluating the risk of risky network access behaviors based on a preset probability threshold and the probability of the network access behaviors occurring in the department center.

[0115] In an optional implementation of the present application, it is assumed that the network access information of the network access behavior includes: C i 、S i 、Proc i , i.e., department center C i The group browser through the internal business system S i Access process Proc i ; At this time, the second probability can be expressed by the following formula (7):

[0116] P(G)=P(C i ,S i ,Proc i )

[0117] =P(C i )·P(S i |C i )·P(Proc i |S i ,C i ) (7);

[0118] Wherein, P(G) represents the second probability; P(Ci ) represents the department center C i The probability of initiating network access behavior; P(S i |C i ) represents the department center C i When initiating network access behavior, access internal business system C i The probability of P(Proc i |S i ,C i ) represents the department center C i Access internal business systems i When the browser process used is Proc i probability.

[0119] Furthermore, suppose that the enterprise has N department centers, among which the i-th department center is C i , over a period of time, the department center C i The total number of network access behaviors initiated is w i , then the department center C i The probability of initiating network access behavior P(C i ) can be expressed by the following formula (8):

[0120]

[0121] Among them, w1+w2+...+w i +...+w N Indicates the total number of network access behavior events initiated by all department centers.

[0122] Furthermore, in the known department center C i The total number of network access behaviors initiated is w i In the case of w i There are w network access events i,s The network access event is access to the internal business system S i If the department center C i When initiating network access behavior, access internal business system C i The probability P(S i |C i ) can be expressed by the following formula (9):

[0123]

[0124] Furthermore, assuming that w i,s Among the network access events, there are w i,s,Proc The network access event of the file is caused by the browser process Proc i Initiated by the department center C iAccess internal business systems i When the browser process used is Proc i The probability P(Proc i |S i ,C i ) can be expressed by the following formula (10):

[0125]

[0126] Finally, based on the above formulas (8) to (10), P(G) in the above formula (7) can be expressed by the following formula (11):

[0127]

[0128] After obtaining the probability of occurrence of each network access behavior, in order to improve the efficiency of calculating the second probability of subsequent network access behaviors, the network access information can be recorded in correspondence with the second probability. After the same network access behavior occurs, it can be directly matched with the recorded network access information to obtain the corresponding second probability.

[0129] For example, as shown in Table 3, Table 3 is a second behavior analysis data table provided in an embodiment of the present application:

[0130] Table 3:

[0131]

[0132]

[0133] As shown in Example 5, when the (department center, internal business system, browser process name) in the network access information is (A, 8080, chrome), the probability of the network access behavior that generates the network access information is 0.001. When the current network access behavior is the same as it, the probability of the current network access behavior is also 0.001. The probability of occurrence at this time is less than 0.001. In this case, the network access behavior does not deviate from the network access behavior of the department center, and no alarm is required.

[0134] If the corresponding network access information cannot be matched, or the second probability is less than a preset second probability threshold, the network access is considered abnormal, that is, the network access behavior deviates from the network access habits of the department center.

[0135] Furthermore, in order to facilitate understanding of the above process of defining the first probability and the second probability by calculation to analyze the network access behavior, the process is further explained below in combination with Table 2, Table 3, and Table 4 below.

[0136] Table 4:

[0137]

[0138] For example, in Example 9, the network access behavior can find a matching result in Table 2, and the first probability of the network access behavior is 0.001, which is greater than the corresponding probability threshold of 0.0001. In this case, the analysis result of the network access behavior is directly output as "normal".

[0139] For example, in Example 10, the network access behavior cannot be matched to a corresponding matching result in Table 2. In this case, further matching is performed in Table 3, and the second probability of the network access behavior is obtained to be 0.001, which is greater than the corresponding probability threshold of 0.0001. In this case, the analysis result of the network access behavior is directly output as "normal";

[0140] As shown in Example 11, the network access behavior cannot be matched to the corresponding results in Table 2 and Table 3, so the probability of the network access behavior occurring is 0, and the behavior analysis result is "warning".

[0141] In another optional embodiment of the present application, the above-mentioned step S5 can also be implemented through a pre-trained second analysis model, that is, using a pre-trained second behavior analysis model, a second behavior analysis is performed on the network access information to determine the second probability of the network access behavior occurring; wherein, the second behavior analysis model is trained based on the historical network access information of the department center.

[0142] Corresponding to the first behavior analysis model, the second behavior analysis model is also a neural network and can be obtained through machine learning training.

[0143] Specifically, in the embodiment of the present application, the second behavior analysis model is trained in the following manner:

[0144] Determine a second label of the historical network access information of the department center; the second label is used to indicate whether the historical network access behavior of the department center deviates from the network access habits of the department center; use the historical network access information of the department center and the second label as training samples to train the second behavior analysis model.

[0145] The second label can be understood as a label that categorizes the department center's historical network access information to indicate whether this historical access information deviates from the department center's network access habits. In actual applications, the second label can also be represented by 0 or 1, where 0 indicates that the historical network access information deviates from the department center's network access habits, and 1 indicates that the historical network access information does not deviate from the department center's network access habits.

[0146] After the second behavior analysis model is obtained through training, when the network access behavior deviates from the network access habits of individual users, the network access information can be input into the second behavior analysis model so that the second behavior analysis model outputs a second probability of the network access behavior occurring.

[0147] In an optional embodiment of the present application, the training of the second behavior analysis model can also be periodic. For example, the network access information of different users is recorded every day as historical network access information, and during non-working hours, the second behavior analysis model is trained in combination with the network access information of the day and its corresponding second label.

[0148] Furthermore, after obtaining the second probability, the above step S6 is executed to determine whether the network access behavior deviates from the network access habits of the department center.

[0149] In an embodiment of the present application, the second probability threshold is set in a manner similar to the first probability threshold. The second probability threshold can be set to the minimum probability value occurring in the group servers of all department centers, or the corresponding probability threshold can be set according to the actual situation of different network access events (for example, the corresponding probability threshold can be set based on information such as the category of different network access events). This application does not impose any restrictions on this.

[0150] In the case that the network access behavior does not deviate from the network access habits of the department center, it can be considered that the risk level of the network access behavior is low. At this time, the network access behavior will no longer be alarmed.

[0151] In order to facilitate understanding of the above behavior analysis method provided in the embodiment of the present application, the following Figure 2 This method is further explained.

[0152] Please refer to Figure 2 , Figure 2 This is a flow chart of the second behavior analysis method provided in an embodiment of the present application.

[0153] like Figure 2 As shown, when the terminal device generates network access behavior, the terminal device sends the network access information corresponding to the network access behavior to the pre-trained first behavior analysis model through the server, so that the first behavior analysis model analyzes the network access behavior and outputs the first behavior analysis result.

[0154] When the first behavior analysis result shows that the network access behavior deviates from the network access habits of the individual user, the network access information corresponding to the network access behavior is sent to a pre-trained second behavior analysis model, so that the second behavior analysis model analyzes the network access behavior again and outputs a second behavior analysis result.

[0155] When the first behavior analysis result indicates that the network access behavior deviates from the network access habits of individual users, and the second behavior analysis result indicates that the network access behavior deviates from the network access habits of the department center, an alarm is issued for the network access behavior, and corresponding work is generated and sent to the work order system, so that relevant staff can pay attention to the network access behavior in a timely manner and take corresponding measures.

[0156] In the process of sending the network access information to the first behavior analysis model, the network access information is stored through storage tools such as HDFS (such as the memory database Redis) to facilitate training the first behavior analysis model and the second behavior analysis model in combination with corresponding labels.

[0157] To sum up, the behavioral analysis method performs a first behavioral analysis on the network access information generated by the network access behavior, and when the first analysis result indicates that the network access behavior deviates from the network access habits of individual users, performs a second behavioral analysis on the network access information, and then determines whether the network access behavior deviates from the network access habits of the department center. This scheme analyzes whether the network access behavior deviates from the network access habits of individual users and the network access habits of the department center in turn, and can more efficiently and accurately detect suspicious network access behaviors, can effectively detect potential abnormal network behaviors when accessing the internal enterprise system through a browser, and effectively reduce the false alarm rate.

[0158] Exemplary devices

[0159] Similar to the above behavior analysis method, this application also provides a behavior analysis device, please refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of the behavior analysis device provided in an embodiment of the present application.

[0160] like Figure 3 As shown, the behavior analysis device includes:

[0161] An acquisition unit 301 is configured to acquire network access information generated by network access behavior;

[0162] A first analyzing unit 302 is configured to perform a first behavior analysis on the network access information based on the historical network access information of the individual user, to obtain a first behavior analysis result for the network access information; wherein the first behavior analysis result indicates whether the network access behavior deviates from the network access habits of the individual user;

[0163] The second analysis unit 303 is used to perform a second behavior analysis on the network access information based on the historical network access information of the department center when the network access behavior deviates from the network access habits of individual users, so as to obtain a second behavior analysis result for the network access information; wherein the second behavior analysis result indicates whether the network access behavior deviates from the network access habits of the department center.

[0164] In an optional implementation manner of the present application, performing a first behavior analysis on the network access information based on the historical network access information of the individual user to obtain a first behavior analysis result for the network access information includes:

[0165] Determining a first probability of occurrence of the network access behavior based on historical network access information of the individual user;

[0166] Determining whether the first probability is less than a preset first probability threshold;

[0167] When the first probability is less than the first probability threshold, determining that the network access behavior deviates from the network access habit of the individual user;

[0168] When the first probability is greater than or equal to the first probability threshold, it is determined that the network access behavior does not deviate from the network access habit of the individual user.

[0169] In an optional implementation manner of the present application, determining the first probability of occurrence of the network access behavior based on historical network access information of the individual user includes:

[0170] Using a pre-trained first behavior analysis model, performing a first behavior analysis on the network access information to determine a first probability of the network access behavior occurring;

[0171] The first behavior analysis model is trained based on the historical network access information of the individual user.

[0172] In an optional implementation manner of the present application, performing a second behavior analysis on the network access information based on the historical network access information of the department center to obtain a second behavior analysis result for the network access information includes:

[0173] Determining a second probability of occurrence of the network access behavior based on historical network access information of the department center;

[0174] Determining whether the second probability is less than a preset second probability threshold;

[0175] When the second probability is less than the second probability threshold, it is determined that the network access behavior deviates from the network access habit of the department center.

[0176] When the second probability is greater than or equal to the second probability threshold, it is determined that the network access behavior does not deviate from the network access habit of the department center.

[0177] In an optional implementation manner of the present application, determining the second probability of occurrence of the network access behavior based on historical network access information of the department center includes:

[0178] Using a pre-trained second behavior analysis model, performing a second behavior analysis on the network access information to determine a second probability of the network access behavior occurring;

[0179] The second behavior analysis model is trained based on the historical network access information of the department center.

[0180] In an optional embodiment of the present application, the first behavior analysis model is trained in the following manner:

[0181] Determining a first tag of the historical network access information of the individual user; the first tag is used to identify whether the historical network access behavior of the individual user deviates from the network access habits of the individual user;

[0182] The first behavior analysis model is trained using the historical network access information of the individual user and the first label as training samples.

[0183] In an optional embodiment of the present application, the second behavior analysis model is trained in the following manner:

[0184] Determine a second tag of the historical network access information of the department center; the second tag is used to indicate whether the historical network access behavior of the department center deviates from the network access habits of the department center;

[0185] The second behavior analysis model is trained using the historical network access information of the department center and the second label as training samples.

[0186] The behavior analysis device provided in this embodiment is based on the same concept as the behavior analysis method provided in the above embodiments of this application. It can execute the behavior analysis method provided in any of the above embodiments of this application and has the corresponding functional modules and beneficial effects of executing the behavior analysis method. For technical details not fully described in this embodiment, please refer to the specific processing content of the behavior analysis method provided in the above embodiments of this application and will not be repeated here.

[0187] It should be understood that the units in the above devices can be implemented in the form of a processor calling software. For example, the device includes a processor, the processor is connected to a memory, and the memory stores instructions. The processor calls the instructions stored in the memory to implement any of the above methods or realize the functions of each unit of the device. The processor can be a general-purpose processor, such as a CPU or a microprocessor, and the memory can be a memory within the device or a memory outside the device. Alternatively, the units in the device can be implemented in the form of hardware circuits. The functions of some or all units can be realized by designing the hardware circuits. The hardware circuit can be understood as one or more processors. For example, in one implementation, the hardware circuit is an ASIC, and the functions of some or all of the above units can be realized by designing the logical relationships between the components within the circuit. For another example, in another implementation, the hardware circuit can be implemented by a PLD. For example, an FPGA can include a large number of logic gate circuits. The connection relationships between the logic gate circuits are configured through a configuration file to realize the functions of some or all of the above units. All units of the above devices can be implemented entirely in the form of a processor calling software, or entirely in the form of hardware circuits, or partially in the form of a processor calling software, with the remaining parts implemented in the form of hardware circuits.

[0188] In an embodiment of the present application, a processor is a circuit with the ability to process signals. In one implementation, the processor may be a circuit with the ability to read and execute instructions, such as a CPU, a microprocessor, a GPU, or a DSP. In another implementation, the processor may implement certain functions through the logical relationship of a hardware circuit, and the logical relationship of the hardware circuit may be fixed or reconfigurable, such as a hardware circuit implemented by an ASIC or PLD, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the configuration of the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as an NPU, TPU, DPU, etc.

[0189] It can be seen that each unit in the above device can be one or more processors (or processing circuits) configured to implement the above method, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0190] In addition, the various units in the above apparatus may be fully or partially integrated together, or may be implemented independently. In one implementation, these units are integrated together and implemented in the form of a system-on-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of the various units of the apparatus. The at least one processor may be of different types, such as a CPU and an FPGA, a CPU and an artificial intelligence processor, a CPU and a GPU, etc.

[0191] Exemplary electronic devices

[0192] Another embodiment of the present application also provides an electronic device, please refer to Figure 4 , Figure 4 A schematic diagram of the electronic device structure provided in an embodiment of the present application.

[0193] like Figure 4 As shown, the electronic device includes:

[0194] Memory 200 and processor 210;

[0195] The memory 200 is connected to the processor 210 and is used to store programs;

[0196] The processor 210 is configured to implement the behavior analysis method disclosed in any of the above embodiments by running the program stored in the memory 200 .

[0197] Specifically, the electronic device may further include: a bus, a communication interface 220 , an input device 230 and an output device 240 .

[0198] The processor 210, the memory 200, the communication interface 220, the input device 230 and the output device 240 are interconnected via a bus.

[0199] A bus may include a pathway that transfers information between components of a computer system.

[0200] Processor 210 can be a general-purpose processor, such as a general-purpose central processing unit (CPU), a microprocessor, or the like, or an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present invention. Alternatively, it can be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware components.

[0201] The processor 210 may include a main processor, and may also include a baseband chip, a modem, and the like.

[0202] The memory 200 stores a program for executing the technical solution of the present invention, and may also store an operating system and other key services. Specifically, the program may include program code, which includes computer operating instructions. More specifically, the memory 200 may include read-only memory (ROM), other types of static storage devices that can store static information and instructions, random access memory (RAM), other types of dynamic storage devices that can store information and instructions, disk storage, flash memory, etc.

[0203] The input device 230 may include a device for receiving data and information input by a user, such as a keyboard, a mouse, a camera, a scanner, a light pen, a voice input device, a touch screen, a pedometer, or a gravity sensor.

[0204] Output device 240 may include devices that allow information to be output to a user, such as a display screen, printer, speakers, etc.

[0205] The communication interface 220 may include any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc.

[0206] The processor 210 executes the program stored in the memory 200 and calls other devices, which can be used to implement each step of any behavior analysis method provided in the above embodiments of the present application.

[0207] Exemplary computer program products and storage media

[0208] In addition to the above-mentioned methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the behavior analysis method according to various embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification.

[0209] The computer program product may be written in any combination of one or more programming languages to implement the program code for performing the operations of the embodiments of the present application, including object-oriented programming languages such as Java, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0210] In addition, an embodiment of the present application may also be a storage medium on which a computer program is stored, and the computer program is executed by a processor to execute the steps of the behavior analysis method according to various embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0211] For the sake of simplicity, the aforementioned method embodiments are described as a series of action combinations. However, those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0212] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similarities between the various embodiments can be referred to in conjunction with each other. For device embodiments, since they are generally similar to method embodiments, their description is relatively simple, and for relevant details, reference can be made to the description of the method embodiments.

[0213] The steps in the methods of each embodiment of the present application can be adjusted in sequence, merged, and deleted according to actual needs, and the technical features recorded in each embodiment can be replaced or combined.

[0214] The modules and sub-modules in the devices and terminals of the various embodiments of the present application can be merged, divided, and deleted according to actual needs.

[0215] In the several embodiments provided in this application, it should be understood that the disclosed terminals, devices, and methods can be implemented in other ways. For example, the terminal embodiments described above are merely illustrative. For example, the division of modules or submodules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple submodules or modules can be combined or integrated into another module, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or module, which can be electrical, mechanical or other forms.

[0216] The modules or submodules described as separate components may or may not be physically separate, and the components of the modules or submodules may or may not be physical modules or submodules, that is, they may be located in one place or distributed across multiple network modules or submodules. Some or all of the modules or submodules may be selected to achieve the purpose of this embodiment according to actual needs.

[0217] In addition, each functional module or submodule in each embodiment of the present application may be integrated into a processing module, or each module or submodule may exist physically separately, or two or more modules or submodules may be integrated into a single module. The above-mentioned integrated modules or submodules may be implemented in the form of hardware or software functional modules or submodules.

[0218] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0219] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, software units executed by a processor, or a combination of the two. The software units may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0220] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0221] The above description of the disclosed embodiments will enable those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is to be construed in the widest manner consistent with the principles and novel features disclosed herein.

Claims

1. A behavior analysis method, characterized in that: include: Obtain network access information generated by network access behavior; Based on the historical network access information of the individual user, performing a first behavior analysis on the network access information to obtain a first behavior analysis result for the network access information; wherein the first behavior analysis result indicates whether the network access behavior deviates from the network access habits of the individual user; In the case that the network access behavior deviates from the network access habits of individual users, a second behavior analysis is performed on the network access information based on the historical network access information of the department center to obtain a second behavior analysis result for the network access information; wherein, the second behavior analysis result indicates whether the network access behavior deviates from the network access habits of the department center.

2. The method according to claim 1, characterized in that The performing a first behavior analysis on the network access information based on the historical network access information of the individual user to obtain a first behavior analysis result for the network access information includes: Determining a first probability of occurrence of the network access behavior based on historical network access information of the individual user; Determining whether the first probability is less than a preset first probability threshold; When the first probability is less than the first probability threshold, determining that the network access behavior deviates from the network access habit of the individual user; When the first probability is greater than or equal to the first probability threshold, it is determined that the network access behavior does not deviate from the network access habit of the individual user.

3. The method according to claim 2, characterized in that The determining, based on the historical network access information of the individual user, a first probability of occurrence of the network access behavior includes: Using a pre-trained first behavior analysis model, performing a first behavior analysis on the network access information to determine a first probability of the network access behavior occurring; The first behavior analysis model is trained based on the historical network access information of the individual user.

4. The method according to claim 1, wherein The performing a second behavior analysis on the network access information based on the historical network access information of the department center to obtain a second behavior analysis result for the network access information includes: Determining a second probability of occurrence of the network access behavior based on historical network access information of the department center; Determining whether the second probability is less than a preset second probability threshold; When the second probability is less than the second probability threshold, it is determined that the network access behavior deviates from the network access habit of the department center. When the second probability is greater than or equal to the second probability threshold, it is determined that the network access behavior does not deviate from the network access habit of the department center.

5. The method according to claim 4, characterized in that The determining, based on the historical network access information of the department center, a second probability of occurrence of the network access behavior includes: Using a pre-trained second behavior analysis model, performing a second behavior analysis on the network access information to determine a second probability of the network access behavior occurring; The second behavior analysis model is trained based on the historical network access information of the department center.

6. The method according to claim 3, characterized in that The first behavior analysis model is trained in the following manner: Determining a first tag of the historical network access information of the individual user; the first tag is used to identify whether the historical network access behavior of the individual user deviates from the network access habits of the individual user; The first behavior analysis model is trained using the historical network access information of the individual user and the first label as training samples.

7. The method according to claim 5, characterized in that The second behavior analysis model is trained in the following manner: Determine a second tag of the historical network access information of the department center; the second tag is used to indicate whether the historical network access behavior of the department center deviates from the network access habits of the department center; The second behavior analysis model is trained using the historical network access information of the department center and the second label as training samples.

8. A behavior analysis device, characterized in that: include: An acquisition unit, configured to acquire network access information generated by network access behavior; a first analyzing unit configured to perform a first behavior analysis on the network access information based on the historical network access information of the individual user, to obtain a first behavior analysis result for the network access information; wherein the first behavior analysis result indicates whether the network access behavior deviates from the network access habits of the individual user; The second analysis unit is used to perform a second behavior analysis on the network access information based on the historical network access information of the department center when the network access behavior deviates from the network access habits of individual users, so as to obtain a second behavior analysis result for the network access information; wherein the second behavior analysis result indicates whether the network access behavior deviates from the network access habits of the department center.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the behavior analysis method according to any one of claims 1 to 7 by running instructions in the memory.

10. A computer storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by the processor, the behavior analysis method according to any one of claims 1 to 7 is executed.

Images