Abnormal user detection method based on unified security management platform

Abstract

The invention discloses an abnormal user detection method based on a unified security management platform, and relates to the field of user security management. Comprising the following steps: data acquisition and standardization; user behavior portrait construction, which is used for carrying out statistical aggregation and feature calculation on the standardized data set according to a preset time window by taking a user as a center, and generating a multi-dimensional user-feature matrix containing a frequency feature, a statistical feature and an entropy feature; feature dimension reduction; performing unsupervised anomaly detection; supervised fine classification is carried out; time sequence behavior analysis; and fusing multi-modal results. According to the method, the technical effects of accurately identifying hidden abnormal users and determining threat types of the hidden abnormal users are achieved through the technical means of constructing unified feature engineering of multi-source heterogeneous data and multi-stage intelligent algorithm fusion analysis; the problems of insufficient unknown threat discovery capability, high false alarm rate and poor interpretability caused by dependence on a rule base and a single detection model of a traditional unified security management platform are solved.

Claims

1. A method for detecting abnormal users based on a unified security management platform, characterized in that, Includes the following steps: S1: Data Acquisition and Standardization: Acquire security log data from multiple heterogeneous data sources of USMP and map the security log data to a predefined unified data model to generate a standardized structured dataset; S2: User behavior profile construction, which is used to perform statistical aggregation and feature calculation on standardized datasets in a user-centric manner according to a preset time window, and generate a multi-dimensional user-feature matrix containing frequency features, statistical features, and entropy features. S3: Feature dimensionality reduction: Principal component analysis (PCA) is performed on the user-feature matrix to obtain a low-dimensional feature representation that retains the main variance information. S4: Unsupervised anomaly detection, inputting low-dimensional feature representations into the isolated forest algorithm model, calculating anomaly scores for each user, and initially filtering out a candidate set of anomalous users based on the anomaly scores; S5: Supervised fine classification. The gradient boosting tree model is trained using a labeled training dataset. The abnormal user candidate set is input into the model, and the specific abnormal type and classification confidence of each abnormal user are output. S6: Temporal behavior analysis, constructing time series of user behavior events, and using the Long Short-Term Memory (LSTM) network model to learn normal behavior patterns, and identifying abnormal behaviors in time series by calculating the predicted probability of event occurrence; S7: Multimodal result fusion, which weights and fuses unsupervised anomaly scores, supervised classification confidence scores, and time-series anomaly scores to generate a comprehensive risk score. It also sets a threshold for the comprehensive risk score and outputs the result of whether the user is abnormal by comparing the threshold.

2. The method for detecting abnormal users based on a unified security management platform according to claim 1, characterized in that, In step S1: the unified data pattern includes timestamp, source IP address, destination IP address, username, event type, and operation result.

3. The method for detecting abnormal users based on a unified security management platform according to claim 1, characterized in that, In step S1, the standardization process includes unified time zone conversion and format standardization of timestamps, unified standardization of IPv4 / IPv6 IP addresses, case cleanup of usernames, and mapping of enumerated values ​​for event types and operation results.

4. The method for detecting abnormal users based on a unified security management platform according to claim 1, characterized in that, In step S2, the feature calculation includes: calculating the number of login failures per user per unit time, calculating the information entropy of users accessing different destination IP addresses, calculating the proportion of user activity frequency during non-working hours, calculating the number of times users access sensitive servers, and calculating the number of commands executed by users in a single session.

5. The method for detecting abnormal users based on a unified security management platform according to claim 1, characterized in that, In step S3, the feature dimensionality reduction input is the user-feature matrix. The output is the dimensionality-reduced matrix. M is the number of samples, P is the number of features before dimensionality reduction, and K is the number of features after dimensionality reduction. The specific steps are as follows: S31: Input the user-feature matrix X, and center X: Where μ is the mean vector of each feature; S32: Calculate the covariance matrix C. S33: Perform eigenvalue decomposition on C, C Vj =λ j v j , where λ j It is the j-th eigenvalue, v j It is the eigenvector of the j-th eigenvalue; S34: Sort the eigenvalues ​​in descending order: λ1≥λ2≥...λ P And select the first K eigenvalues ​​of the special steel box girders to form the projection matrix W. S35: Calculate the dimensionality-reduced data Z∈X centered ·W.

6. The method for detecting abnormal users based on a unified security management platform according to claim 5, characterized in that, In step S3, K ≥ 2.

7. The method for detecting abnormal users based on a unified security management platform according to claim 1, characterized in that, In step S4, the input to the isolated forest model is the dimension-reduced matrix Z, and the output is the user's anomaly score s(x)∈[0,1]. Specifically, it includes the following steps: S41: Set up an isolated forest consisting of T isolated trees iTree, and define the path length h(x) of sample x on one of the isolated trees as the number of edges traversed from the root node to the leaf node; S42: Calculate the average path length of sample x: S43: Given the number of samples M, calculate the standardization constant for the path length: S44: Calculate outlier scores:

8. The method for detecting abnormal users based on a unified security management platform according to claim 7, characterized in that, In step S43, H() is a harmonic function, H(i) = ln(i) + γ, and γ is Euler's constant.

9. The method for detecting abnormal users based on a unified security management platform according to claim 1, characterized in that, In step S5, the gradient boosting tree model is as follows: in: F(X) represents the ensemble model obtained after training. For a feature vector x of an input sample, the output value of the model is F(X). k represents the kth learner, and K represents that there are a total of K learners; α k Represents the weights of the k-th learner; f k (x) represents the k-th learner, given the input feature vector x, f k (x) represents the independent prediction output value of the k-th learner decision tree.

10. The method for detecting abnormal users based on a unified security management platform according to claim 1, characterized in that, In step S6, the LSTM calculates the following at each time step t: After computation at each time step t, the LSTM predicts the probability distribution of the next event through a fully connected layer and a softmax function: The anomaly score of a time step is defined as: α t = 1 - P(e t = v′丨e ＜t ), then the overall temporal anomaly score of the user is where: e t is the input at time t, h t is the hidden state vector at time t, C t is the cell state vector at time t, W and b are the model parameter matrix and vector, σ is the sigmoid function, is the Hadamard product, is the predicted probability distribution vector, v is a specific event type, P is the conditional probability, and v′ is the event type that actually occurred at the current time step.

Images