A method of monitoring network behavior data

Abstract

The application relates to a network behavior data monitoring method and relates to the technical field of network data management, and comprises the following steps: collecting historical operation logs of a target account; the application extracts the baselines of three dimensions of operation time distribution, operation sequence transition probability and operation object access frequency, adopts a sliding window mechanism to update the baselines every week, comprehensively judges operation intention from multiple dimensions, improves the accuracy of malicious operation identification, outputs the statistical deviation degree of the behavior baselines according to the malicious probability, performs weighted fusion, performs intention abnormality judgment, outputs real-time alarm, improves the accuracy of identification, automatically discovers the actual permission set used by a user, compares with a static authorization table, accurately marks out over-authorized items, idle permission items and unauthorized items, calculates the permission deviation degree, automatically generates a permission boundary early warning when the deviation degree exceeds a threshold value, outputs differentiated contraction suggestions according to the deviation types, calculates the fusion confidence, and generates a high-confidence fusion alarm.

Description

Technical Field

[0001] This invention relates to the field of network security monitoring technology, and in particular to a method for monitoring network behavior data. Background Technology

[0002] Network behavior data monitoring is a core component of a network security system. By collecting and analyzing data such as user operation logs, network traffic, and system calls, it identifies abnormal behavior and potential security threats. Enterprises commonly have the management habit of granting permissions without revoking them, resulting in many users having permissions far exceeding their actual work needs for extended periods. For example, an operations and maintenance personnel was granted deletion permissions to a core database three years ago to handle an emergency fault. After the problem was resolved, the permissions were never revoked, even though the personnel no longer need these permissions in their current role. As enterprises deepen their digital transformation, the access permissions held by high-privilege accounts such as database administrators, system operations and maintenance engineers, and network administrators are constantly expanding. If these accounts are abused, they will damage the enterprise's core data assets.

[0003] In summary, existing technologies have the following technical flaws in practical applications regarding the abuse of high-privilege accounts: Existing monitoring methods only verify whether a user has the permission, without assessing whether the permission should be held by the user. This leads to over-authorization that should be revoked becoming a breeding ground for permission abuse. When an attacker steals the account and performs a deletion operation, the system will determine that the user has the permission and the operation is legitimate, completely losing its detection capability. Static permission configuration is severely out of touch with actual use, resulting in legitimate but unauthorized operations going undetected. Existing monitoring methods typically treat each operation as an independent event, focusing only on the type, object, and execution result of a single operation, ignoring the temporal logic and intent information contained in the sequence of operations.

[0004] To address the aforementioned technical shortcomings, a solution is proposed. Summary of the Invention

[0005] The purpose of this invention is to construct an operation intent graph, map user operation sequences to a high-level intent space, and achieve an understanding of operation semantics; to automatically detect the risks of over-authorization and permission drift through least privilege deviation analysis; and to generate interpretable high-confidence alarms through multi-dimensional evidence fusion. This invention does not rely on static rules and manual annotation, and can adapt to different business scenarios to achieve real-time detection and early warning of abuse of high-privilege accounts.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a method for monitoring network behavior data, comprising the following steps: Step 1: Collect historical operation logs of the target account, extract the operation time, operation type, operation object and operation order of each operation, aggregate statistics according to user dimension, and construct the operation time distribution baseline, operation sequence transition probability baseline and operation object access frequency baseline for each user; Step 2: Based on the current user operation, extract time-series features, sequence features, and environmental features, calculate the deviation from the behavior baseline, input the extracted features into the intent recognition model, output a malicious probability value, perform intent anomaly judgment, and output real-time alarms. Step 3: Obtain the historical operation log of the target account within the preset time window, extract the types of operations actually performed by the account and the resource identifiers accessed, construct the actual usage permission set of the target account, compare it with the static permission set granted to the account, and mark items with excessive authorization, items exceeding idle permissions, and unauthorized items that have not been granted. Step 4: Calculate the permission deviation based on the static permission set and the actual permission set used. When the permission deviation exceeds the preset threshold, generate a permission boundary warning and output permission contraction suggestions according to the deviation type. Step 5: When the intent is determined to be abnormal and the permission deviation exceeds the threshold, the evidence of abnormal intent is correlated with the evidence of abnormal permission to generate a high-confidence fusion alarm.

[0007] Furthermore, historical operation logs of the target account are collected, and the operation time, operation type, operation object, and operation sequence of each operation are extracted. Statistics are aggregated based on the user dimension to construct baselines for each user's operation time distribution, operation sequence transition probability, and operation object access frequency. The specific process is as follows: Extract the target account's past operation records. Each record includes the user identifier, operation timestamp, operation type, operation object, and operation sequence number. Remove system-maintained operations and retain only user-initiated operations. The operation time is mapped to the time axis, the probability density of operations within each hour interval is calculated, the operation time distribution function is generated, and the proportion of user operations during working hours and non-working hours is calculated as the time period preference feature. The mean and standard deviation are obtained as the distribution baseline parameters. For each user's operation type sequence, a sliding window method is used to extract consecutive pairs of operation types, the frequency of occurrence of all operation type pairs is counted, the transition probability from one operation type to another is calculated, and a transition probability matrix is ​​constructed. The total number of times each user accesses each object is counted, and the access frequency distribution is obtained after normalization. High-frequency access and low-frequency access are marked, and the constructed operation time distribution, transition probability matrix and access frequency distribution are stored in the database.

[0008] Furthermore, based on the current user operation, temporal features, sequence features, and environmental features are extracted, the deviation from the behavioral baseline is calculated, the extracted features are input into the intent recognition model, a malicious probability value is output, an intent anomaly judgment is made, and a real-time alarm is output. The specific process is as follows: When a user initiates an operation, time-series features, sequence features, and environmental features are extracted. The time-series features include the operation time, the operation number of the day, and the interval since the last operation. The sequence features include the type of the preceding operation and the transition probability. The environmental features include the device fingerprint and the frequency of use of the source IP. The temporal, sequential, and environmental features of the current operation are combined to form a feature vector. The mean vector and covariance of the corresponding features of the current user are calculated. The deviation of the current operation feature vector from the behavioral baseline is calculated to obtain the temporal deviation, sequential deviation, and environmental deviation. These are then fused to obtain the comprehensive deviation. The temporal features, sequence features, and environmental features are input into the intent recognition model, which outputs the probability of malice. Combined with the comprehensive deviation, a comprehensive probability is generated. Based on the comprehensive probability, the intent anomaly is judged. When the comprehensive probability is greater than the standard probability, the current operation is judged to have an intent anomaly. When the intent anomaly is judged, a structured real-time alarm is output.

[0009] Furthermore, the historical operation logs of the target account within a preset time window are obtained, and the types of operations actually performed and the resource identifiers accessed by the account are extracted. The specific process is as follows: Retrieves the operation records of the target account within a preset time window. The length of the time window is dynamically set according to the account type: for operation and maintenance accounts with high-frequency operations, the window takes the set number of high-frequency days; for audit accounts with low-frequency operations, the window takes the set number of low-frequency days; for newly created accounts, the window is calculated from the account creation date. Each operation record must contain at least the following information: operation time, operation type, and operation topic. Each operation log is structured and parsed to extract operation type keywords, statement types, and accessed table names. For file system operations, the operation type and file path are extracted. For configuration change operations, the key names of the changed configuration items are extracted. The extracted operation types are mapped to the corresponding permission items in the permission model. For the same operation topic, resource identifiers of different granularities are unified to a standard format.

[0010] Furthermore, the actual set of permissions for the target account is constructed and compared with the static set of permissions granted to the account. Over-granted permissions, permissions exceeding the limit of inactive permissions, and unauthorized permissions not granted are identified. The specific process is as follows: The extracted operation type is combined with the resource identifier to form a permission-resource tuple. All tuples generated by the same account within the time window are deduplicated and aggregated to generate the actual set of usage permissions for the account. The system reads the static permission set granted to the target account, compares and analyzes the actual permission set with the static permission set, and identifies anomaly types, including over-authorization, restricted permissions, and unauthorized permissions. Over-authorization is defined as permissions that exist in the static permission set but not in the actual permission set. Unauthorized permissions are defined as permissions that were last used for more than the idle time threshold. Unauthorized permissions are defined as permissions that exist in the actual permission set but not in the static permission set. The system generates reports on the actual permission set, static permission set, over-authorization list, idle permission list, and unauthorized permission list.

[0011] Furthermore, based on the static permission set and the actual usage permission set, the permission deviation is calculated. When the permission deviation exceeds a preset threshold, a permission boundary warning is generated, and permission contraction suggestions are output according to the deviation type. The specific process is as follows: Obtain the static permission set and the actual usage permission set, calculate the quantity deviation, permission type deviation, and resource level deviation, and merge them to obtain the comprehensive permission deviation. The quantity deviation reflects the proportion of permissions granted to the account that have never been used, the permission type deviation reflects the proportion of high-risk unused permissions, and the resource level deviation reflects the proportion of resources that the account has the right to access but has never accessed. When the permission deviation exceeds a preset threshold, a permission boundary warning is generated, and permission contraction suggestions are output based on the deviation type, including the following types and suggestions: If the over-authorized items involve deletion operations, it is recommended to revoke them immediately and generate a high-risk permission revoke work order; If the over-authorized items involve update operations, it is recommended to submit them to the business manager for confirmation before revoking them; If the over-authorized items involve query operations and the idle period exceeds the standard number of days, it is recommended to reclaim them and record them for observation.

[0012] Furthermore, when an intent is determined to be abnormal and the permission deviation exceeds a threshold, the evidence of abnormal intent is correlated with the evidence of abnormal permissions to generate a high-confidence fused alarm. The specific process is as follows: When the intent is determined to be abnormal and the permission deviation exceeds the threshold, the evidence of abnormal intent is associated with the evidence of abnormal permission, and spatiotemporal correlation is checked to verify the correlation of time, operation subject, and consistency of permission behavior, and a correlation strength coefficient is generated. Based on the malicious probability value of abnormal intent and the permission deviation degree of permission deviation, combined with the correlation strength coefficient, the confidence of the fused alarm is calculated. When the confidence of the fused alarm is greater than the high confidence threshold, a high confidence fused alarm is generated.

[0013] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: This method for monitoring network behavior data extracts baselines from three dimensions: operation time distribution, operation sequence transition probability, and operation object access frequency. The operation time baseline can identify suspicious operations during non-working hours such as early morning, the operation sequence baseline can detect risky operations, and the operation object baseline can locate abnormal resource access behavior. A sliding window mechanism is used to update the baselines weekly, adapting to changes in normal user behavior patterns. By extracting the temporal context, sequence context, and environmental context of operations, the method comprehensively judges the operation intent from multiple dimensions, improving the accuracy of malicious operation identification. A weighted fusion is performed based on the statistical deviation between the malicious probability output and the behavior baseline, utilizing the ability to identify complex patterns while retaining the interpretability of statistical methods, thus achieving dual verification. The system verifies the purpose and performs real-time alerts to determine abnormal intent, improving the accuracy of identification. By mining historical operation logs, it automatically discovers the user's actual permission set and compares it with the static authorization table to accurately mark over-authorized, idle, and unauthorized items. This transforms permission auditing from manual spot checks to automated continuous monitoring. By calculating permission deviation, it automatically generates permission boundary warnings when the deviation exceeds a threshold and outputs differentiated contraction suggestions based on the deviation type. It suggests revoking over-authorized items, archiving idle items, and issuing immediate alerts for unauthorized items. When abnormal intent and permission occur simultaneously, it performs spatiotemporal correlation verification of the two types of evidence, calculates the fusion confidence level, and generates high-confidence fusion alerts to improve the confirmation confidence of risk events. Attached Figure Description

[0014] Figure 1 A schematic diagram of the overall structure of the method steps of the present invention is shown; Detailed Implementation

[0015] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below. Example

[0016] like Figure 1 As shown, a method for monitoring network behavior data includes the following steps: Step 1: Collect historical operation logs of the target account, extract the operation time, operation type, operation object and operation order of each operation, aggregate statistics according to user dimension, and construct the operation time distribution baseline, operation sequence transition probability baseline and operation object access frequency baseline for each user; Step 2: Based on the current user operation, extract time-series features, sequence features, and environmental features, calculate the deviation from the behavior baseline, input the extracted features into the intent recognition model, output a malicious probability value, perform intent anomaly judgment, and output real-time alarms. Step 3: Obtain the historical operation log of the target account within the preset time window, extract the types of operations actually performed by the account and the resource identifiers accessed, construct the actual usage permission set of the target account, compare it with the static permission set granted to the account, and mark items with excessive authorization, items exceeding idle permissions, and unauthorized items that have not been granted. Step 4: Calculate the permission deviation based on the static permission set and the actual permission set used. When the permission deviation exceeds the preset threshold, generate a permission boundary warning and output permission contraction suggestions according to the deviation type. Step 5: When the intent is determined to be abnormal and the permission deviation exceeds the threshold, the evidence of abnormal intent is correlated with the evidence of abnormal permission to generate a high-confidence fusion alarm.

[0017] Collect historical operation logs of the target account, extract the operation time, operation type, operation object, and operation sequence for each operation, aggregate and statistically analyze them according to the user dimension, and construct baselines for operation time distribution, operation sequence transition probability, and operation object access frequency for each user. The specific process is as follows: Extract the target account's past operation records. Each record includes the user identifier, operation timestamp, operation type, operation object, and operation sequence number. Remove system-maintained operations and retain only user-initiated operations. The operation time is mapped to the time axis, the probability density of operations within each hour interval is calculated, the operation time distribution function is generated, and the proportion of user operations during working hours and non-working hours is calculated as the time period preference feature. The mean and standard deviation are obtained as the distribution baseline parameters. For each user's operation type sequence, a sliding window method is used to extract consecutive pairs of operation types, the frequency of occurrence of all operation type pairs is counted, the transition probability from one operation type to another is calculated, and a transition probability matrix is ​​constructed. The total number of times each user accesses each object is counted, and the access frequency distribution is obtained after normalization. High-frequency access and low-frequency access are marked, and the constructed operation time distribution, transition probability matrix and access frequency distribution are stored in the database.

[0018] Based on the current user actions, time-series features, sequence features, and environmental features are extracted. The deviation from the behavioral baseline is calculated, and the extracted features are input into the intent recognition model. The model outputs a malicious probability value, performs intent anomaly judgment, and outputs real-time alarms. The specific process is as follows: When a user initiates an operation, time-series features, sequence features, and environmental features are extracted. The time-series features include the operation time, the operation number of the day, and the interval since the last operation. The sequence features include the type of the preceding operation and the transition probability. The environmental features include the device fingerprint and the frequency of use of the source IP. The temporal, sequential, and environmental features of the current operation are combined to form a feature vector. The mean vector and covariance of the corresponding features of the current user are calculated. The deviation of the current operation feature vector from the behavioral baseline is calculated to obtain the temporal deviation, sequential deviation, and environmental deviation. These are then fused to obtain the comprehensive deviation. The temporal features, sequence features, and environmental features are input into the intent recognition model, which outputs the probability of malice. Combined with the comprehensive deviation, a comprehensive probability is generated. Based on the comprehensive probability, the intent anomaly is judged. When the comprehensive probability is greater than the standard probability, the current operation is judged to have an intent anomaly. When the intent anomaly is judged, a structured real-time alarm is output.

[0019] The historical operation logs of the target account within a preset time window are retrieved, and the types of operations actually performed and the resource identifiers accessed by the account are extracted. The specific process is as follows: Retrieves the operation records of the target account within a preset time window. The length of the time window is dynamically set according to the account type: for operation and maintenance accounts with high-frequency operations, the window takes the set number of high-frequency days; for audit accounts with low-frequency operations, the window takes the set number of low-frequency days; for newly created accounts, the window is calculated from the account creation date. Each operation record must contain at least the following information: operation time, operation type, and operation topic. Each operation log is structured and parsed to extract operation type keywords, statement types, and accessed table names. For file system operations, the operation type and file path are extracted. For configuration change operations, the key names of the changed configuration items are extracted. The extracted operation types are mapped to the corresponding permission items in the permission model. For the same operation topic, resource identifiers of different granularities are unified to a standard format.

[0020] The actual set of permissions for the target account is constructed and compared with the static set of permissions granted to the account. Over-granted permissions, permissions exceeding the limit of inactive permissions, and unauthorized permissions not granted are identified. The specific process is as follows. The extracted operation type is combined with the resource identifier to form a permission-resource tuple. All tuples generated by the same account within the time window are deduplicated and aggregated to generate the actual set of usage permissions for the account. The system reads the static permission set granted to the target account, compares and analyzes the actual permission set with the static permission set, and identifies anomaly types, including over-authorization, restricted permissions, and unauthorized permissions. Over-authorization is defined as permissions that exist in the static permission set but not in the actual permission set. Unauthorized permissions are defined as permissions that were last used for more than the idle time threshold. Unauthorized permissions are defined as permissions that exist in the actual permission set but not in the static permission set. The system generates reports on the actual permission set, static permission set, over-authorization list, idle permission list, and unauthorized permission list.

[0021] Based on the static permission set and the actual permission set used, the permission deviation is calculated. When the permission deviation exceeds the preset threshold, a permission boundary warning is generated, and permission contraction suggestions are output according to the deviation type. The specific process is as follows: Obtain the static permission set and the actual usage permission set, calculate the quantity deviation, permission type deviation, and resource level deviation, and merge them to obtain the comprehensive permission deviation. The quantity deviation reflects the proportion of permissions granted to the account that have never been used, the permission type deviation reflects the proportion of high-risk unused permissions, and the resource level deviation reflects the proportion of resources that the account has the right to access but has never accessed. When the permission deviation exceeds a preset threshold, a permission boundary warning is generated, and permission contraction suggestions are output based on the deviation type, including the following types and suggestions: If the over-authorized items involve deletion operations, it is recommended to revoke them immediately and generate a high-risk permission revoke work order; If the over-authorized items involve update operations, it is recommended to submit them to the business manager for confirmation before revoking them; If the over-authorized items involve query operations and the idle period exceeds the standard number of days, it is recommended to reclaim them and record them for observation.

[0022] When an intent is deemed abnormal and the permission deviation exceeds a threshold, the evidence of abnormal intent is correlated with the evidence of abnormal permissions to generate a high-confidence fused alarm. The specific process is as follows: When the intent is determined to be abnormal and the permission deviation exceeds the threshold, the evidence of abnormal intent is associated with the evidence of abnormal permission, and spatiotemporal correlation is checked to verify the correlation of time, operation subject, and consistency of permission behavior, and a correlation strength coefficient is generated. Based on the malicious probability value of abnormal intent and the permission deviation degree of permission deviation, combined with the correlation strength coefficient, the confidence of the fused alarm is calculated. When the confidence of the fused alarm is greater than the high confidence threshold, a high confidence fused alarm is generated.

[0023] The specific working process of this invention: The system collects historical operation logs of high-privilege accounts over the past 90 days, extracts the time, type, theme, and operation sequence of each operation, aggregates and statistically analyzes them by user dimension, and constructs three types of behavioral baselines: operation time distribution baseline, reflecting the user's work time pattern; operation sequence transfer probability baseline, reflecting the user's operation habit pattern; and operation object access frequency baseline, reflecting the user's resource access range. These baselines together constitute the user's normal behavior profile, serving as a reference benchmark for subsequent anomaly judgment.

[0024] When a user initiates an action, the system captures the action in real time, extracts its temporal features, sequence features, and environmental features, calculates the Mahalanobis distance between the current action and the behavioral baseline, and comprehensively judges the degree of deviation of the behavior. At the same time, the extracted features are input into a pre-trained intent recognition model, which outputs the probability value that the action is a malicious action. When the malicious probability value exceeds the threshold and the deviation is significant, it is determined that there is an abnormal intent.

[0025] The system extracts the types of operations actually performed and the resources accessed by the account from the historical operation logs, generates the actual set of permissions used, and obtains the static set of permissions granted to the account from the permission management system. Through cross-comparison, it marks over-authorized items, idle permissions, and unauthorized items, calculates the permission deviation degree, and generates a permission boundary warning when the deviation degree exceeds the threshold.

[0026] When both intentional anomalies and permission deviations are detected simultaneously, the system performs spatiotemporal correlation verification on the two types of evidence: checking whether the operation time overlaps with the permission statistics window, whether the operation object is related to the abnormal permission item, and whether the operation type matches the excessive authorization permission. The system calculates the fusion confidence based on the correlation strength, generates a high-confidence alarm, and executes differentiated responses based on the risk level. High-risk triggers mandatory interception, medium-risk pushes approval confirmation, and low-risk only records observation.

[0027] The size of the interval and threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by those skilled in the art for each set of sample data; as long as it does not affect the ratio between the parameter and the quantized value.

[0028] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation. In the two embodiments provided in this application, it should be understood that the disclosed apparatus and system can be implemented in other ways; for example, the apparatus embodiments described above are merely illustrative, and the division of modules is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed; furthermore, the coupling or direct coupling or communication connection between the shown or discussed mutuals can be through some interfaces, and the indirect coupling or communication connection between the apparatus or modules can be electrical, mechanical or other forms. The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for monitoring network behavior data, characterized in that, Includes the following steps: Step 1: Collect historical operation logs of the target account, extract the operation time, operation type, operation object and operation order of each operation, aggregate statistics according to user dimension, and construct the operation time distribution baseline, operation sequence transition probability baseline and operation object access frequency baseline for each user; Step 2: Based on the current user operation, extract time-series features, sequence features, and environmental features, calculate the deviation from the behavior baseline, input the extracted features into the intent recognition model, output a malicious probability value, perform intent anomaly judgment, and output real-time alarms. Step 3: Obtain the historical operation log of the target account within the preset time window, extract the types of operations actually performed by the account and the resource identifiers accessed, construct the actual usage permission set of the target account, compare it with the static permission set granted to the account, and mark items with excessive authorization, items exceeding idle permissions, and unauthorized items that have not been granted. Step 4: Calculate the permission deviation based on the static permission set and the actual permission set used. When the permission deviation exceeds the preset threshold, generate a permission boundary warning and output permission contraction suggestions according to the deviation type. Step 5: When the intent is determined to be abnormal and the permission deviation exceeds the threshold, the evidence of abnormal intent is correlated with the evidence of abnormal permission to generate a high-confidence fusion alarm.

2. The method for monitoring network behavior data according to claim 1, characterized in that, Collect historical operation logs of the target account, extract the operation time, operation type, operation object, and operation sequence for each operation, aggregate and statistically analyze them according to the user dimension, and construct baselines for operation time distribution, operation sequence transition probability, and operation object access frequency for each user. The specific process is as follows: Extract the target account's past operation records. Each record includes the user identifier, operation timestamp, operation type, operation object, and operation sequence number. Remove system-maintained operations and retain only user-initiated operations. The operation time is mapped to the time axis, the probability density of operations within each hour interval is calculated, the operation time distribution function is generated, and the proportion of user operations during working hours and non-working hours is calculated as the time period preference feature. The mean and standard deviation are obtained as the distribution baseline parameters. For each user's operation type sequence, a sliding window method is used to extract consecutive pairs of operation types, the frequency of occurrence of all operation type pairs is counted, the transition probability from one operation type to another is calculated, and a transition probability matrix is ​​constructed. The total number of times each user accesses each object is counted, and the access frequency distribution is obtained after normalization. High-frequency access and low-frequency access are marked, and the constructed operation time distribution, transition probability matrix and access frequency distribution are stored in the database.

3. The method for monitoring network behavior data according to claim 1, characterized in that, Based on the current user actions, time-series features, sequence features, and environmental features are extracted. The deviation from the behavioral baseline is calculated, and the extracted features are input into the intent recognition model. The model outputs a malicious probability value, performs intent anomaly judgment, and outputs real-time alarms. The specific process is as follows: When a user initiates an operation, time-series features, sequence features, and environmental features are extracted. The time-series features include the operation time, the operation number of the day, and the interval since the last operation. The sequence features include the type of the preceding operation and the transition probability. The environmental features include the device fingerprint and the frequency of use of the source IP. The temporal, sequential, and environmental features of the current operation are combined to form a feature vector. The mean vector and covariance of the corresponding features of the current user are calculated. The deviation of the current operation feature vector from the behavioral baseline is calculated to obtain the temporal deviation, sequential deviation, and environmental deviation. These are then fused to obtain the comprehensive deviation. The temporal features, sequence features, and environmental features are input into the intent recognition model, which outputs the probability of malice. Combined with the comprehensive deviation, a comprehensive probability is generated. Based on the comprehensive probability, the intent anomaly is judged. When the comprehensive probability is greater than the standard probability, the current operation is judged to have an intent anomaly. When the intent anomaly is judged, a structured real-time alarm is output.

4. The method for monitoring network behavior data according to claim 1, characterized in that, The historical operation logs of the target account within a preset time window are retrieved, and the types of operations actually performed and the resource identifiers accessed by the account are extracted. The specific process is as follows: Retrieves the operation records of the target account within a preset time window. The length of the time window is dynamically set according to the account type: for operation and maintenance accounts with high-frequency operations, the window takes the set number of high-frequency days; for audit accounts with low-frequency operations, the window takes the set number of low-frequency days; for newly created accounts, the window is calculated from the account creation date. Each operation record must contain at least the following information: operation time, operation type, and operation topic. Each operation log is structured and parsed to extract operation type keywords, statement types, and accessed table names. For file system operations, the operation type and file path are extracted. For configuration change operations, the key names of the changed configuration items are extracted. The extracted operation types are mapped to the corresponding permission items in the permission model. For the same operation topic, resource identifiers of different granularities are unified to a standard format.

5. The method for monitoring network behavior data according to claim 1, characterized in that, The actual set of permissions for the target account is constructed and compared with the static set of permissions granted to the account. Over-granted permissions, permissions exceeding the limit of inactive permissions, and unauthorized permissions not granted are identified. The specific process is as follows. The extracted operation type is combined with the resource identifier to form a permission-resource tuple. All tuples generated by the same account within the time window are deduplicated and aggregated to generate the actual set of usage permissions for the account. The system reads the static permission set granted to the target account, compares and analyzes the actual permission set with the static permission set, and identifies anomaly types, including over-authorization, restricted permissions, and unauthorized permissions. Over-authorization is defined as permissions that exist in the static permission set but not in the actual permission set. Unauthorized permissions are defined as permissions that were last used for more than the idle time threshold. Unauthorized permissions are defined as permissions that exist in the actual permission set but not in the static permission set. The system generates reports on the actual permission set, static permission set, over-authorization list, idle permission list, and unauthorized permission list.

6. The method for monitoring network behavior data according to claim 1, characterized in that, Based on the static permission set and the actual permission set used, the permission deviation is calculated. When the permission deviation exceeds the preset threshold, a permission boundary warning is generated, and permission contraction suggestions are output according to the deviation type. The specific process is as follows: Obtain the static permission set and the actual usage permission set, calculate the quantity deviation, permission type deviation, and resource level deviation, and merge them to obtain the comprehensive permission deviation. The quantity deviation reflects the proportion of permissions granted to the account that have never been used, the permission type deviation reflects the proportion of high-risk unused permissions, and the resource level deviation reflects the proportion of resources that the account has the right to access but has never accessed. When the permission deviation exceeds a preset threshold, a permission boundary warning is generated, and permission contraction suggestions are output based on the deviation type, including the following types and suggestions: If the over-authorized items involve deletion operations, it is recommended to revoke them immediately and generate a high-risk permission revoke work order; If the over-authorized items involve update operations, it is recommended to submit them to the business manager for confirmation before revoking them; If the over-authorized items involve query operations and the idle period exceeds the standard number of days, it is recommended to reclaim them and record them for observation.

7. The method for monitoring network behavior data according to claim 1, characterized in that, When an intent is deemed abnormal and the permission deviation exceeds a threshold, the evidence of abnormal intent is correlated with the evidence of abnormal permissions to generate a high-confidence fused alarm. The specific process is as follows: When the intent is determined to be abnormal and the permission deviation exceeds the threshold, the evidence of abnormal intent is associated with the evidence of abnormal permission, and spatiotemporal correlation is checked to verify the correlation of time, operation subject, and consistency of permission behavior, and a correlation strength coefficient is generated. Based on the malicious probability value of abnormal intent and the permission deviation degree of permission deviation, combined with the correlation strength coefficient, the confidence of the fused alarm is calculated. When the confidence of the fused alarm is greater than the high confidence threshold, a high confidence fused alarm is generated.

Images