A network security posture assessment system based on user behavior analysis

Abstract

The application discloses a network security situation assessment system based on user behavior analysis. In the application, each user is placed in the group to which the user belongs for horizontal comparison, and the system can identify abnormal behavior as long as the individual behavior deviates from the group commonness significantly even if the individual behavior does not deviate from the historical range of the individual. The group game mechanism further gives the system the ability to predict, and the system can give a warning before substantial damage occurs by judging whether the current behavior is inclined to obtain the income exceeding the normal business demand. The system can also capture the collusion attack in which multiple accounts approach the same target in a coordinated rhythm by analyzing the synchronism of the behavior changes of multiple users in the group, and the mode is completely invisible in the single-point detection perspective. The mechanisms are combined, and the detection sensitivity and the early discovery ability of the system to the hidden threats such as internal espionage, account hijacking and coordinated penetration are effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically a network security situation assessment system based on user behavior analysis. Background Technology

[0002] A network security situation assessment system is a core component of an enterprise's information security architecture. Its basic task is to collect multi-source data from network devices, security devices, host systems, and business applications, comprehensively analyze and assess the overall network security status, and provide decision-making support for security operations personnel. With the deepening of enterprise digital transformation, network boundaries are becoming increasingly blurred, and the operational behaviors of internal personnel have become one of the main sources of security risks. Therefore, network security situation assessment technologies based on user behavior analysis have received widespread attention.

[0003] Several network security situation assessment schemes based on user behavior analysis already exist in the current technology. The basic idea of ​​these schemes is to first collect various user operation behavior data, including login authentication records, resource access logs, command execution records, and network connection information, and then establish a baseline model of normal behavior for each user. The construction of the baseline usually adopts statistical methods to calculate the mean and standard deviation of user behavior, or uses machine learning methods to train a classifier to distinguish between normal and abnormal behavior.

[0004] However, current technologies for user behavior analysis generally rely on an individual's historical baseline. After stealing legitimate credentials, attackers can evade detection simply by mimicking the user's daily operations. The lack of cross-group comparison makes multi-account collaborative penetration undetectable, and the analysis is based solely on post-event judgments of past behavior, lacking the ability to predict threats based on behavioral trends. Furthermore, the anomaly detection thresholds in existing systems are fixed once set, and the significant shifts in normal behavior caused by changes in the business environment cannot be adaptively followed by these thresholds, leading to a higher false positive rate. Attackers can also gradually uncover the boundaries of the rules through incremental probing. Data flow between modules is unidirectional; detection results and handling effects are not fed back upstream. The system cannot accumulate experience and iterate itself during operation, requiring security operations personnel to frequently manually adjust parameters to maintain system effectiveness. Summary of the Invention

[0005] The purpose of this invention is to provide a network security situation assessment system based on user behavior analysis in order to solve the problems mentioned above.

[0006] The technical solution adopted in this invention is as follows: a network security situation assessment system based on user behavior analysis, comprising: a data acquisition module, a data preprocessing module, a behavior baseline modeling module, a behavior entropy and group game anomaly detection module, a situation assessment and visualization module, and a response and handling module; The data output terminal of the data acquisition module is connected to the raw data receiving terminal of the data preprocessing module; The standard data output of the data preprocessing module is connected to the training data input of the behavior baseline modeling module and the real-time detection data input of the behavior entropy and group game anomaly detection module, respectively. The baseline data output of the behavior baseline modeling module is connected to the reference data receiving end of the behavior entropy and group game anomaly detection module; The risk result output of the behavioral entropy and group game anomaly detection module is connected to the data receiving end of the situation assessment and visualization module; the alarm and work order output of the situation assessment and visualization module is connected to the event processing input of the response and handling module. The feedback output of the response and handling module is connected to the strategy adjustment receiver of the data acquisition module and the handling status receiver of the situation assessment and visualization module, respectively. The threshold and dispersion feedback output of the behavioral entropy and group game anomaly detection module are connected to the evolutionary parameter receiving end of the behavioral baseline modeling module.

[0007] In a preferred embodiment, the data acquisition module internally includes a log data acquisition submodule, a traffic data acquisition submodule, a user behavior data acquisition submodule, and a threat intelligence acquisition submodule. The log acquisition submodule is responsible for collecting various operational logs and alarm logs from firewalls, intrusion detection systems, host operating systems, databases, and critical application services. The traffic acquisition submodule captures network packets through the mirror port of the core switch and extracts metadata such as the five-tuple, session duration, and protocol type. The user behavior acquisition submodule embeds probes in the authentication gateway and the service front end to capture records of login requests, page visits, data exports, and operation times and locations. The threat intelligence acquisition submodule periodically synchronizes external malicious IPs, malicious domains, vulnerability disclosures, and attack organization fingerprints through a standardized interface. All collected data is initially decoded, uniformly encapsulated, and then passed to the preprocessing module.

[0008] In a preferred embodiment, the data preprocessing module internally includes a data cleaning and deduplication submodule, a format standardization and field mapping submodule, a feature extraction and derived calculation submodule, and a data caching and distribution scheduling submodule. The cleaning and deduplication submodule performs quality checks on the raw data, discarding records with missing key fields and using a Bloom filter to remove nearly duplicate records. The standardization submodule converts data from different sources into an internal standard model, standardizing the format and value range of timestamps, IP addresses, and various fields. The feature extraction submodule extracts basic features such as user identifiers, resource sensitivity, and operation idempotency from the standardized records, and calculates derived features such as operation frequency per unit time and resource access dispersion. The caching and distribution submodule sets up two levels of cache to store the raw data and feature vectors respectively, and distributes the data stream to the baseline modeling module and the anomaly detection module according to a strategy.

[0009] In a preferred embodiment, the behavioral entropy and group game anomaly detection module is internally equipped with an individual behavioral entropy and group entropy center calculation module: based on the sliding window to statistically analyze the user action transition probability, calculate the disorder of individual behavior, and aggregate the group mean as the orderliness benchmark.

[0010] The module maintains a fixed-length sliding time window for each user and counts the frequency of action type transitions within the window. Individual behavior entropy quantifies the degree of disorder in the operation sequence; a higher entropy value indicates more unpredictable behavior. Simultaneously, the arithmetic mean of the individual entropies of all users within the same group is taken to obtain the group entropy center, which serves as a benchmark for measuring the overall orderliness of the group. The corresponding formulas are individual behavior entropy and group entropy center.

[0011] The formula for calculating the entropy of individual behavior is:

[0012] Where i is the user ID, t is the current time, and n is the total number of action types. Let be the empirical probability that user i transitions from action j to action k within the sliding window.

[0013] The formula for calculating the center of group entropy is:

[0014] Where c is the group identifier and m is the total number of users in the group. Let be the individual entropy of user l at time t.

[0015] In a preferred embodiment, the behavioral entropy and group game anomaly detection module is internally equipped with a group dispersion and game betrayal payoff calculation module: it measures the difference between user and group distribution through relative entropy, and at the same time, it integrates three dimensions of access deviation, time anomaly and cooperation cost to quantify the potential payoff of users deviating from the cooperation strategy.

[0016] Group dispersion, expressed as relative entropy, compares the difference between the distribution of an individual user's behavior and the average distribution of their group. A significantly high value indicates a severe disconnect between the user's operational patterns and the group's. The payoff for betrayal in the game theory framework considers three dimensions: deviation from access to sensitive resources, unconventional activity over time, and the cost of maintaining collaborative consistency. A higher payoff indicates greater potential benefits for the user by deviating from cooperative strategies. The corresponding formulas are group dispersion and payoff for betrayal.

[0017] The formula for calculating the population dispersion is:

[0018] in The frequency at which user i performs action type s. Let n be the global frequency of action type s performed by all members in group c, where n is the total number of action types.

[0019] The formula for calculating the payoff for betrayal in a game is:

[0020] in For sensitive resource access deviation, This is an outlier in time-based activity. As the cost of collaborative consistency, α, β, and γ are preset non-negative weight coefficients.

[0021] In a preferred embodiment, the dynamic adaptive threshold update module generates a judgment threshold for the next period based on the current group entropy center, median return, and risk momentum term, so that the threshold adaptively adjusts with the overall fluctuation of the group. This dynamically updates the anomaly judgment threshold for the next period. This threshold is determined by the current period's group entropy center, the median of the game payoffs of all users within the group, and the risk momentum term from the previous period, allowing the threshold to adjust rapidly in response to fluctuations in the overall risk level of the group. The corresponding formula is for dynamic threshold updates.

[0022] Dynamic threshold update

[0023] in To determine the threshold for the next cycle, and Here, median represents the median value of the earnings of all users within the group, and denoted by the weighting coefficient. This is the momentum term of the group risk slope in the previous cycle. This is the momentum adjustment factor.

[0024] In a preferred embodiment, the behavioral entropy and group game anomaly detection module is internally equipped with a comprehensive risk coefficient fusion and output module: it nonlinearly combines the relative value of individual entropy with the payoff deviation index term to output the final risk score, and feeds back the group dispersion and new threshold to the baseline modeling module to drive continuous evolution.

[0025] The above indicators are combined into a final comprehensive risk coefficient. This coefficient uses the ratio of individual entropy to the group entropy center as a basic factor, multiplied by an exponential deviation term of the game payoff relative to the group mean. When both factors simultaneously point to anomalies, the risk coefficient jumps sharply, directly used for early warning and judgment, while also incorporating group dispersion. and new threshold The data is then fed back to the baseline modeling module to drive baseline evolution.

[0026] The formula for calculating the comprehensive risk coefficient is:

[0027] in Let be the arithmetic mean of the game payoffs of all users within group c. This is the final risk score output.

[0028] In a preferred embodiment, the behavior baseline modeling module internally includes a feature time-series statistical analysis submodule, an individual behavior profile construction submodule, a group behavior aggregation submodule, and a baseline storage and version management submodule. The time-series statistical analysis submodule performs trend, periodic, and residual decomposition on user behavior characteristics, calculating the historical mean and quantile intervals for each time period. The individual profile construction submodule establishes multi-dimensional normal behavior intervals for each user, including active time intervals, frequently used network and device sets, typical operation paths, and access permission boundaries. The group aggregation submodule divides users into groups based on department, role, and resource access similarity, aggregating common patterns and behavior similarity matrices within the groups. The storage and version management submodule serializes the baseline and group baselines and stores them in a time-series database, and periodically triggers baseline recalculation based on feedback parameters from the anomaly detection module, storing both old and new versions in parallel for auditing purposes.

[0029] In a preferred embodiment, the situation assessment and visualization module internally includes a global risk aggregation calculation submodule, a user risk profile management submodule, a threat trend analysis submodule, and a visualization dashboard and report generation submodule. The global risk aggregation submodule summarizes the risk coefficients of all users and calculates the global instantaneous risk index, regional risk score, and system risk score according to asset weight, mapping continuous values ​​to discrete situation levels. The user risk profile submodule maintains dynamically updated risk score sequences, abnormal contribution dimensions, group rankings, and historical alarm event records for each user, using a sliding window to retain only the most recently valid data. The threat trend analysis submodule maps abnormal events to each link in the network kill chain and statistically analyzes the distribution at each stage, performing correlation calculations on multi-user risk sequences within the group to identify coordinated attack signals. The visualization dashboard and report generation submodule renders the above data into a situation overview map, user ranking table, network topology coloring map, and geographic view, and supports periodic generation of security situation reports.

[0030] In a preferred embodiment, the response and handling module internally includes an alarm classification and work order generation submodule, an automated response execution submodule, a manual review and handling tracking submodule, and a handling effect evaluation and feedback submodule. The alarm classification submodule classifies events into informational, warning, severe, and urgent levels based on risk thresholds, generates structured work orders, and routes them to the corresponding maintenance personnel according to responsibility. The automated response submodule pre-configures standardized scripts for severe and urgent alarms, automatically executing actions such as firewall blocking, forced session logout, terminal isolation, and permission revocation, recording system status snapshots before and after execution for rollback purposes. The manual review submodule provides maintenance personnel with an operation console displaying pending work orders and recommendations, supporting confirmation or rejection of automated handling, and tracking the complete lifecycle of work orders. The effect evaluation submodule compares the risk changes and recurrence intervals before and after handling after the work order is closed, encapsulates the evaluation results into feedback messages, and sends them back to the data acquisition module and the situation assessment module for adjusting data acquisition filtering strategies and alarm confidence weights.

[0031] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: 1. In this invention, each user is placed within their respective group for horizontal comparison. Even if an individual's behavior does not deviate from its historical range, the system can identify anomalies as long as it shows significant differences from the commonalities of the group. The group game mechanism further endows the system with predictive capabilities. By judging whether current behavior tends to obtain benefits beyond normal business needs, the system can issue early warnings before substantial damage occurs. The system's synchronous analysis of changes in the behavior of multiple users within the group can also capture collusive attacks in which multiple accounts move towards the same target in a coordinated manner. This pattern is completely invisible from a single-point detection perspective. These mechanisms combined effectively improve the system's sensitivity and early detection capability against covert threats such as internal theft, account hijacking, and coordinated infiltration.

[0032] 2. In this invention, the threshold is automatically recalibrated based on the group entropy center and risk momentum after each evaluation cycle, always following the drift of actual business behavior, effectively reducing the number of false alarms caused by normal business changes. In the complete data collection, baseline modeling, anomaly detection, situation assessment, and response chain, the handling conclusions are continuously fed back to the upstream module to correct the collection strategy and alarm weights. The baseline modeling module continuously receives dynamic threshold and dispersion data from the detection module to drive baseline iteration, ensuring that the entire system does not repeatedly make the same type of false positives or false negatives. These mechanisms combined effectively improve the long-term stability and availability of the system, reducing the workload of security operations personnel in manually adjusting parameters and handling false alarms. Attached Figure Description

[0033] Figure 1 This is an overall system block diagram of the present invention; Figure 2 This is a flowchart of the system security situation assessment method in this invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Example

[0035] Reference Figure 1-2 A network security situation assessment system based on user behavior analysis includes: a data acquisition module, a data preprocessing module, a behavior baseline modeling module, a behavior entropy and group game anomaly detection module, a situation assessment and visualization module, and a response and handling module. The data output terminal of the data acquisition module is connected to the raw data receiving terminal of the data preprocessing module; The standard data output of the data preprocessing module is connected to the training data input of the behavior baseline modeling module and the real-time detection data input of the behavior entropy and group game anomaly detection module, respectively. The baseline data output of the behavior baseline modeling module is connected to the reference data receiving end of the behavior entropy and group game anomaly detection module; The risk result output of the behavioral entropy and group game anomaly detection module is connected to the data receiving end of the situation assessment and visualization module; the alarm and work order output of the situation assessment and visualization module is connected to the event processing input of the response and handling module. The feedback output of the response and handling module is connected to the strategy adjustment receiver of the data acquisition module and the handling status receiver of the situation assessment and visualization module, respectively. The threshold and dispersion feedback output of the behavioral entropy and group game anomaly detection module are connected to the evolutionary parameter receiving end of the behavioral baseline modeling module.

[0036] The data acquisition module internally comprises four sub-modules: log data acquisition, traffic data acquisition, user behavior data acquisition, and threat intelligence acquisition. The log acquisition sub-module is responsible for collecting various operational and alarm logs from firewalls, intrusion detection systems, host operating systems, databases, and critical application services. The traffic acquisition sub-module captures network packets through the mirrored ports of the core switch and extracts metadata such as the five-tuple, session duration, and protocol type. The user behavior acquisition sub-module embeds probes in the authentication gateway and business front-end to capture records of login requests, page visits, data exports, and operation times and locations. The threat intelligence acquisition sub-module periodically synchronizes external intelligence data such as malicious IPs, malicious domains, vulnerability disclosures, and attack organization fingerprints through standardized interfaces. All collected data is initially decoded, uniformly encapsulated, and then passed to the preprocessing module.

[0037] The data preprocessing module includes sub-modules for data cleaning and deduplication, format standardization and field mapping, feature extraction and derived calculation, and data caching and distribution scheduling. The cleaning and deduplication sub-module performs quality checks on the raw data, discarding records with missing key fields and using a Bloom filter to remove near-duplicate records. The standardization sub-module converts data from different sources into an internal standard model, standardizing the format and value range of timestamps, IP addresses, and various fields. The feature extraction sub-module extracts basic features such as user identifiers, resource sensitivity, and operation idempotency from the standardized records, and calculates derived features such as operation frequency per unit time and resource access dispersion. The caching and distribution sub-module sets up two levels of cache to store the raw data and feature vectors respectively, and distributes the data stream to the baseline modeling module and the anomaly detection module according to a strategy.

[0038] The behavioral entropy and group game anomaly detection module has an internal module for calculating individual behavioral entropy and group entropy centers: it calculates the disorder of individual behavior based on the probability of user action transitions using a sliding window, and aggregates the group mean as a benchmark for orderliness.

[0039] The module maintains a fixed-length sliding time window for each user and counts the frequency of action type transitions within the window. Individual behavior entropy quantifies the degree of disorder in the operation sequence; a higher entropy value indicates more unpredictable behavior. Simultaneously, the arithmetic mean of the individual entropies of all users within the same group is taken to obtain the group entropy center, which serves as a benchmark for measuring the overall orderliness of the group. The corresponding formulas are individual behavior entropy and group entropy center.

[0040] The formula for calculating the entropy of individual behavior is:

[0041] Where i is the user ID, t is the current time, and n is the total number of action types. Let be the empirical probability that user i transitions from action j to action k within the sliding window.

[0042] The formula for calculating the center of group entropy is: Where c is the group identifier and m is the total number of users in the group. Let be the individual entropy of user l at time t.

[0044] The behavioral entropy and group game anomaly detection module has an internal module for calculating group dispersion and game betrayal payoff: it measures the difference between user and group distribution through relative entropy, and quantifies the potential payoff of users deviating from the cooperation strategy by comprehensively considering three dimensions: access deviation, time anomaly, and cooperation cost.

[0045] Group dispersion, expressed as relative entropy, compares the difference between the distribution of an individual user's behavior and the average distribution of their group. A significantly high value indicates a severe disconnect between the user's operational patterns and the group's. The payoff for betrayal in the game theory framework considers three dimensions: deviation from access to sensitive resources, unconventional activity over time, and the cost of maintaining collaborative consistency. A higher payoff indicates greater potential benefits for the user by deviating from cooperative strategies. The corresponding formulas are group dispersion and payoff for betrayal.

[0046] The formula for calculating the population dispersion is:

[0047] in The frequency at which user i performs action type s. Let n be the global frequency of action type s performed by all members in group c, where n is the total number of action types.

[0048] The formula for calculating the payoff for betrayal in a game is:

[0049] in For sensitive resource access deviation, This is an outlier in time-based activity. As the cost of collaborative consistency, α, β, and γ are preset non-negative weight coefficients.

[0050] The dynamic adaptive threshold update module generates the judgment threshold for the next period based on the current group entropy center, median return, and risk momentum term, allowing the threshold to adaptively adjust with overall group fluctuations. It dynamically updates the anomaly judgment threshold for the next period. This threshold is determined by the current period's group entropy center, the median of the game payoffs of all users within the group, and the risk momentum term from the previous period, allowing the threshold to adjust rapidly in response to fluctuations in the overall risk level of the group. The corresponding formula is for dynamic threshold updates.

[0051] Dynamic threshold update

[0052] in To determine the threshold for the next cycle, and Here, median represents the median value of the earnings of all users within the group, and denoted by the weighting coefficient. This is the momentum term of the group risk slope in the previous cycle. This is the momentum adjustment factor.

[0053] The behavioral entropy and group game anomaly detection module has an internal comprehensive risk coefficient fusion and output module: it nonlinearly combines the relative value of individual entropy with the payoff deviation index term to output the final risk score, and feeds back the group dispersion and new threshold to the baseline modeling module to drive continuous evolution.

[0054] The above indicators are combined into a final comprehensive risk coefficient. This coefficient uses the ratio of individual entropy to the group entropy center as a basic factor, multiplied by an exponential deviation term of the game payoff relative to the group mean. When both factors simultaneously point to anomalies, the risk coefficient jumps sharply, directly used for early warning and judgment, while also incorporating group dispersion. and new threshold The data is then fed back to the baseline modeling module to drive baseline evolution.

[0055] The formula for calculating the comprehensive risk coefficient is:

[0056] in Let be the arithmetic mean of the game payoffs of all users within group c. This is the final risk score output.

[0057] The behavioral baseline modeling module internally comprises a feature time-series statistical analysis submodule, an individual behavior profile construction submodule, a group behavior aggregation submodule, and a baseline storage and version management submodule. The time-series statistics submodule performs trend, periodic, and residual decomposition on user behavior characteristics, calculating historical means and quantile intervals for each time period. The individual profile construction submodule establishes multi-dimensional normal behavior intervals for each user, including active time intervals, frequently used network and device sets, typical operation paths, and access permission boundaries. The group aggregation submodule divides users into groups based on department, role, and resource access similarity, aggregating common patterns and behavioral similarity matrices within each group. The storage and version management submodule serializes the baseline and group baselines and stores them in a time-series database. It also receives feedback parameters from the anomaly detection module to periodically trigger baseline recalculation, storing both old and new versions in parallel for auditing purposes.

[0058] The situation assessment and visualization module includes a global risk aggregation calculation submodule, a user risk profile management submodule, a threat trend analysis submodule, and a visualization dashboard and report generation submodule. The global risk aggregation submodule summarizes the risk coefficients of all users and calculates the global instantaneous risk index, regional risk score, and system risk score according to asset weight, mapping continuous values ​​to discrete situation levels. The user risk profile submodule maintains dynamically updated risk score sequences, abnormal contribution dimensions, group rankings, and historical alarm event records for each user, using a sliding window to retain only the most recently valid data. The threat trend analysis submodule maps abnormal events to each link in the network kill chain and statistically analyzes the distribution of each stage, performing correlation calculations on multi-user risk sequences within a group to identify coordinated attack signals. The visualization dashboard and report generation submodule renders the above data into a situation overview map, user ranking table, network topology coloring map, and geographic view, and supports periodic generation of security situation reports.

[0059] The response and handling module includes sub-modules for alarm classification and work order generation, automated response execution, manual review and handling tracking, and handling effect evaluation and feedback. The alarm classification sub-module categorizes events into informational, warning, severe, and urgent levels based on risk thresholds, generates structured work orders, and routes them to the corresponding operations and maintenance personnel according to responsibility. The automated response sub-module pre-configures standardized scripts for severe and urgent alarms, automatically executing actions such as firewall blocking, forced session logout, endpoint isolation, and permission revoke, recording system state snapshots before and after execution for rollback purposes. The manual review sub-module provides operations and maintenance personnel with an operation console displaying pending work orders and recommendations, supporting confirmation or rejection of automated handling, and tracking the complete lifecycle of work orders. The effect evaluation sub-module compares risk changes and recurrence intervals before and after handling after work order closure, encapsulates the evaluation results into feedback messages, and sends them back to the data acquisition module and the situation assessment module for adjusting data acquisition filtering strategies and alarm confidence weights.

[0060] Based on the above system design, the security situation assessment method of this system includes the following steps: S1: The data acquisition module collects raw security data from security devices, network traffic, user operation logs, and external threat intelligence sources. Security devices include firewalls, intrusion detection systems, and antivirus gateways. Network traffic is captured through the mirror port of the core switch, and protocol metadata is extracted. User operation logs are obtained by embedding points at the authentication gateway and the front end of the business system to obtain login behavior and function operation records. Threat intelligence is synchronized with external malicious domains and attack organization fingerprints through standardized interfaces.

[0061] S2: The data preprocessing module cleans, deduplicates, standardizes, and extracts features from the collected raw data to form a structured feature vector with a unified format. The cleaning process filters out invalid records with missing key fields and removes duplicate data. The standardization process maps all data fields from all sources to a standard model defined within the system. Feature extraction extracts basic features such as user identifier, operation object, resource sensitivity, and action type from the standardized records.

[0062] S3: The behavioral baseline modeling module establishes individual behavioral profiles and group behavioral baselines based on historical data. The behavioral entropy and group game anomaly detection module compares real-time features with the baseline and group reference, calculates individual behavioral entropy, group entropy center, group dispersion, and game betrayal payoff, and outputs the comprehensive risk coefficient for each user. The baseline modeling module first establishes a multi-dimensional normal behavior range for each user, then divides users into groups based on department affiliation and aggregates group-level behavioral distributions. The anomaly detection module sequentially completes entropy field calculation, payoff assessment, and risk fusion in each evaluation cycle, and finally outputs the risk score for each user in numerical form.

[0063] S4: The situation assessment and visualization module aggregates the risk coefficients of all users, generating a global risk index, regional risk levels, and user risk profiles. The assessment results are presented in the form of a visualization dashboard and reports. The global risk index is obtained by weighting the risk scores of all users according to asset importance. The regional risk levels are calculated independently for each network area and business system. The user risk profile records the risk trends and specific dimensions that trigger anomalies for each user. The visualization dashboard renders the above data as a situation overview map, ranking table, and topology coloring map.

[0064] S5: The response and handling module triggers alarms and handling actions based on the risk level, and feeds back the handling results to the upstream module for optimizing the data collection strategy and baseline evolution. Handling actions are divided into four levels according to risk level: information logging, alarm notification, automatic isolation, and complete blocking. Alarms of severe or higher levels trigger preset standardized response scripts to execute blocking or permission revocation actions. After handling is completed, the effect evaluation results are encapsulated as feedback messages and sent back to the data collection module and the behavior baseline modeling module to drive adjustments to the data collection filtering strategy and updates to the baseline version.

[0065] The primary effect of this system lies in its substantial enhancement of anomaly detection capabilities. Traditional methods rely on an individual's historical baseline, allowing attackers to easily bypass detection once they possess legitimate credentials and mimic the user's daily actions. This system places each user within their respective group for horizontal comparison. Even if an individual's behavior does not deviate significantly from their historical range, the system can identify anomalies if it differs significantly from the group's commonalities. The group game mechanism further endows the system with predictive capabilities. By judging whether current behavior tends to gain benefits beyond normal business needs, the system can issue warnings before substantial damage occurs. The system's synchronous analysis of changes in the behavior of multiple users within the group can also capture collusive attacks where multiple accounts move towards the same target in a coordinated manner—a pattern completely invisible from a single-point detection perspective. These mechanisms combined effectively improve the system's sensitivity and early detection capabilities against covert threats such as internal theft, account hijacking, and coordinated infiltration.

[0066] Another core effect of this system is that the detection threshold automatically evolves with the business environment, while the various modules form a mutually reinforcing closed-loop feedback. Fixed threshold rules either frequently generate false alarms or gradually become ineffective when faced with business expansion, personnel adjustments, or slow attacker probing. This system's thresholds are automatically recalibrated at the end of each assessment cycle based on the group entropy center and risk momentum, always following the drift of actual business behavior, effectively reducing the number of false alarms caused by normal business changes. In the complete data collection, baseline modeling, anomaly detection, situation assessment, and response chain, the response conclusions are continuously fed back to the upstream modules to correct the collection strategy and alarm weights. The baseline modeling module continuously receives dynamic threshold and dispersion data from the detection module to drive baseline iteration, ensuring that the entire system does not repeatedly make the same type of false positives or false negatives. These mechanisms combined effectively improve the long-term stability and availability of the system, reducing the workload of security operations personnel in manually adjusting parameters and handling false alarms.

[0067] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the term "comprising" or any other variations thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0068] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security situation assessment system based on user behavior analysis, characterized in that: include: The module includes a data acquisition module, a data preprocessing module, a behavioral baseline modeling module, a behavioral entropy and group game anomaly detection module, a situation assessment and visualization module, and a response and handling module. The data output terminal of the data acquisition module is connected to the raw data receiving terminal of the data preprocessing module; The standard data output of the data preprocessing module is connected to the training data input of the behavior baseline modeling module and the real-time detection data input of the behavior entropy and group game anomaly detection module, respectively. The baseline data output of the behavior baseline modeling module is connected to the reference data receiving end of the behavior entropy and group game anomaly detection module; The risk result output of the behavioral entropy and group game anomaly detection module is connected to the data receiving end of the situation assessment and visualization module; the alarm and work order output of the situation assessment and visualization module is connected to the event processing input of the response and handling module. The feedback output of the response and handling module is connected to the strategy adjustment receiver of the data acquisition module and the handling status receiver of the situation assessment and visualization module, respectively. The threshold and dispersion feedback output of the behavioral entropy and group game anomaly detection module are connected to the evolutionary parameter receiving end of the behavioral baseline modeling module.

2. The network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The data acquisition module is internally configured with a log data acquisition submodule, a traffic data acquisition submodule, a user behavior data acquisition submodule, and a threat intelligence acquisition submodule. The log collection submodule is responsible for collecting various operational logs and alarm logs from firewalls, intrusion detection systems, host operating systems, databases, and critical application services; The traffic acquisition submodule captures network packets through the mirror port of the core switch and extracts metadata such as the five-tuple, session duration, and protocol type.

3. The network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The data preprocessing module includes a data cleaning and deduplication submodule, a format standardization and field mapping submodule, a feature extraction and derivative calculation submodule, and a data caching and distribution scheduling submodule.

4. The network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The behavioral entropy and group game anomaly detection module is internally equipped with an individual behavioral entropy and group entropy center calculation module: based on the sliding window to statistically analyze the user action transition probability, calculate the disorder of individual behavior, and aggregate the group mean as the orderliness benchmark; The module maintains a fixed-length sliding time window for each user and counts the frequency of action type transitions within the window; Individual behavioral entropy quantifies the degree of disorder in the sequence of operations; the higher the entropy value, the more unpredictable the behavior. At the same time, the arithmetic mean of the individual entropies of all users in the same group is taken to obtain the group entropy center, which serves as a benchmark for measuring the overall orderliness of the group. The corresponding formulas are individual behavioral entropy and group entropy center. The formula for calculating the entropy of individual behavior is: Where i is the user ID, t is the current time, and n is the total number of action types. Let be the empirical probability that user i transitions from action j to action k within the sliding window; The formula for calculating the center of group entropy is: Where c is the group identifier and m is the total number of users in the group. Let be the individual entropy of user l at time t.

5. The network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The behavioral entropy and group game anomaly detection module is internally set up with a group dispersion and game betrayal payoff calculation module: it measures the difference between user and group distribution through relative entropy, and at the same time, it integrates three dimensions of access deviation, time anomaly and cooperation cost to quantify the potential payoff of users deviating from the cooperation strategy. Group dispersion is expressed as relative entropy, comparing the difference between the distribution of a single user's behavior and the average distribution of their group. A significantly higher value indicates that the user's operating pattern is severely out of sync with the group. Game betrayal payoff considers three dimensions: deviation from access to sensitive resources, unconventional activity over time, and the cost of collaboration consistency. A higher payoff indicates that the user can obtain greater potential benefits by adopting a strategy that deviates from cooperation. The corresponding formulas are group dispersion and game betrayal payoff. The formula for calculating the population dispersion is: in The frequency at which user i performs action type s. The global frequency of action type s performed by all members in group c, where n is the total number of action types; The formula for calculating the payoff for betrayal in a game is: in For sensitive resource access deviation, This is an outlier in time-based activity. As the cost of collaborative consistency, α, β, and γ are preset non-negative weight coefficients.

6. The network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The dynamic adaptive threshold update module generates the judgment threshold for the next period based on the current group entropy center, median return, and risk momentum term, so that the threshold is adaptively adjusted with the overall fluctuation of the group. The anomaly detection threshold is dynamically updated for the next cycle. The threshold is determined by the group entropy center of the current period, the median of the game payoffs of all users in the group, and the risk momentum term of the previous period, so that the threshold can be quickly adjusted to follow the fluctuations of the overall risk level of the group; the corresponding formula is dynamic threshold update. Dynamic threshold update in To determine the threshold for the next cycle, and Here, median represents the median value of the earnings of all users within the group, and denoted by the weighting coefficient. This is the momentum term of the group risk slope in the previous cycle. This is the momentum adjustment factor.

7. The network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The behavioral entropy and group game anomaly detection module is internally equipped with a comprehensive risk coefficient fusion and output module: it nonlinearly combines the relative value of individual entropy with the payoff deviation index term to output the final risk score, and feeds back the group dispersion and new threshold to the baseline modeling module to drive continuous evolution. The above indicators are combined into a final comprehensive risk coefficient; this coefficient uses the ratio of individual entropy to the center of group entropy as the basic factor, and then multiplies it by the exponential deviation of the game payoff from the group mean. When both factors point to an anomaly, the risk coefficient jumps sharply, which is directly used for early warning and judgment, while also considering the population dispersion. and new threshold The data is then fed back to the baseline modeling module to drive baseline evolution; The formula for calculating the comprehensive risk coefficient is: in Let be the arithmetic mean of the game payoffs of all users within group c. This is the final risk score output.

8. The network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The behavior baseline modeling module includes a feature time-series statistical analysis submodule, an individual behavior profile construction submodule, a group behavior aggregation submodule, and a baseline storage and version management submodule. The time series statistics submodule performs trend, periodic and residual decomposition on user behavior characteristics and calculates the historical mean and quantile intervals for each time period.

9. A network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The situation assessment and visualization module includes a global risk aggregation calculation submodule, a user risk profile management submodule, a threat trend analysis submodule, and a visualization dashboard and report generation submodule. The global risk aggregation submodule summarizes the risk coefficients of all users and calculates the global instantaneous risk index, regional risk score and system risk score according to asset weight, mapping continuous values ​​to discrete situation levels.

10. A network security situation assessment system based on user behavior analysis according to claim 1, characterized in that: The response and handling module includes an alarm classification and work order generation submodule, an automated response execution submodule, a manual review and handling tracking submodule, and a handling effect evaluation and feedback submodule. The alarm classification submodule classifies events into information level, warning level, critical level and emergency level according to risk thresholds, generates structured work orders and routes them to the corresponding operation and maintenance personnel according to responsibility.

Images