Dynamic non-intrusive user identity mapping and behavior security operation and maintenance method of UEBA system
By creating a master account in the UEBA system and automatically associating it with subordinate accounts, the problem of inconsistent user accounts across different systems is solved, enabling rapid identification and collection of user behavior, and improving the accuracy of threat detection and the operability of alerts.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING YOUTEJIE INFORMATION TECH
- Filing Date
- 2026-01-22
- Publication Date
- 2026-04-10
AI Technical Summary
In the existing UEBA system, user accounts on different systems cannot be unified, resulting in fragmented behavioral profiles, which seriously weakens the accuracy of threat detection and the operability of alerts.
By creating a unique master account in the UEBA system and automatically associating it with subordinate accounts from different systems, the system synchronizes account information using preset cycles or change events, establishes relationships using an account matching algorithm, and parses and aggregates event streams to a unified master account in real time.
It enables rapid identification and collection of the same user's behavior across different systems, reduces manual intervention, accurately associates event streams with user accounts, and supports cross-system user behavior analysis and security operations.
Smart Images
Figure CN121841808A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer software technology, and in particular, to a dynamic non-intrusive user identity mapping and behavior security operation and maintenance method and apparatus for a UEBA system. Background Technology
[0002] In digital security operations, User and Entity Behavior Analytics (UEBA) is a key technology for identifying insider threats, advanced persistent threats (APTs), and anomalous user behavior. Its core value lies in building behavioral baselines and identifying deviations by analyzing the massive amounts of multi-dimensional logs generated by users (such as employees and third parties) and devices (such as servers and endpoints) within the IT environment. Typical analytics scenarios require integrating log data from multiple heterogeneous systems, including bastion hosts (operations auditing), endpoint security management (endpoint activity), zero-trust networks (access requests), database auditing (data manipulation), and internet access management (network access). These systems are typically provided by different vendors and manage user identities independently, resulting in a single physical user having multiple different "account aliases" within the IT environment, such as `zhangsan@company.com` in Active Directory, `zs_admin` in the bastion host, and `zhang_s` in the database.
[0003] The effectiveness of UEBA heavily relies on accurately associating isolated event streams of the same entity across different systems with a single user. If accounts are not unified, the analysis model will misclassify the same user's behavior across different systems as the behavior of multiple independent entities, leading to fragmented behavioral profiles, inaccurate baselines, and severely weakening the accuracy of threat detection and the operability of alerts. Therefore, achieving a unified user identifier across systems is the primary technical prerequisite for the successful implementation of UEBA projects. Summary of the Invention
[0004] This invention provides a dynamic, non-intrusive user identity mapping and behavior security operation and maintenance method and corresponding device for UEBA system, which can quickly identify and collect the behavior of the same user in different systems, greatly reduce manual intervention, and accurately associate event streams with user accounts.
[0005] Firstly, a dynamic, non-intrusive user identity mapping and behavior security operation and maintenance method for a UEBA system is provided, comprising: creating a unique master account for a target user based on the identity center records of a first system, and associating the master account with at least one subordinate account from a second system; performing corresponding configuration operations according to a preset period or in response to a change event of the master account, and obtaining a list of information containing the master account, the list information including the source system account name, user name, email address, and department; establishing or updating the association relationship of subordinate accounts for the master account according to an account matching algorithm; when an event flow related to the master account or at least one subordinate account associated with it from the second system is detected, the behavior corresponding to the event flow is parsed in real time and aggregated to the corresponding unified master account through the association relationship, so as to support cross-system user behavior analysis and security operation and maintenance.
[0006] In some embodiments, creating a unique master account for a target user based on the identity center records of the first system, and associating the master account with at least one subordinate account from the second system, includes the following steps: importing a user list from a predetermined system; selecting a unique master account from the target user's identity accounts on multiple data platforms; and associating the master account with at least one subordinate account from the second system.
[0007] In some embodiments, according to a preset period or in response to a change event of the main account, a corresponding configuration operation is performed to obtain a list of information containing the main account, including the following steps: according to a preset period or in response to a change event of the main account, a pre-configured response function is called; through the response function, a list of information containing the main account is obtained.
[0008] In some embodiments, establishing or updating the association relationship of subordinate accounts for the main account according to the account matching algorithm includes the following steps: if the email address in the list information is consistent with the email address of the main account, select the exact matching rule in the account matching algorithm and perform a direct association operation; if the email address in the list information is inconsistent with the email address of the main account, determine the similarity between the user name in the list information and the name of the main account, and perform an association operation when the similarity exceeds a predetermined confidence threshold; if the above matching fails, determine whether the department in the list information is consistent with the department of the main account, and also determine whether the source system account name in the list information contains the main account. If the departments are consistent and the source system account name contains the main account, mark it as pending review and further manual processing.
[0009] In some embodiments, the method further includes: aggregating the subordinate accounts associated with the master account to obtain an aggregated subset of subordinate accounts; performing data preprocessing on the aggregated subset of subordinate accounts, and performing cleaning and standardization operations.
[0010] In some embodiments, the method further includes: associating the behavior corresponding to the event stream with at least one subordinate account from the second system associated with the main account, establishing a behavior query list, and storing it in a cache for real-time querying.
[0011] In some embodiments, the behaviors corresponding to the event stream include: operation and maintenance behaviors, data access behaviors, and network access behaviors.
[0012] Secondly, a dynamic, non-intrusive user identity mapping and behavior security operation and maintenance device for a UEBA system is provided, comprising: a master account creation module, used to create a unique master account for a target user based on the identity center record of a first system, and associate the master account with at least one subordinate account from a second system; a configuration module, used to perform corresponding configuration operations according to a preset period or in response to a change event of the master account, and obtain list information containing the master account, the list information including source system account name, user name, email address, and department; a calculation module, used to establish or update the association relationship of subordinate accounts for the master account according to an account matching algorithm; and a monitoring module, used to, when an event flow related to the master account or at least one subordinate account associated with it from the second system is detected, to parse the behavior corresponding to the event flow in real time and aggregate it to the corresponding unified master account through the association relationship, so as to support cross-system user behavior analysis and security operation and maintenance.
[0013] Thirdly, an electronic device is provided, characterized in that it includes: at least one processor; and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to utilize the at least one processor to cause the electronic device to execute the above-described dynamic non-intrusive user identity mapping and behavior security operation and maintenance method of the UEBA system.
[0014] Fourthly, a computer-readable storage medium is also provided, characterized in that the computer-readable storage medium stores program code, which can be called by a processor to execute the above-mentioned dynamic non-intrusive user identity mapping and behavior security operation and maintenance method of the UEBA system.
[0015] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects: it can quickly identify and collect the behavior of the same user in different systems, greatly reduce manual intervention, and accurately associate event streams with user accounts.
[0016] The summary section is provided to present the chosen concepts in a simplified form, which will be further described in the detailed description below. The summary section is not intended to identify essential or necessary features of this disclosure, nor is it intended to limit the scope of this disclosure. Attached Figure Description
[0017] The above and other objects, features and advantages of this disclosure will become more apparent from the accompanying drawings, in which like reference numerals generally denote like parts.
[0018] Figure 1 A schematic diagram of the dynamic non-intrusive user identity mapping and behavior security operation and maintenance method of the UEBA system provided in this application embodiment is shown; Figure 2 This illustration shows a schematic diagram of the dynamic non-intrusive user identity mapping and behavior security operation and maintenance device of the UEBA system provided in this application embodiment; Figure 3 A schematic diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation
[0019] Embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.
[0020] The term "comprising" and its variations as used herein signify open inclusion, i.e., "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "at least partially based on". The terms "one example embodiment" and "one embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.
[0021] This application provides a dynamic, non-intrusive user identity mapping and behavior security operation and maintenance method for a UEBA system. Please refer to... Figure 1 This figure is a schematic diagram of the first embodiment of this application. The following is in conjunction with... Figure 1 The first embodiment of this application provides a detailed description of a dynamic non-intrusive user identity mapping and behavior security operation and maintenance method 100 for a UEBA system.
[0022] Step S102: Create a master account. This involves creating a unique master account for the target user based on the identity center records of the first system, and associating this master account with at least one subordinate account from the second system. For example, within the UEBA system, a master account is created for each entity (user) that needs to be monitored. This master account uses a relatively stable and easily identifiable identifier within the enterprise (such as username, employee ID, or email prefix) as its unified identifier. The key innovation lies in associating one or more subordinate accounts with each master account. Each subordinate account is not manually entered but is automatically obtained and updated periodically through targeted collection methods such as calling standard query APIs provided by various source systems (bastion hosts, endpoint management, etc.). The subordinate account records the user's actual login name in each source system.
[0023] Step S104: Obtain the list. That is, based on a preset period or in response to a change event of the master account, perform corresponding configuration operations to obtain a list of information containing the master account. The list information includes the source system account name, user name, email address, and department. For example: Automated synchronization and association of slave accounts based on APIs: The system configures connectors with each source system, periodically and automatically batch-pushing or listening for account change events via APIs to obtain the latest user account list. Through preset matching rules (such as email matching, fuzzy name matching, and organizational structure inference), the obtained external system accounts are automatically associated with the master account in the UEBA identity center, establishing and dynamically maintaining a "master-slave" relationship. This process achieves dynamic synchronization of slave account information without the need for manual maintenance of a static mapping table.
[0024] Step S106: Matching algorithm, that is, according to the account matching algorithm, establish or update the association relationship of subordinate accounts for the main account.
[0025] Step S108: Event streams are associated with accounts. That is, when an event stream related to the main account or at least one associated subordinate account from the second system is detected, the behavior corresponding to the event stream is analyzed in real time and aggregated to the corresponding unified main account through the association relationship, supporting cross-system user behavior analysis and security operations. For example, in the UEBA presentation layer, any user-related alarms, risk scores, or behavior details are aggregated and displayed with the main account as the core, while also clearly showing all associated subordinate accounts and their specific behaviors in the corresponding systems. This provides security analysts with a complete cross-system user behavior perspective. Simultaneously, the system can monitor the synchronization status and associated health of subordinate accounts, forming a closed-loop management system.
[0026] In some embodiments, creating a unique master account for a target user based on the identity center records of the first system, and associating the master account with at least one subordinate account from the second system, includes the following steps: importing a user list from a predetermined system; selecting a unique master account from the target user's identity accounts on multiple data platforms; and associating the master account with at least one subordinate account from the second system.
[0027] In some embodiments, based on a preset period or in response to a change event of the main account, corresponding configuration operations are performed to obtain a list of information containing the main account. This includes the following steps: calling a pre-configured response function based on a preset period or in response to a change event of the main account; and obtaining a list of information containing the main account through the response function. For example, an identity center established by the system is responsible for storing and managing the main account and its associated sub-account list, providing account mapping and resolution services. A set of adapters, each connector dedicated to interfacing with a type of external system, periodically and automatically obtains the user account list of that system through its public application programming interface (API) or management protocol. Finally, the UEBA analysis engine is responsible for receiving security event logs from various systems, associating events with a unified main account based on the mapping relationship of the identity center, and performing behavioral modeling and anomaly detection.
[0028] In some embodiments, the association relationship between the master account and the subordinate account is established or updated according to the account matching algorithm, including the following steps: if the email address in the list information is consistent with the email address of the master account, the exact matching rule in the account matching algorithm is selected and the direct association operation is performed; if the email address in the list information is inconsistent with the email address of the master account, the similarity between the user name in the list information and the name of the master account is determined, and when the similarity exceeds a predetermined confidence threshold, the association operation is performed; if the above matching fails, it is determined whether the department in the list information is consistent with the department of the master account, and it is also necessary to determine whether the source system account name in the list information contains the master account. If the department is consistent and the source system account name contains the master account, it is marked as pending review and further processed manually. For example, the matching rule example can be shown as follows: (1) Exact matching: compare the "email" field of the subordinate account with the "corporate email" of the master account. If they are completely consistent, the direct association is performed. (2) Fuzzy name matching: if the email address does not match, the string similarity algorithm is used to calculate the similarity between the "name" of the subordinate account and the "name" of the master account. If the similarity exceeds the threshold (e.g., 0.9), an association is established. (3) Inference based on organizational structure: If the above matching fails, but the "department" information of the secondary account is consistent with the "department" of the primary account, and the account name contains the abbreviation of the primary account's name in pinyin, an association may be established, but the confidence level is low and it can be marked as "pending review". (4) Conflict handling: When the same secondary account can be matched with multiple primary accounts, the system will arbitrate according to the priority and confidence level of the matching rules, or submit this conflict relationship to the administrator for manual judgment.
[0029] In some embodiments, the method further includes: aggregating the subordinate accounts associated with the master account to obtain an aggregated subset of subordinate accounts; performing data preprocessing on the aggregated subset of subordinate accounts, and performing cleaning and standardization operations.
[0030] In some embodiments, the method further includes: associating the behavior corresponding to the event stream with at least one subordinate account from the second system associated with the main account, establishing a behavior query list, and storing it in a cache for real-time querying.
[0031] In some embodiments, the behaviors corresponding to the event stream include: operation and maintenance behaviors, data access behaviors, and network access behaviors.
[0032] This application also provides a dynamic, non-intrusive user identity mapping and behavior security operation and maintenance device 200 for the UEBA system. Please refer to [link / reference]. Figure 2 The processing flow of device 200 may include the following modules: main account creation module 202, configuration module 204, calculation module 206 and monitoring module 208.
[0033] The main account creation module 202 is used to create a unique main account for the target user based on the identity center record of the first system, and associate the main account with at least one subordinate account from the second system.
[0034] The configuration module 204 is used to perform corresponding configuration operations according to a preset period or in response to a change event of the main account, and to obtain a list of information containing the main account. The list information includes the source system account name, user name, email address, and department.
[0035] The calculation module 206 is used to establish or update the association relationship between subordinate accounts for the main account according to the account matching algorithm.
[0036] The monitoring module 208 is used to analyze and aggregate the behavior corresponding to the event flow in real time to the corresponding unified main account when an event flow related to the main account or at least one subordinate account associated with it from the second system is detected, so as to support cross-system user behavior analysis and security operation and maintenance.
[0037] like Figure 3 As shown in the illustration, an electronic device provided in this embodiment of the invention may include a processor 320 and a memory 310. Optionally, the electronic device may further include a transceiver. The processor, memory, and transceiver may be connected via a communication bus. The memory stores computer-readable instructions, which, when executed by the processor, implement the steps of the dynamic non-intrusive user identity mapping and behavior security operation and maintenance method of the UEBA system described above.
[0038] In a specific implementation, as one example, processor 320 may include one or more CPUs.
[0039] Optionally, in a specific implementation, if the memory 310, processor 320 and communication interface 330 are integrated on a single chip, the memory 310, processor 320 and communication interface 330 can communicate with each other through an internal interface.
[0040] In a specific implementation, as one example, the electronic device may also include multiple processors, each of which may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, a processor may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).
[0041] The memory is used to store the software program that executes the solution of the present invention, and the execution is controlled by the processor. The specific implementation method can be referred to the above method embodiment, which will not be repeated here.
[0042] A transceiver is used to communicate with network devices or with terminal devices.
[0043] Optionally, the transceiver may include a receiver and a transmitter. The receiver is used to implement the receiving function, and the transmitter is used to implement the sending function.
[0044] Optionally, the transceiver can be integrated with the processor or exist independently and coupled to the processor through the interface circuit of the electronic device. This embodiment of the invention does not specifically limit this.
[0045] It should be noted that the structure of the electronic device described above does not constitute a limitation on the electronic device. Actual electronic devices may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. Furthermore, the technical effects of the electronic device can be referred to the technical effects of the above method embodiments, and will not be repeated here.
[0046] In an exemplary embodiment, the present invention also provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the steps of a dynamic non-intrusive user identity mapping and behavior security operation and maintenance method such as that of a UEBA system. For example, the computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.
[0047] This invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores program code, which can be called by a processor to execute the above-described dynamic non-intrusive user identity mapping and behavior security operation and maintenance method of the UEBA system.
[0048] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).
[0049] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.
[0050] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.
[0051] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0052] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0053] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.
[0054] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.
Claims
1. A dynamic, non-intrusive user identity mapping and behavior security operation and maintenance method for a UEBA system, comprising: Based on the identity center records of the first system, a unique master account is created for the target user to be monitored, and at least one subordinate account from the second system is associated with the master account. Based on a preset cycle or in response to a change event of the main account, perform corresponding configuration operations to obtain a list of information containing the main account. The list information includes the source system account name, user name, email address, and department. Based on the account matching algorithm, establish or update the association relationship between subordinate accounts for the main account; When an event stream related to the main account or at least one subordinate account from the second system is detected, the behavior corresponding to the event stream is analyzed in real time and aggregated to the corresponding unified main account through the association relationship, so as to support cross-system user behavior analysis and security operation and maintenance.
2. The dynamic non-intrusive user identity mapping and behavior security operation and maintenance method for the UEBA system according to claim 1, characterized in that, Create a unique primary account for the target user based on the identity center records of the first system, and associate the primary account with at least one subordinate account from the second system, including the following steps: Import the user list from the pre-defined system; Select a unique primary account from the target user's identity accounts across multiple data platforms; Associate the primary account with at least one subordinate account from the second system.
3. The dynamic non-intrusive user identity mapping and behavior security operation and maintenance method for the UEBA system according to claim 1, characterized in that, Based on a preset period or in response to a change event of the main account, perform corresponding configuration operations to obtain a list of information containing the main account, including the following steps: Based on a preset period or in response to a change event of the main account, a pre-configured response function is invoked; The response function retrieves a list of information containing the main account.
4. The dynamic non-intrusive user identity mapping and behavior security operation and maintenance method for the UEBA system according to claim 1, characterized in that, Based on the account matching algorithm, the association relationship between the primary account and subordinate accounts is established or updated, including the following steps: If the email address in the list information matches the email address of the main account, select the exact matching rule in the account matching algorithm and perform a direct association operation; If the email address in the list information does not match the email address of the main account, the similarity between the user name in the list information and the name of the main account is determined. If the similarity exceeds a predetermined confidence threshold, an association operation is performed. If the above matching fails, it is determined whether the department in the list information matches the department of the main account. It is also necessary to determine whether the source system account name in the list information contains the main account. If the departments match and the source system account name contains the main account, it is marked as pending review and further manual processing is required.
5. The dynamic non-intrusive user identity mapping and behavior security operation and maintenance method for the UEBA system according to any one of claims 1 to 4 further includes: Aggregate the subordinate accounts associated with the main account to obtain an aggregated subset of subordinate accounts; The aggregated subset of subordinate accounts undergoes data preprocessing, including cleaning and standardization operations.
6. The dynamic non-intrusive user identity mapping and behavior security operation and maintenance method for the UEBA system according to any one of claims 5, further comprising: The behavior corresponding to the event stream is associated with the main account and at least one subordinate account from the second system, and a behavior query list is established and stored in a cache for real-time querying.
7. The dynamic non-intrusive user identity mapping and behavior security operation and maintenance method for the UEBA system according to claim 6, characterized in that, The behaviors corresponding to the event stream include: Operational and maintenance behavior, data access behavior, and network access behavior.
8. A dynamic, non-intrusive user identity mapping and behavior security operation and maintenance device for a UEBA system, characterized in that, include: The main account creation module is used to create a unique main account for the target user based on the identity center record of the first system, and associate the main account with at least one subordinate account from the second system. The configuration module is used to perform corresponding configuration operations according to a preset period or in response to a change event of the main account, and to obtain a list of information containing the main account, the list of information including the source system account name, user name, email address and department; The calculation module is used to establish or update the association relationship between subordinate accounts for the main account according to the account matching algorithm; The monitoring module is used to analyze and aggregate the behavior corresponding to the event flow in real time to the corresponding unified main account when an event flow related to the main account or at least one subordinate account associated with the second system is detected, so as to support cross-system user behavior analysis and security operation and maintenance.
9. An electronic device, characterized in that, include: At least one processor; as well as At least one memory, including computer program code, wherein the at least one memory and the computer program code are configured to utilize the at least one processor to cause the electronic device to execute the dynamic non-intrusive user identity mapping and behavior security operation and maintenance method of the UEBA system according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program code, which can be called by a processor to execute the dynamic non-intrusive user identity mapping and behavior security operation and maintenance method of the UEBA system as described in any one of claims 1 to 7.