A log data management method for terminal access authentication

Abstract

The present application relates to the technical field of data processing, and especially relates to a log data management method for terminal access authentication, which comprises the following steps: in the log data of the access authentication of a target terminal, according to all authentication success transactions of any target user, the Apriori algorithm is used to obtain the behavior association rule of any target user; according to the time law of each authentication success of any target user, the habit association rule of any target user is obtained; each habit association rule and each behavior association rule are associated to obtain the behavior habit association rule of any target user; according to the support degree and the confidence degree of the corresponding behavior association rule and habit association rule of each behavior habit association rule, the frequent association rule of any target user is obtained; and according to the frequent association rule of each target user, the target terminal is detected abnormally, so that the accuracy of the abnormal behavior detection of the log data of the target terminal authentication is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a log data management method for terminal access authentication. BACKGROUND

[0002] With the continuous expansion and complication of network application, network security problems are increasingly prominent, becoming a key factor restricting the further development of the network. The importance of terminal access authentication, as the first line of defense for network security, is self-evident. The terminal access authentication process involves multiple links and systems, such as authentication servers, network devices, terminal devices, etc. Each link will generate corresponding log data, so that the log data of different systems and different links can be associated and analyzed to discover potential threats in a timely manner.

[0003] In the traditional way, the Apriori algorithm is used to preliminarily analyze the terminal authentication log data, and the association relationship between different attributes is mined to quickly discover abnormal behavior. However, the Apriori algorithm mainly focuses on the co-occurrence relationship between item sets, and it is difficult to directly mine the time series pattern of log data, so the mining of association relationship is not comprehensive, and potential association relationship is easily missed, making the detection of abnormal behavior not comprehensive enough.

[0004] Therefore, how to more comprehensively mine the association relationship between different attributes in the terminal authentication log data to improve the accuracy of abnormal behavior detection of the terminal authentication log data has become a problem to be solved. SUMMARY

[0005] Therefore, the embodiments of the present application provide a log data management method for terminal access authentication to solve the problem of how to more comprehensively mine the association relationship between different attributes in the terminal authentication log data to improve the accuracy of abnormal behavior detection of the terminal authentication log data.

[0006] The log data management method for terminal access authentication provided in the embodiments of the present application comprises the following steps:

[0007] According to the log data of the access authentication of the target terminal, at least one authentication success transaction of all users is obtained, the authentication transaction contains at least one item, the number of authentication success transactions of each user is obtained to obtain a target user, for any target user, according to all items in each authentication success transaction of the target user, the Apriori algorithm is used to obtain at least one behavior association rule of the target user, and the support and confidence of each behavior association rule.

[0008] According to the time of each authentication success of the any target user and a preset time period, at least one time item is obtained, according to all the time items, a habit association rule of the any target user is acquired by using an Apriori algorithm, and a support degree and a confidence degree of each habit association rule are obtained;

[0009] The any target user is obtained according to the number of authentication success transactions of each user, including:

[0010] The any target user is obtained according to the number of authentication success transactions of each user, including:

[0011] The any target user is obtained according to the number of authentication success transactions of each user, including:

[0012] The number of authentication success transactions of each user is sorted in ascending order to obtain a sequence, a maximum value in a first difference sequence of the sequence is obtained, a minimum value of the number of authentication success transactions corresponding to the maximum value is recorded as an authentication success transaction threshold, and all users corresponding to the authentication success transaction threshold are recorded as target users.

[0013] The any target user is obtained according to the number of authentication success transactions of each user, including:

[0014] The any target user is obtained according to the number of authentication success transactions of each user, including:

[0015] The any target user is obtained according to the number of authentication success transactions of each user, including:

[0016] The any target user is obtained according to the number of authentication success transactions of each user, including:

[0017] According to a preset time period, the continuous authentication number of the any target user in each preset time period, the segmented authentication number, the segmented authentication time difference, and the authentication date are taken as time items;

[0018] The continuous authentication number is the number of successful authentication transactions of the any target user in a preset time interval.

[0019] All successful authentication transactions of the any target user in a preset time interval are marked as a round of successful authentication, and the segmented authentication number is the number of successful authentication rounds of the any target user in a preset time period.

[0020] The segmented authentication time difference is the time interval between any round of successful authentication of the any target user and the previous round of successful authentication in the same preset time period.

[0021] The authentication date is the time period in which each successful authentication transaction of the any target user is located.

[0022] Preferably, according to all time items, the habit association rules of the any target user are obtained by using the Apriori algorithm, including:

[0023] According to all time items of the any target user in each time period, the support degree of each time item is obtained by using the Apriori algorithm, and a time item set containing the most number of time items is obtained.

[0024] For any time item set, the minimum support degree time item is obtained according to the support degree of each time item in the any time item set, the time items other than the minimum support degree time item in the any time item set are taken as the condition part, the minimum support degree time item is taken as the result part, and the habit association rule corresponding to the any time item set is obtained according to the condition part and the result part.

[0025] Preferably, the at least one behavior habit association rule of the any target user is obtained by simultaneously solving each habit association rule and each behavior association rule, including:

[0026] For any habit association rule, any behavior association rule belonging to the same time period as the any habit association rule is obtained according to the time period to which the any habit association rule and each behavior association rule belong, and all time items in the any habit association rule and all items in the any behavior association rule form a target item set.

[0027] The other items in the target item set except the item with the minimum support degree are taken as a condition part, and the item with the minimum support degree is taken as a result part, and a behavior habit association rule composed of any one of the habit association rules and any one of the behavior association rules is obtained according to the condition part and the result part.

[0028] Preferably, the frequent association rules of any one of the target users are obtained according to the support degree and the confidence degree of the corresponding behavior association rule and habit association rule of each of the behavior habit association rules.

[0029] For any one of the behavior habit association rules, a ratio between a minimum value and a maximum value in the support degree of the corresponding behavior association rule and the support degree of the habit association rule is calculated to obtain a credibility of the any one of the behavior habit association rules.

[0030] An average value between the confidence degree of the corresponding behavior association rule and the confidence degree of the habit association rule is calculated to obtain an average confidence degree.

[0031] A product between the credibility and the average confidence degree is calculated to obtain the confidence degree of the any one of the behavior habit association rules.

[0032] The confidence degrees of all the behavior habit association rules of the any one of the target users are obtained, and the frequent association rules of the any one of the target users are obtained according to the confidence degrees of all the behavior habit association rules.

[0033] Preferably, the frequent association rules of the any one of the target users are obtained according to the confidence degrees of all the behavior habit association rules, and the frequent association rules of the any one of the target users are obtained according to the confidence degrees of all the behavior habit association rules.

[0034] The behavior habit association rule corresponding to the maximum value in the confidence degrees of all the behavior habit association rules is selected as the frequent association rule of the any one of the target users.

[0035] Preferably, the target terminal is abnormally detected according to the frequent association rules of each of the target users, and the target terminal is abnormally detected according to the frequent association rules of each of the target users.

[0036] In the log data of the access authentication of the target terminal, the data of the any one of the target users under the time corresponding to the frequent association rules of the any one of the target users is recorded as normal data, and if the data in any one of the authentication success transactions in the log data is abnormal data, or if the data of any one item in any one of the authentication success transactions of any one of the target users is inconsistent with the data of the any one item in the frequent association rules of the any one of the target users, the target terminal is abnormally warned.

[0037] Compared with the prior art, the embodiment of the application has the following beneficial effects:

[0038] The application obtains at least one authentication success transaction of all users according to log data of access authentication of a target terminal, obtains a target user according to the number of authentication success transactions of each user, obtains at least one behavior association rule of any target user according to all items in each authentication success transaction of the any target user by using an Apriori algorithm, and obtains the support and confidence of each behavior association rule; obtains at least one time item according to the time of each authentication success of the any target user and a preset time period, obtains a habit association rule of the any target user according to all time items by using the Apriori algorithm, and obtains the support and confidence of each habit association rule; obtains at least one behavior habit association rule of the any target user by simultaneously solving each habit association rule and each behavior association rule, obtains a frequent association rule of the any target user according to the support and confidence of the behavior association rule and the habit association rule corresponding to each behavior habit association rule, obtains the frequent association rule of each target user, and performs abnormality detection on the target terminal according to the frequent association rule of each target user. The Apriori algorithm is used to obtain the behavior association rule of each target user, then the time rule of each target user when accessing the target terminal each time is combined to obtain the habit association rule of each target user, and then the behavior association rule and the habit association rule of each target user are simultaneously solved to obtain the behavior habit association rule, which is used to more comprehensively mine the association relationship between different attributes in the log data of authentication of the target terminal, and then the abnormal behavior of the target terminal is detected according to the behavior habit association rule, and the accuracy of abnormal behavior detection on the log data of authentication of the target terminal is improved. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0040] Figure 1 It is a method flow chart of a log data management method for terminal access authentication provided by the first embodiment of the present application. DETAILED DESCRIPTION

[0041] The embodiments of the present application will be described in detail below, and examples of the embodiments are shown in the drawings. The embodiments described below with reference to the drawings are exemplary and are intended to explain the present application, and cannot be understood as a limitation of the present application.

[0042] It should be noted that the terms "first", "second", etc. in the specification of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The implementation described in the following exemplary embodiments does not represent all implementations consistent with the present disclosure. Rather, they are merely examples of devices and methods consistent with some aspects of the present disclosure.

[0043] In order to illustrate the technical solutions of the present application, the following will be described by specific embodiments.

[0044] Referring to Figure 1 , it is a method flow chart of a log data management method for terminal access authentication provided by an embodiment of the present application, as Figure 1 shown, the method can include:

[0045] Step S101, according to the log data of the target terminal access authentication, at least one authentication success transaction of all users is obtained, the authentication transaction contains at least one item, according to the number of each user's authentication success transaction, the target user is obtained, for any target user, according to all items in each authentication success transaction of the any target user, at least one behavior association rule of the any target user is obtained by using Apriori algorithm, and the support and confidence of each behavior association rule.

[0046] For the abnormal detection of terminal access authentication, in the traditional way, the Apriori algorithm is used to analyze the terminal authentication log data, the association relationship between different attributes is mined, the frequent items are obtained, and then the abnormal behavior is quickly found. However, the Apriori algorithm mainly focuses on the co-occurrence relationship between item sets, and it is difficult to directly mine the time series pattern of log data, so the mining of association relationship is not comprehensive, and potential association relationship is easily missed, so that the detection of abnormal behavior is not comprehensive. Therefore, in the embodiment of the present application, the time characteristics of log data are combined to more comprehensively mine the association relationship in the log data of access authentication, and the accuracy of detecting abnormal behavior is improved.

[0047] First, any terminal to be detected is recorded as a target terminal, and the log data of the access authentication of the target terminal is converted into a transaction format by the Flink CEP library. Each authentication transaction represents an authentication event, and each authentication transaction includes the following main items: user id, time when the authentication transaction occurs, unique identifier of the access terminal device (such as MAC address, device serial number, etc.), authentication method (such as username / password authentication, digital certificate authentication, biometric authentication, etc.), authentication result (whether the authentication is successful, if failed, record the failure reason, such as password error, account lock, certificate expiration, verification code error, etc.), network related information (such as network configuration information such as IP address, subnet mask, gateway address of the access terminal device, network name, etc.), location information (such as latitude and longitude coordinates, approximate area name, etc.), device state information (operating system version, hardware model, software version, etc. of the access terminal device), authentication process details (such as authentication request sending time, server response time, authentication completion time), etc. Among them, the log data of the access authentication of the target terminal is converted into a transaction format by the Flink CEP library, which is prior art, and will not be described here.

[0048] Considering that some temporary users will also generate authentication transactions when accessing the target terminal, but the rights of temporary users are generally lower, the authentication process is more complex, and the possibility of causing harm to the system information is smaller, and the frequent items of temporary users in the log data are less, it is difficult to find the correlation, so in the embodiment of the present application, the authentication transactions of temporary users are excluded, and the authentication transactions of other normal users are obtained, to analyze the authentication transactions of normal users, and obtain the frequent association rules. Since the number of authentication successes of temporary users is much less than that of normal users, in the embodiment of the present application, the authentication success transaction is recorded as an authentication success transaction, and according to the number of authentication success transactions of each user in the log data, the temporary users are excluded to obtain normal users, and the normal users are recorded as target users, specifically:

[0049] The number of authentication success transactions of each user is sorted in ascending order to obtain a sequence, the maximum value in the first difference sequence of the sequence is obtained, the minimum value of the number of the two authentication success transactions corresponding to the maximum value is recorded as the authentication success transaction number threshold, and all users corresponding to the authentication success transaction number threshold are recorded as target users.

[0050] After obtaining the target user, taking the u-th target user as an example, the Apriori algorithm is used to obtain the behavior association rule of the u-th target user. According to the traditional Apriori algorithm, at least one frequent item set is obtained from each authentication success transaction of the i-th target user, then all possible rules are generated according to each frequent item set, and the confidence of each possible rule is calculated, and then the rules meeting the pre-set confidence threshold are taken as the association rule. Considering that each authentication transaction includes many items, the time complexity of the traditional Apriori algorithm is too high, in order to reduce the number of calculations, in the embodiment of the application, according to all items in each authentication success transaction of the u-th target user, the Apriori algorithm is used to obtain the support degree of each item and at least one item set containing the most items; for any item set, according to the support degree of each item in the any item set, the minimum support degree item is obtained, the other items in the any item set except the minimum support degree item are taken as the condition part, the minimum support degree item is taken as the result part, and according to the condition part and the result part, the behavior association rule corresponding to the any item set is obtained.

[0051] For example: the item set containing the most items is (i, j, k), wherein the support degree of item i is 0.6, the support degree of item j is 0.5, and the support degree of item k is 0.7, the minimum support degree item is j, items i and k are taken as the condition part, and item j is taken as the result part, to obtain the behavior association rule corresponding to the item set (i, j, k), that is, (i, k)→j, which indicates that when items i and k occur at the same time, item j also occurs. Wherein the support degree of the item set (i, j, k) of the behavior association rule (i, k)→j is denoted as The confidence of the behavior association rule (i, k)→j is denoted as which is used to represent the probability that item j occurs when items i and k occur at the same time. Wherein the calculation formula of the support degree of the item set (i, j, k) of the behavior association rule (i, k)→j is:

[0052]

[0053] Wherein, denotes the support degree of the item set (i, j, k) of the behavior association rule (i, k)→j, denotes the number of authentication success transactions in which items i, k and j occur at the same time of the u-th target user, N u denotes the number of all authentication success transactions of the u-th target user.

[0054] It should be noted that, The greater the value is, the greater the relevance between the item i, the item k and the item j is, and further The greater the value is, the greater the frequency of the item set (i, j, k) of the behavior association rule (i, k) -> j in all authentication success transactions of the u-th target user is.

[0055] The calculation formula of the confidence of the behavior association rule (i, k) -> j is:

[0056]

[0057] The greater the value is, the greater the relevance between the item i, the item k and the item j is, and further The greater the value is, the greater the relevance between the item i, the item k and the item j is, and further The greater the value is, the greater the relevance between the item i, the item k and the item j is, and further The greater the value is, the greater the relevance between the item i, the item k and the item j is, and further

[0058] It should be noted that, The greater the value is, the greater the relevance between the item i, the item k and the item j is, and further The greater the value is, the greater the relevance between the item i, the item k and the item j is, and further

[0059] Similarly, all behavior association rules of the u-th target user are obtained, and the support and the confidence of each behavior association rule are obtained. The Apriori algorithm, the support and the confidence are prior art, and will not be described herein.

[0060] In step S102, at least one time item is obtained according to the time of each authentication success of the any target user and a preset time period, and the habit association rule of the any target user and the support and the confidence of each habit association rule are obtained by using the Apriori algorithm according to all time items.

[0061] The behavior association rule of the u-th target user when accessing the target terminal is obtained through step S101, but if the security detection is only based on the behavior association rule, it lacks comprehensiveness, such as potential risks that someone may impersonate the user to perform authentication, or the user himself / herself violates the rules to perform authentication at a non-specified time. Therefore, in the embodiment of the present application, the authentication time of the u-th target user is further analyzed to obtain the habit association rule of the u-th target user.

[0062] First, set the preset time period as one day, which is not limited here, and the implementer can set it according to the specific scene. The continuous authentication number of the u-th target user in each day, the segmented authentication number, the segmented authentication time difference, and the authentication date are taken as time items respectively. The continuous authentication number is the number of authentication success transactions of the u-th target user in a preset time interval. In the embodiment of the application, the preset time interval is set as one minute, which is not limited here, and the implementer can set it according to the specific scene. All authentication success transactions of the u-th target user in the preset time interval are marked as one round of successful authentication. The segmented authentication number is the number of successful authentication rounds of the u-th target user in a preset time period. The segmented authentication time difference is the time interval between any round of authentication success of the u-th target user and the last round of authentication success in the same preset time period. The authentication date is the time period in which each authentication success transaction of the u-th target user is located. In the embodiment of the application, the authentication date is represented by the day of the week.

[0063] For example, the u-th target user authenticates twice at 9 o'clock in the morning and 2 o'clock in the afternoon on Monday, and each round needs to be continuously authenticated twice. The continuous authentication number of the u-th target user at 9 o'clock in the morning on Monday is 2, the segmented authentication number is 1, the segmented authentication time is 9 o'clock, the segmented authentication time difference is 0, and the authentication date is 1 (representing Monday). The continuous authentication number of the u-th target user at 2 o'clock in the afternoon on Monday is 2, the segmented authentication number is 2, the segmented authentication time is 14 o'clock, the segmented authentication time difference is 5 hours, and the authentication date is 1 (representing Monday).

[0064] Then, according to the acquisition mode of the behavior association rule of the u-th target user, the habit association rule of the u-th target user is acquired by using the Apriori algorithm according to all the time items. Specifically:

[0065] According to all the time items of the u-th target user in each time period, the support degree of each time item is obtained by using the Apriori algorithm, and a time item set containing the largest number of time items is obtained.

[0066] For any time item set, the minimum support degree time item is obtained according to the support degree of each time item in the any time item set. The time items other than the minimum support degree time item in the any time item set are taken as the condition part, and the minimum support degree time item is taken as the result part. The habit association rule corresponding to the any time item set is obtained according to the condition part and the result part, and the support degree and the confidence degree of the habit association rule corresponding to the any time item set are obtained.

[0067] Similarly, all the habit association rules of the u-th target user are obtained, and the support degree and the confidence degree of each habit association rule are obtained.

[0068] Step S103, the habits associated with each of the rules and each of the behavior associated rules are combined to obtain at least one behavior habit associated rule of the any target user, and the support degree and the confidence degree of the behavior habit associated rule corresponding to each of the behavior habit associated rules are obtained to obtain the frequent association rules of the any target user.

[0069] After the behavior associated rules and the habits associated rules of the u-th target user are obtained through the steps S101 and S102, the behavior associated rules and the habits associated rules of the u-th target user are combined by day to obtain at least one behavior habit associated rule, which is used to more comprehensively mine the rules of the u-th target user accessing the target terminal, and further improve the accuracy of the abnormal behavior detection of the log data of the target terminal authentication, and the specific steps are as follows:

[0070] For any habits associated rule, according to the time period to which the any habits associated rule and each of the behavior associated rules belong, any behavior associated rule belonging to the same day as the any habits associated rule is obtained, and all time items in the any habits associated rule and all items in the any behavior associated rule are combined to form a target item set.

[0071] The items in the target item set other than the minimum support degree items are taken as the condition part, and the minimum support degree items are taken as the result part, and the behavior habit associated rule composed of the any habits associated rule and the any behavior associated rule is obtained according to the condition part and the result part.

[0072] Similarly, all behavior habit associated rules of the u-th user are obtained. Then, the confidence degree of each behavior habit associated rule is obtained, which is used to obtain the frequent association rules of the u-th user, and the specific steps are as follows:

[0073] For any behavior habit associated rule, the ratio between the minimum value and the maximum value in the support degree of the behavior associated rule corresponding to the any behavior habit associated rule and the support degree of the habits associated rule is calculated to obtain the confidence degree of the any behavior habit associated rule.

[0074] The average value between the confidence degree of the behavior associated rule corresponding to the any behavior habit associated rule and the confidence degree of the habits associated rule is calculated to obtain the average confidence degree.

[0075] The product between the confidence degree and the average confidence degree is calculated to obtain the confidence degree of the any behavior habit associated rule.

[0076] In an embodiment, the confidence degree of the G-th behavior habit associated rule of the u-th target user is calculated according to the following formula:

[0077]

[0078] wherein, represents the confidence of the Gth behavior habit association rule of the u th target user, represents the support of the behavior association rule corresponding to the Gth behavior habit association rule of the u th target user, represents the support of the habit association rule corresponding to the Gth behavior habit association rule of the u th target user, represents the confidence of the behavior association rule corresponding to the Gth behavior habit association rule of the u th target user, represents the confidence of the habit association rule corresponding to the Gth behavior habit association rule of the u th target user, min() represents the minimum symbol, and max() represents the maximum symbol.

[0079] It should be noted that, represents the proportion of the number of authentication success transactions containing all items in the behavior association rule corresponding to the Gth behavior habit association rule in the number of all authentication success transactions, represents the proportion of the number of days when the habit association rule corresponding to the Gth behavior habit association rule appears, The greater, the more consistent the frequency of the behavior association rule and the habit association rule corresponding to the Gth behavior habit association rule, the higher the overlap rate, and the greater the possibility of coexistence, that is, the higher the credibility of the Gth behavior habit association rule, and further The greater, the greater the confidence of the Gth behavior habit association rule; The greater, the greater the confidence of the behavior association rule and the habit association rule corresponding to the Gth behavior habit association rule, and further The greater, the greater the confidence of the Gth behavior habit association rule.

[0080] Similarly, the confidence of all behavior habit association rules of the u th target user is obtained, and the habit association rule corresponding to the maximum value is selected as the frequent association rule of the u th target user.

[0081] Step S104, obtaining the frequent association rule of each target user, and performing abnormal detection on the target terminal according to the frequent association rule of each target user.

[0082] According to step S103, the frequent association rule of each target user is obtained, and further, the log data of the target terminal authentication is detected for abnormal behavior according to the frequent association rule of each target user, specifically:

[0083] In the log data of the access authentication of the target terminal, the data of all target users at the time corresponding to the frequent association rule is recorded as normal data, if the data in any one authentication success transaction in the log data is abnormal data, or in any one authentication success transaction of any one target user, the data of any one item is inconsistent with the data of the any one item in the frequent association rule of the any one target user, the target terminal is abnormally warned.

[0084] For example, from 10:00 to 12:00 on Monday, the users accessing the target terminal are user a, user b and user c, that is, from 10:00 to 12:00 on Monday, the normal data is a, b and c, if user d accesses the target terminal from 10:00 to 12:00 on Monday, d is abnormal data, so there is a potential threat at this time, the target terminal issues a warning to the relevant staff, and increases the verification factor or takes blocking measures to protect the data information; if the frequent association rule of user a is to use device p to access the target terminal at 10:00 on Monday, but in one authentication success transaction of user a, device f is used to access the target terminal at 10:00 on Monday, device f is inconsistent with the frequent association rule of user a, so the target terminal issues a warning to the relevant staff at this time, and increases the verification factor or takes blocking measures to protect the data information. The increase of the verification factor or the taking of the blocking measures to protect the data information is the prior art, which will not be described here.

[0085] In summary, the present application obtains at least one authentication success transaction of all users according to the log data of the access authentication of the target terminal, the authentication transaction contains at least one item, obtains the target user according to the number of authentication success transactions of each user, for any target user, according to all items in each authentication success transaction of the any target user, using the Apriori algorithm, obtains at least one behavior association rule of the any target user, and the support and confidence of each behavior association rule; according to the time of each authentication success of the any target user and the preset time period, at least one time item is obtained, according to all time items, using the Apriori algorithm, obtains the habit association rule of the any target user, and the support and confidence of each habit association rule; the simultaneous equation of each habit association rule and each behavior association rule is obtained, at least one behavior habit association rule of the any target user is obtained, the frequent association rule of the any target user is obtained according to the support and confidence of the corresponding behavior association rule and habit association rule of each behavior habit association rule; the frequent association rule of each target user is obtained, and the target terminal is detected abnormally according to the frequent association rule of each target user. Wherein, using the Apriori algorithm, the behavior association rule of each target user is obtained, then the time rule of each target user when accessing the target terminal each time is combined, the habit association rule of each target user is obtained, and then the behavior association rule and the habit association rule of each target user are simultaneously solved, the behavior habit association rule is obtained, which is used for more comprehensively mining the association relationship between different attributes in the authentication log data of the target terminal, and then the abnormal behavior of the target terminal is detected according to the behavior habit association rule, and the accuracy of the abnormal behavior detection of the log data of the target terminal authentication is improved.

[0086] The above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent ones; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A log data management method for terminal access authentication, characterized by, The log data management method for terminal access authentication comprises: According to the log data of the access authentication of the target terminal, at least one authentication success transaction of all users is obtained, the authentication transaction contains at least one item, the number of authentication success transactions of each user is obtained, a target user is obtained, for any target user, according to all items in each authentication success transaction of the target user, at least one behavior association rule of the target user is obtained by using the Apriori algorithm, and the support and confidence of each behavior association rule are obtained; According to the time of each authentication success of the target user and the preset time period, at least one time item is obtained, and the habit association rule of the target user is obtained by using the Apriori algorithm according to all time items, and the support and confidence of each habit association rule are obtained; Each habit association rule and each behavior association rule are combined to obtain at least one behavior habit association rule of the target user, and the frequent association rule of the target user is obtained according to the support and confidence of the corresponding behavior association rule and habit association rule of each behavior habit association rule; The frequent association rule of each target user is obtained, and the target terminal is abnormally detected according to the frequent association rule of each target user; The frequent association rule of the target user is obtained according to the support and confidence of the corresponding behavior association rule and habit association rule of each behavior habit association rule, comprising: For any behavior habit association rule, the ratio between the minimum value and the maximum value in the support of the corresponding behavior association rule and the support of the habit association rule of the behavior habit association rule is calculated to obtain the credibility of the behavior habit association rule; The average value between the confidence of the corresponding behavior association rule and the confidence of the habit association rule of the behavior habit association rule is calculated to obtain the average confidence; The product between the credibility and the average confidence is calculated to obtain the confidence of the behavior habit association rule; The confidence of all behavior habit association rules of the target user is obtained, and the frequent association rule of the target user is obtained according to the confidence of all behavior habit association rules.

2. The log data management method for terminal access authentication according to claim 1, wherein The target user is obtained according to the number of authentication success transactions of each user, comprising: The number of authentication success transactions of each user is sorted in ascending order to obtain a sequence, the maximum value in the first difference sequence of the sequence is obtained, the minimum value of the number of authentication success transactions corresponding to the maximum value is recorded as the authentication success transaction number threshold, and all users corresponding to the authentication success transaction number threshold are recorded as target users.

3. The log data management method for terminal access authentication according to claim 1, wherein The at least one behavior association rule of the target user is obtained by using the Apriori algorithm according to all items in each authentication success transaction of the target user, comprising: According to all items in each authentication success transaction of the any target user, using an Apriori algorithm, obtaining a support degree of each item, and at least one item set containing the most number of items; For any item set, according to the support degree of each item in the any item set, obtaining a minimum support degree item, taking other items in the any item set except the minimum support degree item as a condition part, taking the minimum support degree item as a result part, and according to the condition part and the result part, obtaining a behavior association rule corresponding to the any item set.

4. The log data management method for terminal access authentication according to claim 1, wherein The at least one time item is obtained according to the time of each authentication success of the any target user and a preset time period, and includes: According to the preset time period, the continuous authentication number, the segmented authentication number, the segmented authentication time difference and the authentication date of the any target user in each preset time period are taken as time items respectively; The continuous authentication number is the number of authentication success transactions of the any target user in a preset time interval; All authentication success transactions of the any target user in a preset time interval are marked as a round of successful authentication, and the segmented authentication number is the number of successful authentication rounds of the any target user in a preset time period; The segmented authentication time difference is the time interval between any round of authentication success of the any target user and the last round of authentication success in the same preset time period; The authentication date is the time period in which each authentication success transaction of the any target user is located.

5. The log data management method for terminal access authentication according to claim 1, wherein The habit association rule of the any target user is obtained according to all time items using an Apriori algorithm, and includes: According to all time items of each time period of the any target user, using an Apriori algorithm, a support degree of each time item is obtained, and at least one time item set containing the most number of time items is obtained; For any time item set, according to the support degree of each time item in the any time item set, a minimum support degree time item is obtained, other time items in the any time item set except the minimum support degree time item are taken as a condition part, the minimum support degree time item is taken as a result part, and according to the condition part and the result part, a habit association rule corresponding to the any time item set is obtained.

6. The log data management method for terminal access authentication according to claim 1, wherein The at least one behavior habit association rule of the any target user is obtained by simultaneously solving each habit association rule and each behavior association rule, and includes: For any habit association rule, according to the time period to which the any habit association rule and each behavior association rule belong, any behavior association rule belonging to the same time period as the any habit association rule is obtained, all time items in the any habit association rule and all items in the any behavior association rule are taken to form a target item set; The other items in the target item set except the item with the minimum support degree are taken as a condition part, and the item with the minimum support degree is taken as a result part, and a behavior habit association rule composed of the any habit association rule and the any behavior association rule is obtained according to the condition part and the result part.

7. The log data management method for terminal access authentication according to claim 1, wherein The frequent association rule of the any target user is obtained according to the confidence of all the behavior habit association rules, and the method comprises the following steps of: In the confidence of all the behavior habit association rules, a behavior habit association rule corresponding to a maximum value is selected as the frequent association rule of the any target user.

8. The log data management method for terminal access authentication according to claim 1, wherein The target terminal is abnormally detected according to the frequent association rule of each target user, and the method comprises the following steps of: In the log data of the access authentication of the target terminal, data of the target user at a time corresponding to the frequent association rule of the target user is recorded as normal data, if data in any one of the authentication success transactions in the log data is abnormal data, or if data of any one item in any one of the authentication success transactions of the any target user is inconsistent with data of the any one item in the frequent association rule of the any target user, an abnormal warning is given to the target terminal.

Images