User and entity abnormal behavior analysis method, system and equipment and storage medium

Abstract

The invention relates to the technical field of artificial intelligence, and particularly provides a user and entity abnormal behavior analysis method, system and device and a storage medium, and the method comprises the steps: obtaining network flow data, and obtaining structured behavior data which comprises behavior records and identity features; summarizing behavior records which have the same identity characteristics and continuously appear in a preset time interval in the structured behavior data, and arranging the behavior records according to a time sequence to obtain session associated data; based on the session associated data, extracting a time feature, a frequency feature, an access range feature and an interaction mode feature of the session associated data to obtain behavior portrait data; and based on the behavior portrait data, comparing the behavior portrait data with the real-time behavior deviation degree to obtain a judgment result. According to the method, the abnormal access behavior is accurately identified, and the system security and the identification accuracy are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, specifically relating to a method, system, device, and storage medium for analyzing abnormal user and entity behaviors. Background Technology

[0002] With the widespread application of information systems, the interaction between various business systems in the network environment is becoming increasingly frequent. The number of access objects carried by the system is constantly growing, and the types and combinations of access behaviors are becoming more diversified. Network services have gradually expanded from simple queries and browsing to complex behaviors involving the acquisition of sensitive data, business process operations, and online transactions. This has resulted in significant differences and dynamic changes in the behavior of different access objects within the system. At the same time, internal and external access subjects may participate in system interactions in different scenarios, at different times, and in different ways, generating a large amount of operational trajectories and access data.

[0003] However, existing methods for identifying abnormal access behavior still have significant limitations. On the one hand, existing methods typically focus on single-point judgments of access behavior, such as setting fixed rules or static thresholds based on access time, number of accesses, or access content, lacking a holistic consideration of how access behavior changes over time. This makes it difficult for the system to cope with the complexity and non-linear changes in access behavior. On the other hand, existing solutions often fail to effectively handle the correlation between access behavior across different records, and cannot extract behavioral characteristics of accessed objects from multiple access records, resulting in an insufficient understanding of access object behavior patterns. Furthermore, many technologies still rely on preset rules or empirical parameters to determine whether something is abnormal, making it difficult to adapt to constantly changing business environments and diverse access scenarios. When the behavior of an accessed object deviates from the normal pattern but does not trigger the rules, the system may not be able to identify it in a timely manner; while when normal access experiences brief fluctuations, it is easily misjudged as abnormal, resulting in a large number of false positives or false negatives. Summary of the Invention

[0004] In view of the above-mentioned shortcomings of the prior art, the present invention provides a method, system, device and storage medium for analyzing abnormal user and entity behavior to solve the above-mentioned technical problems.

[0005] In a first aspect, the present invention provides a method for analyzing abnormal user and entity behavior, comprising: Network traffic data is acquired to obtain structured behavioral data, which includes behavioral records and identity features. Summarize and arrange the behavioral records with the same identity characteristics that appear continuously within a preset time interval in the structured behavioral data, and obtain the session association data in chronological order; Based on the session association data, the time features, frequency features, access scope features and interaction pattern features of the session association data are extracted to obtain behavioral profile data. Based on behavioral profile data, the deviation between the behavioral profile data and real-time behavior is compared to obtain the judgment result.

[0006] In an optional implementation, the behavior record is a set of fields for access behavior, including access time, access path, request parameters, response status, response data content, and access source information; The identity feature is the identification information of the accessed object, and the identification information is the field attribute of the target accessed object's behavior record at different access times.

[0007] In an optional implementation, behavioral records with the same identity characteristics that appear consecutively within a preset time interval in the structured behavioral data are summarized and arranged in chronological order to obtain session association data, including: Read the identity features from each behavior record in the structured behavioral data; Extract behavioral records with the same identity characteristics, and calculate the time interval between different behavioral records with the same identity characteristics: When the time interval between adjacent behavior records does not exceed a preset time threshold, they are grouped into the same session, and the first session association data is obtained. During the process of categorizing sessions, the behavior records are sorted according to the access time, and the start time, end time, and sorted sequence of behavior records of each session are recorded. When the time interval between adjacent behavior records exceeds a preset time threshold, a new session is generated, and the second session association data is obtained.

[0008] In an optional implementation, based on session association data, time characteristics, frequency characteristics, access scope characteristics, and interaction pattern characteristics of the session association data are extracted to obtain behavioral profile data, including: The duration, time period, and rhythm of the session are calculated based on the access time of each behavior record in the session association data to obtain the time characteristics; Based on the number of behavioral records in the session association data, the distribution of behavioral records within the session, and the time interval between adjacent behavioral records, the access frequency and access density are calculated to obtain frequency characteristics. Based on the set of access paths appearing in the session association data, the access scope of the access object in the session is extracted, and it is identified whether the access scope contains multiple business functions or multiple access areas to obtain the access scope characteristics. Based on the access order, path jump relationship and parameter changes during the access process of the behavior records in the session association data, the interaction steps and access path patterns of the accessed object in the session are analyzed to obtain the interaction pattern characteristics. By combining time features, frequency features, access scope features, and interaction pattern features, behavioral profile data is obtained.

[0009] In one optional implementation, based on the behavioral profile data, the behavioral profile data is compared with the real-time behavioral deviation to obtain a judgment result, including: Real-time behavior records are generated based on real-time access behavior, and time features, frequency features, access scope features, and interaction pattern features corresponding to the behavior profile data are extracted from the real-time behavior records. The difference values ​​between each feature of the real-time behavior and each feature of the behavior profile data are calculated separately. The difference values ​​are used to characterize the degree of deviation of the real-time behavior from the profiled behavior. The time feature difference value, frequency feature difference value, access range feature difference value and interaction mode feature difference value are weighted according to preset weights to obtain the real-time behavior deviation. The system compares the real-time behavior deviation with a preset threshold. When the deviation is below the threshold, a normal judgment result is generated. When the deviation is near the threshold, a suspicious judgment result is generated. When the deviation exceeds the threshold, an abnormal judgment result is generated.

[0010] Secondly, the present invention provides a user and entity abnormal behavior analysis system, comprising: The data acquisition module is used to acquire network traffic data and obtain structured behavioral data, which includes behavioral records and identity features. The session association module is used to summarize and arrange the behavioral records with the same identity characteristics that appear continuously within a preset time interval in the structured behavioral data, so as to obtain session association data. The profile generation module is used to extract behavioral profile data based on the time features, frequency features, access scope features and interaction pattern features of the session association data. The behavior comparison module is used to compare the deviation between the behavior profile data and the real-time behavior based on the behavior profile data to obtain the judgment result.

[0011] In one optional implementation, the session association module includes: The identity feature reading unit is used to read the identity features from each behavior record in the structured behavior data; The time interval calculation unit is used to extract behavior records with the same identity characteristics and calculate the time interval between different behavior records with the same identity characteristics. The first session association unit is used to group adjacent behavior records into the same session when the time interval between them does not exceed a preset time threshold, and obtain the first session association data. The behavior record sorting unit is used to sort behavior records according to access time during the process of classifying them into a session, and to record the start time, end time of the session, and the sorted sequence of behavior records. The second session association unit is used to generate a new session and obtain the second session association data when the time interval between adjacent behavior records exceeds a preset time threshold.

[0012] In one optional implementation, the image generation module includes: The time feature generation unit is used to calculate the duration of the session, the access time period and the access rhythm based on the access time of each behavior record in the session association data, and obtain the time features. The frequency feature generation unit is used to calculate the access frequency and access density based on the number of behavior records in the session association data, the distribution of behavior records in the session, and the time interval between adjacent behavior records, and to obtain the frequency features. The access scope feature generation unit is used to extract the access scope of the access object in the session based on the set of access paths appearing in the session association data, and to identify whether the access scope contains multiple business functions or multiple access areas, thereby obtaining the access scope feature. The interaction pattern feature generation unit is used to analyze the interaction steps and access path patterns of the accessed object in the session based on the access order, path jump relationship and parameter changes during the access process of the behavior records in the session association data, and obtain the interaction pattern features. The behavioral profile data generation unit is used to combine time features, frequency features, access range features and interaction pattern features to obtain behavioral profile data.

[0013] Thirdly, a device is provided, comprising: Memory, used to store user and entity abnormal behavior analysis programs; A processor for implementing the steps of the user and entity abnormal behavior analysis method as provided in the first aspect when executing a user and entity abnormal behavior analysis program.

[0014] Fourthly, a computer-readable storage medium is provided, on which a user and entity abnormal behavior analysis program is stored, wherein when the user and entity abnormal behavior analysis program is executed by a processor, it implements the steps of the user and entity abnormal behavior analysis method provided in the first aspect.

[0015] The beneficial effects of this invention are as follows: The user and entity abnormal behavior analysis method, system, device, and storage medium provided by this invention, by parsing structured behavioral data containing behavioral records and identity features from network traffic data, achieve semantic reconstruction of the original network traffic, enabling access behavior to be presented in the form of a computable set of fields, thereby providing high-quality, associative input data for subsequent behavior modeling; by summarizing continuous access behavior based on identity features and organizing it in chronological order, the deep behavioral relationships of access objects are restored, enabling the establishment of stable semantic association links between multiple discrete data, thereby obtaining session association data that reflects the logical structure of the access process; by extracting time features, frequency features, access range features, and interaction pattern features from session association data, a multi-dimensional quantitative expression of the behavioral patterns of access objects is achieved, upgrading behavior recognition from single-dimensional statistics to pattern modeling based on continuous behavioral structures; by comparing the deviation between behavioral profile data and real-time behavior, a dynamic quantitative assessment of the degree of abnormality of access behavior is achieved, enabling the immediate identification of significant deviations in behavioral patterns during the occurrence of behavior, thereby significantly improving the accuracy, stability, and adaptability of abnormal behavior detection.

[0016] Furthermore, the design principle of this invention is reliable, the structure is simple, and it has a very wide range of application prospects. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic flowchart of a method according to an embodiment of the present invention.

[0019] Figure 2 This is a schematic block diagram of a system according to an embodiment of the present invention.

[0020] Figure 3 This is a schematic diagram of the structure of a device provided in an embodiment of the present invention. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0023] The user and entity abnormal behavior analysis method provided in this embodiment of the invention is executed by a computer device, and correspondingly, the user and entity abnormal behavior analysis system runs on the computer device.

[0024] Figure 1 This is a schematic flowchart illustrating a method according to an embodiment of the present invention. Wherein, Figure 1 The executing entity can be a user and entity abnormal behavior analysis system. Depending on different needs, the order of the steps in this flowchart can be changed, and some can be omitted.

[0025] like Figure 1 As shown, the method includes: S1. Obtain network traffic data to obtain structured behavioral data, which includes behavioral records and identity features.

[0026] S2. Summarize and arrange the behavioral records with the same identity characteristics that appear continuously within a preset time interval in the structured behavioral data to obtain the session association data.

[0027] S3. Based on the session association data, extract the time characteristics, frequency characteristics, access scope characteristics and interaction pattern characteristics of the session association data to obtain behavioral profile data.

[0028] S4. Based on the behavioral profile data, compare the behavioral profile data with the real-time behavioral deviation to obtain the judgment result.

[0029] In one embodiment of the present invention, based on step S1, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0030] Network traffic data is acquired to obtain structured behavioral data, which includes behavioral records and identity features. The behavioral records are a set of fields representing access behavior, including access time, access path, request parameters, response status, response data content, and access source information. The identity features are the identification information of the accessed object, which consists of field attributes of the target accessed object's behavioral records at different access times.

[0031] Specifically, in practical applications, traffic acquisition devices are deployed at the core switches of the business network. By configuring port mirroring or traffic replication policies, all network traffic interacting with the target system can be simultaneously received by the acquisition devices. The acquisition devices parse each received network data packet packet by packet, identifying the link layer, network layer, and transport layer header fields. Based on the five-tuple information, data packets belonging to the same connection are reassembled to restore a continuous byte stream. The system identifies application layer protocol content in the reassembled byte stream and parses information containing access behavior, extracting access behavior fields such as access time, access path, request parameters, response status, response data content, and access source information. These fields are then organized into behavior records. Simultaneously, the system extracts identity features from attributes that characterize the consistency of the accessed object from the access behavior. These identity features originate from field attributes in the behavior records that remain stable across different access times, such as fields that appear continuously across multiple behavior records and can be used to indicate the identity or source of the accessed object. The system formats and organizes the behavior records and identity features, uniformly writing them into a structured data storage area, forming a standardized dataset that can be directly used for subsequent analysis. Using the methods described above, those skilled in the art can obtain structured behavioral data containing behavioral records and identity features based on the collected network traffic data.

[0032] In one embodiment of the present invention, based on step S2, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0033] By summarizing and arranging chronologically the behavioral records with the same identity characteristics that occur consecutively within a preset time interval in the structured behavioral data, session association data is obtained, including: Read the identity features from each behavior record in the structured behavior data; extract behavior records with the same identity features, and calculate the time interval between different behavior records with the same identity features: when the time interval between adjacent behavior records does not exceed a preset time threshold, they are grouped into the same session to obtain the first session association data; during the process of grouping into sessions, the behavior records are sorted according to the access time, and the start time, end time of the session, and the sorted sequence of behavior records are recorded; when the time interval between adjacent behavior records exceeds the preset time threshold, a new session is generated to obtain the second session association data.

[0034] Specifically, the system first sequentially reads the identity features of each behavior record in the structured behavior data, and determines whether the records belong to the same access object by comparing the identity features in the behavior records. When multiple behavior records have the same identity features, the system considers them as candidate records that may belong to the same access process, and calculates the access time of these candidate records to determine their temporal relationship. The system compares the access time difference of two adjacent records according to the time order of the behavior records. When the time difference does not exceed a preset time threshold, the system classifies these two records into the same session, and continuously adds subsequent behavior records that meet the conditions to the session, thus forming the first session association data. During the process of adding records to the session, the system continuously sorts the behavior records according to the access time, and updates the start time, end time, and complete behavior record sequence of the session according to the sorting results. When the system detects that a behavior record has the same identity features, but the time interval between its access time and the previous record exceeds the preset time threshold, the system considers the previous session to have ended, and generates a new session starting from the current record, thus forming the second session association data. Using the above method, the system can organize scattered behavior records into multiple structured sessions based on the access object and time continuity, with each session containing a complete behavior chain.

[0035] In one embodiment of the present invention, based on step S3, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0036] Based on session association data, behavioral profile data is obtained by extracting time features, frequency features, access scope features, and interaction pattern features from the session association data, including: The duration, time period, and rhythm of a session are calculated based on the access time of each behavior record in the session association data to obtain time characteristics. Access frequency and density are calculated based on the number of behavior records, their distribution within the session, and the time interval between adjacent behavior records to obtain frequency characteristics. The access scope of the accessed object within the session is extracted from the set of access paths appearing in the session association data, and it is identified whether the access scope includes multiple business functions or multiple access areas to obtain access scope characteristics. The interaction steps and access path patterns of the accessed object in the session are analyzed based on the access order, path jump relationships, and parameter changes during the access process in the session association data to obtain interaction pattern characteristics. The time characteristics, frequency characteristics, access scope characteristics, and interaction pattern characteristics are combined to obtain behavioral profile data.

[0037] Specifically, the system first reads the access time of each behavior record in the session, calculates the session duration based on the earliest and latest access times, determines the access time period by combining the distribution of access times throughout the day, and judges the access rhythm based on the clustering of access time points, thus obtaining time characteristics. Next, the system counts the number of behavior records in the session and calculates access frequency and access density based on the distribution density of these records within the session duration and the access time interval between adjacent behavior records, thus obtaining frequency characteristics. The system continues to organize the access paths of each behavior record in the session, collecting all occurrences into a complete access path set, and on this basis, identifies whether the accessing object crosses multiple business functions or accesses multiple regions, thus obtaining access scope characteristics. Then, based on the sorting results of behavior records in the session, the system analyzes the actual access order, path jump relationships, and changes in request parameters during the access process to identify the interaction steps and access path patterns of the accessing object in the session, thus obtaining interaction pattern characteristics. Finally, the system combines time characteristics, frequency characteristics, access scope characteristics, and interaction pattern characteristics to form behavioral profile data that reflects the behavioral habits and patterns of the accessing object.

[0038] In one embodiment of the present invention, based on step S4, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0039] Based on behavioral profile data, the deviation between the behavioral profile data and real-time behavior is compared to obtain the judgment result, including: Real-time behavior records are generated based on real-time access behavior. Time features, frequency features, access range features, and interaction mode features corresponding to the behavior profile data are extracted from the real-time behavior records. The difference values ​​between each feature of the real-time behavior and each feature of the behavior profile data are calculated. The difference values ​​are used to characterize the degree of deviation of the real-time behavior from the profile behavior. The time feature difference value, frequency feature difference value, access range feature difference value, and interaction mode feature difference value are weighted according to preset weights to obtain the real-time behavior deviation degree. The real-time behavior deviation degree is compared with a preset threshold. When the deviation degree is lower than the threshold, a normal judgment result is generated. When the deviation degree is near the threshold, a suspicious judgment result is generated. When the deviation degree exceeds the threshold, an abnormal judgment result is generated.

[0040] Specifically, the system first collects data in real-time at the time of access, including access time, access path, request parameters, response status, response data content, and access source information, generating real-time behavior records based on these fields. Then, following the same rules used when building the behavior profile, the system extracts time features, frequency features, access scope features, and interaction pattern features from the real-time behavior records to ensure consistency in dimension and meaning between real-time features and profile features. After extracting real-time features, the system calculates the degree of difference between real-time features and profile features. For example, it determines time feature differences based on the degree of deviation in access time, frequency feature differences based on the degree of change in access frequency, access scope feature differences based on the number of paths in the real-time access path that do not appear in the profile, and interaction pattern feature differences based on differences in access steps and path jump relationships. The system weights these four types of difference values ​​using preset weights to obtain a real-time behavior deviation degree that comprehensively reflects the deviation of real-time behavior. Finally, the system compares the deviation to a preset threshold. When the deviation is below the threshold, the access behavior is considered normal; when the deviation is near the threshold, it is judged as suspicious and the system is prompted to pay attention; when the deviation exceeds the threshold, an anomaly judgment result is generated, indicating that the accessed object's current behavior has significantly deviated from its profile behavior, and corresponding processing strategies are triggered. For example, a company has an internal reporting system. Employee Zhang San's usual access habits are: logging into the system from the company's intranet IP address between 9:00 and 18:00 on weekdays, occasionally querying reports, and rarely exporting large reports. During this system operation, firstly, the traffic acquisition terminal captured an HTTP request from the mirror port, parsing the access time as 02:35:10, the access path as / report / export, the request parameters as report type and time range, the response status as 200, the response data content as 35MB, and the access source information as a public IP address 203.xx10. Simultaneously, fields such as account ID, session token, and client fingerprint were parsed from the request headers and parameters; these were used as the "identity characteristics" of the accessed entity. The system organizes "access time, access path, request parameters, response status, response data content, and access source information" into a behavior record, which together with the parsed identity features constitutes a structured behavior data. In the next 10 minutes, the system successively parsed multiple export request behavior records with the same identity features (same account ID + same token) and time intervals of less than 1 minute.

[0041] Subsequently, the system filters out behavior records with the same identity characteristics from the structured behavioral data. It checks the access time difference between adjacent records; none exceed the preset 5-minute time interval threshold. Therefore, these behavior records are grouped into the same session and sorted by access time from earliest to latest, forming a session association data. This session started at 02:35:10 and ended at 02:44:58, with the request sequence primarily consisting of export requests to ` / report / export`. Next, based on this session association data, the system extracts the session's time characteristics, frequency characteristics, access scope characteristics, and interaction pattern characteristics to obtain behavioral profile data. The time characteristics show that the session occurred in the early morning hours; the frequency characteristics show that the number of export requests within 10 minutes is significantly higher than the user's previous average; the access scope characteristics show that this access is concentrated on highly sensitive report export interfaces; and the interaction pattern characteristics show that after logging in, the user almost immediately engages in high-frequency export operations, lacking normal intermediate steps such as querying and filtering. These extracted features are compressed and organized into a behavioral profile data set to characterize the differences between this session's behavior and the user's historical profiles.

[0042] Finally, the system found that Zhang San's long-term behavioral profile data showed that his normal working hours were mainly from 9:00 to 18:00, and his report export behavior was usually infrequent and limited, with access to general query interfaces and an interaction pattern of "login—query—view—occasionally export". However, the behavioral profile data of this session showed significant differences from historical profiles in terms of time characteristics, frequency characteristics, access scope characteristics, and interaction pattern characteristics. The system calculated the deviation of each dimension, weighted and summarized the time deviation (access in the early morning), frequency deviation (export frequency increased exponentially), access scope deviation (concentrated access to sensitive interfaces), and interaction pattern deviation (lack of normal browsing steps), and obtained an overall real-time behavioral deviation that was higher than the preset abnormal threshold. Based on this, the system output a judgment result, marking the session as "high-risk abnormal data export behavior", and providing this judgment result to subsequent alarm or handling processes.

[0043] In some embodiments, the user and entity abnormal behavior analysis system may include multiple functional modules composed of computer program segments. The computer programs for each program segment in the user and entity abnormal behavior analysis system may be stored in the memory of a computer device and executed by at least one processor to perform (see details). Figure 1 (Description) Functionality for analyzing abnormal user and entity behavior.

[0044] In this embodiment, the user and entity abnormal behavior analysis system can be divided into multiple functional modules based on the functions it performs, such as... Figure 2As shown. The module referred to in this invention is a series of computer program segments that can be executed by at least one processor and perform a fixed function, and is stored in memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0045] The data acquisition module is used to acquire network traffic data and obtain structured behavioral data, which includes behavioral records and identity features. The session association module is used to summarize and arrange the behavioral records with the same identity characteristics that appear continuously within a preset time interval in the structured behavioral data, so as to obtain session association data. The profile generation module is used to extract behavioral profile data based on the time features, frequency features, access scope features and interaction pattern features of the session association data. The behavior comparison module is used to compare the deviation between the behavior profile data and the real-time behavior based on the behavior profile data to obtain the judgment result.

[0046] In one embodiment of the present invention, the session association module includes: The identity feature reading unit is used to read the identity features from each behavior record in the structured behavior data; The time interval calculation unit is used to extract behavior records with the same identity characteristics and calculate the time interval between different behavior records with the same identity characteristics. The first session association unit is used to group adjacent behavior records into the same session when the time interval between them does not exceed a preset time threshold, and obtain the first session association data. The behavior record sorting unit is used to sort behavior records according to access time during the process of classifying them into a session, and to record the start time, end time of the session, and the sorted sequence of behavior records. The second session association unit is used to generate a new session and obtain the second session association data when the time interval between adjacent behavior records exceeds a preset time threshold.

[0047] In one embodiment of the present invention, the image generation module includes: The time feature generation unit is used to calculate the duration of the session, the access time period and the access rhythm based on the access time of each behavior record in the session association data, and obtain the time features. The frequency feature generation unit is used to calculate the access frequency and access density based on the number of behavior records in the session association data, the distribution of behavior records in the session, and the time interval between adjacent behavior records, so as to obtain the frequency features. The access scope feature generation unit is used to extract the access scope of the access object in the session based on the set of access paths appearing in the session association data, and to identify whether the access scope contains multiple business functions or multiple access areas, thereby obtaining the access scope feature. The interaction pattern feature generation unit is used to analyze the interaction steps and access path patterns of the accessed object in the session based on the access order, path jump relationship and parameter changes during the access process of the behavior records in the session association data, and obtain the interaction pattern features. The behavioral profile data generation unit is used to combine time features, frequency features, access range features and interaction pattern features to obtain behavioral profile data.

[0048] Figure 3 The user and entity abnormal behavior analysis method provided in the embodiments of this application can be applied to devices. Those skilled in the art will understand that the device structure involved in the embodiments of this invention does not constitute a limitation on the device. A device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of this invention, the device includes, but is not limited to, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of this application described and / or claimed herein.

[0049] The device 300 may include a processor 310, a memory 320, and a communication unit 330. These components communicate via one or more buses. Those skilled in the art will understand that the server structure shown in the figure does not constitute a limitation of the present invention. It may be a bus topology or a star topology, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0050] The memory 320 can be used to store execution instructions of the processor 310. The memory 320 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. When the execution instructions in the memory 320 are executed by the processor 310, the device 300 is able to perform some or all of the steps in the above method embodiments.

[0051] The processor 310 serves as the control center of the storage device, connecting various parts of the electronic device via various interfaces and lines. It executes software programs and / or modules stored in the memory 320, and calls data stored in the memory to perform various functions of the electronic device and / or process data. The processor can be composed of integrated circuits (ICs), such as a single packaged IC or multiple packaged ICs with the same or different functions connected together. For example, the processor 310 may consist only of a central processing unit (CPU). In this embodiment of the invention, the CPU may have a single processing core or include multiple processing cores.

[0052] The communication unit 330 is used to establish a communication channel, enabling the storage device to communicate with other devices. It can receive user data sent by other devices or send user data to other devices.

[0053] The present invention also provides a computer storage medium, wherein the computer storage medium may store a program, which, when executed, may include some or all of the steps provided in the embodiments of the present invention. The storage medium may be a magnetic disk, an optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0054] Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or any other medium capable of storing program code. It includes several instructions to cause a computer device (which may be a personal computer, a server, or a second device, network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present invention.

[0055] The same or similar parts between the various embodiments in this specification can be referred to mutually. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the description in the method embodiments.

[0056] In the embodiments provided by this invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or modules may be electrical, mechanical, or other forms.

[0057] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0058] In addition, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0059] Although the present invention has been described in detail with reference to the accompanying drawings and preferred embodiments, the present invention is not limited thereto. Various equivalent modifications or substitutions can be made to the embodiments of the present invention by those skilled in the art without departing from the spirit and essence of the invention, and such modifications or substitutions should all be within the scope of the present invention. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should also be covered within the protection scope of the present invention.

Claims

1. A method for analyzing abnormal user and entity behavior, characterized in that, include: Network traffic data is acquired to obtain structured behavioral data, which includes behavioral records and identity features. Summarize and arrange the behavioral records with the same identity characteristics that appear continuously within a preset time interval in the structured behavioral data, and obtain the session association data in chronological order; Based on the session association data, the time features, frequency features, access scope features and interaction pattern features of the session association data are extracted to obtain behavioral profile data. Based on behavioral profile data, the deviation between the behavioral profile data and real-time behavior is compared to obtain the judgment result.

2. The method according to claim 1, characterized in that, The behavior record is a set of fields for access behavior, including access time, access path, request parameters, response status, response data content, and access source information; The identity feature is the identification information of the accessed object, and the identification information is the field attribute of the target accessed object's behavior record at different access times.

3. The method according to claim 1, characterized in that, By summarizing and arranging chronologically the behavioral records with the same identity characteristics that occur consecutively within a preset time interval in the structured behavioral data, session association data is obtained, including: Read the identity features from each behavior record in the structured behavioral data; Extract behavioral records with the same identity characteristics, and calculate the time interval between different behavioral records with the same identity characteristics: When the time interval between adjacent behavior records does not exceed a preset time threshold, they are grouped into the same session, and the first session association data is obtained. During the process of categorizing sessions, the behavior records are sorted according to the access time, and the start time, end time, and sorted sequence of behavior records of each session are recorded. When the time interval between adjacent behavior records exceeds a preset time threshold, a new session is generated, and the second session association data is obtained.

4. The method according to claim 1, characterized in that, Based on session association data, behavioral profile data is obtained by extracting time features, frequency features, access scope features, and interaction pattern features from the session association data, including: The duration, time period, and rhythm of the session are calculated based on the access time of each behavior record in the session association data to obtain the time characteristics; Based on the number of behavioral records in the session association data, the distribution of behavioral records within the session, and the time interval between adjacent behavioral records, the access frequency and access density are calculated to obtain frequency characteristics. Based on the set of access paths appearing in the session association data, the access scope of the access object in the session is extracted, and it is identified whether the access scope contains multiple business functions or multiple access areas to obtain the access scope characteristics. Based on the access order, path jump relationship and parameter changes during the access process of the behavior records in the session association data, the interaction steps and access path patterns of the accessed object in the session are analyzed to obtain the interaction pattern characteristics. By combining time features, frequency features, access scope features, and interaction pattern features, behavioral profile data is obtained.

5. The method according to claim 1, characterized in that, Based on behavioral profile data, the deviation between the behavioral profile data and real-time behavior is compared to obtain the judgment result, including: Real-time behavior records are generated based on real-time access behavior, and time features, frequency features, access scope features, and interaction pattern features corresponding to the behavior profile data are extracted from the real-time behavior records. The difference values ​​between each feature of the real-time behavior and each feature of the behavior profile data are calculated separately. The difference values ​​are used to characterize the degree of deviation of the real-time behavior from the profiled behavior. The time feature difference value, frequency feature difference value, access range feature difference value and interaction mode feature difference value are weighted according to preset weights to obtain the real-time behavior deviation. The system compares the real-time behavior deviation with a preset threshold. When the deviation is below the threshold, a normal judgment result is generated. When the deviation is near the threshold, a suspicious judgment result is generated. When the deviation exceeds the threshold, an abnormal judgment result is generated.

6. A user and entity abnormal behavior analysis system, characterized in that, include: The data acquisition module is used to acquire network traffic data and obtain structured behavioral data, which includes behavioral records and identity features. The session association module is used to summarize and arrange the behavioral records with the same identity characteristics that appear continuously within a preset time interval in the structured behavioral data, so as to obtain session association data. The profile generation module is used to extract behavioral profile data based on the time features, frequency features, access scope features and interaction pattern features of the session association data. The behavior comparison module is used to compare the deviation between the behavior profile data and the real-time behavior based on the behavior profile data to obtain the judgment result.

7. The system according to claim 6, characterized in that, The session association module includes: The identity feature reading unit is used to read the identity features from each behavior record in the structured behavior data; The time interval calculation unit is used to extract behavior records with the same identity characteristics and calculate the time interval between different behavior records with the same identity characteristics. The first session association unit is used to group adjacent behavior records into the same session when the time interval between them does not exceed a preset time threshold, and obtain the first session association data. The behavior record sorting unit is used to sort behavior records according to access time during the process of classifying them into a session, and to record the start time, end time of the session, and the sorted sequence of behavior records. The second session association unit is used to generate a new session and obtain the second session association data when the time interval between adjacent behavior records exceeds a preset time threshold.

8. The system according to claim 6, characterized in that, The portrait generation module includes: The time feature generation unit is used to calculate the duration of the session, the access time period and the access rhythm based on the access time of each behavior record in the session association data, and obtain the time features. The frequency feature generation unit is used to calculate the access frequency and access density based on the number of behavior records in the session association data, the distribution of behavior records in the session, and the time interval between adjacent behavior records, and obtain the frequency features. The access scope feature generation unit is used to extract the access scope of the access object in the session based on the set of access paths appearing in the session association data, and to identify whether the access scope contains multiple business functions or multiple access areas, thereby obtaining the access scope feature. The interaction pattern feature generation unit is used to analyze the interaction steps and access path patterns of the accessed object in the session based on the access order, path jump relationship and parameter changes during the access process of the behavior records in the session association data, and obtain the interaction pattern features. The behavioral profile data generation unit is used to combine time features, frequency features, access range features and interaction pattern features to obtain behavioral profile data.

9. A device, characterized in that, include: Memory, used to store user and entity abnormal behavior analysis programs; A processor, configured to implement the steps of the user and entity abnormal behavior analysis method as claimed in any one of claims 1-5 when executing a user and entity abnormal behavior analysis program.

10. A computer-readable storage medium storing a computer program, characterized in that, The readable storage medium stores a user and entity abnormal behavior analysis program, which, when executed by a processor, implements the steps of the user and entity abnormal behavior analysis method as claimed in any one of claims 1-5.

Images