Abnormal data access behavior monitoring method, device and system, and electronic device

Abstract

The application relates to the field of data security, in particular to an abnormal data access behavior monitoring method, device and system and an electronic device. The method comprises the following steps: extracting features from historical access data to obtain access feature data, and dividing the access feature data into normal feature data and abnormal feature data; performing feature interaction on the normal feature data to obtain a normal feature interaction relationship, and performing feature interaction on the abnormal feature data to obtain an abnormal feature interaction relationship; obtaining a real-time feature interaction relationship of real-time access data; calculating a normal feature matching degree of the real-time feature interaction relationship and the normal feature interaction relationship, and calculating an abnormal feature matching degree of the real-time feature interaction relationship and the abnormal feature interaction relationship; and determining whether the real-time data access behavior is an abnormal data access behavior according to the normal feature matching degree and the abnormal feature matching degree. The application achieves the technical effects of improving the accuracy and adaptability of an abnormal data access behavior monitoring result and reducing the false positive rate and the false negative rate.

Description

Technical Field

[0001] This application relates to the field of data security, specifically to a method, apparatus and system, and electronic device for monitoring abnormal data access behavior. Background Technology

[0002] With the rapid development of information technology, data has become a crucial asset for enterprises and organizations. Various business systems store vast amounts of business data, and the leakage or alteration of this data can cause incalculable losses to businesses and institutions. At the same time, user access behaviors to data are becoming increasingly complex and diverse. Ensuring data security and integrity, and promptly detecting and preventing abnormal data access behavior, is vital for maintaining stable system operation, protecting user privacy, and ensuring the normal operation of enterprises.

[0003] Traditional data access monitoring methods often rely on simple rule matching, such as access control and anomaly detection based on static information like usernames and IP addresses. However, this approach struggles to cope with increasingly sophisticated attack methods and changing user behavior patterns. For example, hackers might obtain legitimate user account information and access data from seemingly normal IP addresses during normal access periods, but in reality, they are performing abnormal data theft or tampering operations. In such cases, traditional monitoring methods often fail to detect the anomalies in a timely manner.

[0004] Furthermore, with the continuous growth of data volume, traditional methods are inefficient in processing massive amounts of data and cannot meet the needs of real-time monitoring. At the same time, traditional methods struggle to accurately identify some new types of abnormal behaviors due to the lack of effective feature extraction and learning mechanisms. Therefore, there is an urgent need for a more intelligent and efficient method for monitoring abnormal data access behavior to adapt to the ever-changing security environment. Summary of the Invention

[0005] In view of this, it is necessary to provide a method, device, system, and electronic device for monitoring abnormal data access behavior, so as to improve the accuracy and adaptability of the monitoring results of abnormal data access behavior and reduce the false alarm rate and false negative rate.

[0006] To achieve the aforementioned technical effects, firstly, this application provides a method for monitoring abnormal data access behavior, including: Historical access data is obtained, and features are extracted from the historical access data to obtain access feature data. The access feature data is then divided into normal feature data and abnormal feature data. Normal feature interaction relationships are obtained by performing feature interaction on the normal feature data, and abnormal feature interaction relationships are obtained by performing feature interaction on the abnormal feature data. Obtain real-time access data of real-time data access behavior, and obtain the real-time feature interaction relationship of the real-time access data; Calculate the normal feature matching degree between the real-time feature interaction relationship and the normal feature interaction relationship, and calculate the abnormal feature matching degree between the real-time feature interaction relationship and the abnormal feature interaction relationship; Whether the real-time data access behavior is an abnormal data access behavior is determined based on the normal feature matching degree and the abnormal feature matching degree.

[0007] In one possible embodiment, obtaining normal feature interaction relationships by performing feature interaction on the normal feature data includes: Based on a deep neural network, feature interactions are performed on the normal feature data, and the data interaction relationships between the normal feature data are extracted as the normal feature interaction relationships.

[0008] In one possible embodiment, dividing the access feature data into normal feature data and abnormal feature data includes: Obtain labeled data from the historical access data, and determine a classification model based on the proportion of labeled data in the historical access data. Based on the classification model, the access feature data is divided into normal feature data and abnormal feature data.

[0009] In one possible embodiment, determining the classification model based on the proportion of the labeled data in the historical access data includes: If the proportion of the data volume is greater than the first set threshold, the classification model is determined to be a supervised algorithm model; If the proportion of the data volume is less than or equal to the first set threshold, the classification model is determined to be an unsupervised algorithm model.

[0010] In one possible embodiment, the classification model is a supervised algorithm model, and the step of dividing the access feature data into normal feature data and abnormal feature data based on the classification model includes: If the proportion of the data volume is greater than the second set threshold, the supervised algorithm model is trained based on the labeled data to obtain the target classification model. Based on the target classification model, the access feature data is divided into normal feature data and abnormal feature data.

[0011] In one possible embodiment, the classification model is a supervised algorithm model, and the step of dividing the access feature data into normal feature data and abnormal feature data based on the classification model includes: If the proportion of the data volume is less than or equal to the second set threshold, the supervised algorithm model is trained based on the labeled data to form a teacher model. Pseudo-label data is constructed based on the teacher model and the access feature data; The supervised algorithm model is trained based on the labeled data and the pseudo-label data to obtain the target classification model. Based on the target classification model, the access feature data is divided into normal feature data and abnormal feature data.

[0012] In one possible embodiment, the step of extracting features from the historical access data to obtain access feature data includes: Provides multiple preset feature dimensions; Feature extraction is performed on the historical access data to obtain historical data features; Each of the historical data features is matched to the preset feature dimension to form the access feature data.

[0013] Secondly, this application provides an abnormal data access behavior monitoring device, comprising: The historical data acquisition module is used to acquire historical access data, extract features from the historical access data to obtain access feature data, and divide the access feature data into normal feature data and abnormal feature data. The feature interaction module is used to perform feature interaction on the normal feature data to obtain normal feature interaction relationships, and to perform feature interaction on the abnormal feature data to obtain abnormal feature interaction relationships. A real-time data acquisition module is used to acquire real-time access data of real-time data access behavior and to acquire real-time feature interaction relationships of the real-time access data. An interaction matching module is used to calculate the normal feature matching degree between the real-time feature interaction relationship and the normal feature interaction relationship, and to calculate the abnormal feature matching degree between the real-time feature interaction relationship and the abnormal feature interaction relationship. An anomaly determination module is used to determine whether the real-time data access behavior is an abnormal data access behavior based on the normal feature matching degree and the abnormal feature matching degree.

[0014] Thirdly, this application provides an electronic device, including: an input serial bus, an output serial bus, a memory, and a processor, wherein... The input serial bus is used to acquire historical access data and real-time access data of real-time data access behavior; The memory is used to store the program, the historical access data, and the real-time access data; The processor, coupled to the memory, is used to execute the program stored in the memory based on the actual concentration change data, so as to implement the steps in the aforementioned abnormal data access behavior monitoring method, in order to determine whether the real-time data access behavior is abnormal data access behavior. The output serial bus is used to output to the result display device whether the real-time data access behavior is abnormal data access behavior.

[0015] Fourthly, this application provides an abnormal data access behavior monitoring system, including: A gateway device, an abnormal data access behavior monitoring device as described above connected to the gateway device, and a data storage device connected to the abnormal data access behavior monitoring device. The gateway device is used to receive real-time data access behavior, and the abnormal data access behavior monitoring device is used to monitor whether the real-time data access behavior is abnormal data access behavior. If the real-time data access behavior is the abnormal data access behavior, the gateway device is allowed to access the data storage device.

[0016] Compared with related technologies, the abnormal data access behavior monitoring method, device, system, and electronic equipment provided in this application extracts features from historical access data to obtain access feature data, divides the access feature data into normal feature data and abnormal feature data, and then further performs feature interaction on the normal feature data and abnormal feature data to obtain corresponding normal feature interaction relationships and abnormal feature interaction relationships. Using the normal feature interaction relationships and abnormal feature interaction relationships as standards, for real-time access data of real-time data access behavior, the corresponding real-time feature interaction relationships are obtained, and the real-time feature interaction relationships are compared with the standard normal feature interaction relationships and abnormal feature interaction relationships. The matching degree of feature interaction relationships is calculated to obtain the normal feature matching degree between real-time feature interaction relationships and normal feature interaction relationships, and the abnormal feature matching degree between real-time feature interaction relationships and abnormal feature interaction relationships. Finally, based on the normal feature matching degree and the abnormal feature matching degree, it is determined whether the real-time data access behavior is abnormal data access behavior. By constructing standard normal feature interaction relationships and abnormal feature interaction relationships, and calculating the matching degree between real-time feature interaction relationships and normal feature interaction relationships and abnormal feature interaction relationships to determine abnormal behavior, it can effectively identify abnormal patterns at the feature combination level, improve the accuracy and adaptability of anomaly detection, and reduce the false alarm rate and false negative rate. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the abnormal data access behavior monitoring method provided in an embodiment of this application. Figure 2 This is a flowchart illustrating the process of dividing access feature data into normal feature data and abnormal feature data in the abnormal data access behavior monitoring method provided in this application embodiment; Figure 3 This is a schematic diagram of the abnormal data access behavior monitoring device provided in the embodiments of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application; Figure 5 This is a schematic diagram of the abnormal data access behavior monitoring system provided in the embodiments of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0020] In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0021] The terms "first," "second," etc., used in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a technical feature defined with "first" or "second" may explicitly or implicitly include at least one of those features.

[0022] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] This application provides a method, device, system, and electronic device for monitoring abnormal data access behavior, which will be described below.

[0024] Please refer to Figure 1 The abnormal data access behavior monitoring method provided in this application includes: Step S101: Obtain historical access data, extract features from the historical access data to obtain access feature data, and divide the access feature data into normal feature data and abnormal feature data.

[0025] In this step, historical access data is a collection of records of all data access behaviors in the system or application within a historical period, including access time, accessing user identity, accessed resource, type of operation performed, source IP address, and other information.

[0026] Furthermore, multiple preset feature dimensions are provided for these historical access data; features are extracted from the historical access data to obtain historical data features; each historical data feature is matched to a preset feature dimension to form access feature data.

[0027] The preset feature dimensions are a set of attributes or metrics predefined to describe data access behavior based on its characteristics and monitoring needs. These dimensions can be discrete categorical attributes, such as access protocol type, operation type (read, write, delete), user role, etc.; or they can be continuous numerical attributes, such as accessed data volume, access frequency, connection duration, etc. For example, providing multiple preset feature dimensions is represented as follows: .in: Encode the data source; This is the account's expiration date; once the account expires, login will no longer be permitted. This is the account's validity period. You can set it so that if the validity period expires in half an hour, you will need to log in and verify again. The system time is used. During accessible time periods (such as 8:00 to 22:00, or during special task periods, as provided by the abnormal access behavior identification knowledge base), it is considered normal behavior; otherwise, it is considered abnormal behavior. Provides blacklist and whitelist settings for user login IP addresses. When authenticating user login, the IP whitelist can be used to verify whether the login IP is legitimate, and blacklisted IPs are not allowed to log in. If the terminal operating system is not Kylin OS or other certified operating systems, login will not be allowed. To verify the characteristics of the application system, only application systems that have passed single sign-on authentication can be accessed directly; those that have not passed single sign-on will only be redirected to an address and will require a second login with a username and password.

[0028] Feature extraction from historical access data specifically involves identifying, selecting, and transforming information that effectively reflects the characteristics of data access behavior from the original historical access data as historical data features. These historical data features can be direct fields from the original data, such as IP addresses and timestamps in logs; or they can be derived features obtained through calculation or transformation, such as the number of accesses within a specific time window, average data transfer rate, and access failure rate.

[0029] Each historical data feature is matched to a preset feature dimension. This means that the specific historical data features extracted from the original historical access data are classified into the corresponding preset feature dimensions.

[0030] Furthermore, in some embodiments of this application, the preset feature dimension may also include multiple levels, that is, multiple smaller feature dimensions are classified into the same larger feature dimension. For example, it can be set as follows: (1) Basic identity features: including account validity period, account validity time and system time. Used to verify the timeliness of user identity. (2) Device trust features: including terminal operating system identifier (e.g., verifying whether it is a Kylin operating system) and hardware fingerprint. Hardware fingerprint is used to uniquely identify the access terminal and prevent IP forgery or account theft. (3) Application context features: including single sign-on authentication status (verifying whether the request comes from a legitimate authentication application system) and access data sensitivity level (judging the risk level based on the type of data accessed).

[0031] For further details, please refer to Figure 2 In this embodiment, the access feature data is divided into normal feature data and abnormal feature data, specifically including: Step S201: Obtain labeled data from historical access data, and determine the classification model based on the proportion of labeled data in historical access data.

[0032] In this step, the labeled data refers to samples of historical access data that have been explicitly marked as "normal" or "abnormal". This can be achieved through human experts reviewing and labeling portions of the historical access data; that is, security analysts use their experience to determine whether certain access behaviors are normal or abnormal and then manually label them.

[0033] After acquiring the labeled data, the ratio of the labeled data volume to the total historical access data volume is calculated, and the corresponding classification model is determined based on this ratio. Specifically, in this embodiment: if the data volume ratio is greater than a first set threshold, the classification model is determined to be a supervised algorithm model; if the data volume ratio is less than or equal to the first set threshold, the classification model is determined to be an unsupervised algorithm model. For example, the first set threshold is set to 15%. When the calculated labeled data volume ratio is 20%, since 20% is greater than 15%, the system will determine to use a supervised algorithm model for classification. In this case, models such as Support Vector Machines or Deep Neural Networks can be selected as the specific supervised algorithm model. These models will be trained using existing labeled data to learn features that distinguish between normal and abnormal access behaviors. On the other hand, if the calculated labeled data volume ratio is 10%, since 10% is less than or equal to 15%, the system will determine to use an unsupervised algorithm model for classification. In this case, models such as K-Means clustering or Gaussian Mixture Models (GMM) can be selected as the specific unsupervised algorithm model. These models will perform cluster analysis on access feature data, grouping data with similar characteristics into one category, and dividing the data into normal feature data and abnormal feature data based on the clustering results.

[0034] Alternatively, in some embodiments of this application, a machine learning model selection algorithm can be used to automatically evaluate and select the most suitable classification model based on factors such as the proportion of labeled data in historical access data and data characteristics. For example, cross-validation and other methods can be used to evaluate the performance of different classification models under the current data volume, and the classification model with the best performance can be selected.

[0035] By acquiring labeled data from historical access data and dynamically determining a suitable classification model based on the proportion of these labeled data within the historical access data, this model is used to classify all access feature data, clearly dividing it into normal and abnormal feature data. This dynamic selection of the classification model allows the data partitioning process to adapt to changes in the amount of labeled data in different scenarios, avoiding the limitations that a single classification model might bring. This improves the accuracy and robustness of the initial data partitioning, thereby enhancing the overall performance of the entire abnormal data access behavior monitoring method.

[0036] In this step, if the proportion of data volume is greater than the second set threshold, the supervised algorithm model is trained based on the labeled data to obtain the target classification model; the access feature data is then divided into normal feature data and abnormal feature data based on the target classification model. If the proportion of data volume is less than or equal to the second set threshold, the supervised algorithm model is trained based on the labeled data to form the teacher model; pseudo-label data is constructed based on the teacher model and the access feature data; the supervised algorithm model is trained based on the labeled data and the pseudo-label data to obtain the target classification model; the access feature data is then divided into normal feature data and abnormal feature data based on the target classification model.

[0037] Specifically, when the proportion of labeled data in the historical access data is less than or equal to a second set threshold, the supervised algorithm model is first initially trained using limited but reliable labeled data to obtain a teacher model with basic classification capabilities. Then, this teacher model is used to predict a large amount of unlabeled access feature data, generating pseudo-label data. Subsequently, the original labeled data is combined with these pseudo-label data to further train the supervised algorithm model, resulting in a target classification model with better robustness and accuracy. For example, when the proportion of labeled data in the historical access data is less than or equal to the second set threshold, a Laplacian Support Vector Machine (LSVM) is selected as the supervised algorithm model. The LSVM is initially trained using existing labeled data (e.g., only 5% of the total data) to form a teacher model. Next, the teacher model is used to predict at least a portion (e.g., 20%) of the remaining 95% of unlabeled data, obtaining the classification results and corresponding prediction confidence for each unlabeled data point. Pseudo-labels are assigned to those unlabeled data points with prediction confidence higher than a set threshold (e.g., 85%). In other words, if the teacher's model predicts with 85% confidence that an unlabeled data point is "normal" or "abnormal," it is labeled as a pseudo-label of "normal" or "abnormal." Then, the original 5% labeled data is merged with the newly generated pseudo-label data to form a larger training dataset. Finally, this merged dataset is used to retrain the Laplacian support vector machine to obtain the final target classification model.

[0038] Step S202: Based on the classification model, the access feature data is divided into normal feature data and abnormal feature data.

[0039] In this step, the access feature data is input into the classification model, and the classification results of each access feature data output by the classification model are obtained, resulting in normal feature data and abnormal feature data.

[0040] Step S102: Perform feature interaction on normal feature data to obtain normal feature interaction relationships, and perform feature interaction on abnormal feature data to obtain abnormal feature interaction relationships.

[0041] In this step, the feature interaction process is the process of obtaining a model or pattern that describes the deep association and dependency between different features. The feature interaction result obtained by the feature interaction process is the model or pattern that describes the deep association and dependency between different features.

[0042] In this embodiment, a deep neural network is specifically used to perform feature interaction analysis on normal and abnormal feature data. The data interaction relationships between normal feature data are extracted as normal feature interaction relationships, and the data interaction relationships between abnormal feature data are extracted as abnormal feature interaction relationships. A deep neural network is a neural network model containing multiple hidden layers, possessing powerful feature extraction and pattern recognition capabilities. By training the deep neural network model, the extracted features can be further learned and mined, thereby constructing normal and abnormal feature interaction relationships for user access behavior.

[0043] Specifically, normal feature data is input into a pre-built deep neural network. Leveraging its multi-layered nonlinear transformation capabilities, this deep neural network can automatically learn and capture the complex, nonlinear correlation patterns existing between normal feature data. Through the layer-by-layer processing of the deep neural network, the interactions between different feature dimensions are fully explored and integrated, thereby forming normal feature interaction relationships that comprehensively reflect the characteristics of normal data access behavior. These normal feature interaction relationships learned by the deep neural network can more deeply and precisely characterize the inherent patterns of normal feature data.

[0044] Deep neural networks (DNNs) are neural network models containing multiple hidden layers. Through multi-layer nonlinear transformations, they can automatically learn and extract high-level, abstract feature representations from input data. Compared to shallow networks, DNNs have stronger feature learning and pattern recognition capabilities, and are particularly adept at handling complex, high-dimensional data. DNNs can employ a multilayer perceptron (MLP) structure, which includes an input layer, multiple fully connected hidden layers, and an output layer. They are trained using backpropagation to learn complex mapping relationships between data. Alternatively, DNNs can use an autoencoder structure, which compresses input data into a low-dimensional representation using an encoder, and then attempts to reconstruct the original data using a decoder, thereby learning the data's inherent structure and features.

[0045] Step S103: Obtain real-time access data of real-time data access behavior, and obtain real-time feature interaction relationships of real-time access data.

[0046] The real-time access data of real-time data access behavior is the access data that needs to be monitored. In this step, the real-time feature interaction relationship of the real-time access data is obtained based on the acquisition method of the aforementioned normal feature interaction relationship and abnormal feature interaction relationship.

[0047] Step S104: Calculate the normal feature matching degree between real-time feature interaction relationship and normal feature interaction relationship, and calculate the abnormal feature matching degree between real-time feature interaction relationship and abnormal feature interaction relationship.

[0048] In this step, the normal feature matching degree is calculated using distance metrics. For example, Euclidean distance or cosine similarity can be used to quantify the similarity between real-time feature interactions and normal feature interactions. A high matching degree is indicated if the statistical distributions of real-time and normal feature interactions are very similar across multiple feature dimensions. Similarly, the abnormal feature matching degree can be calculated using distance metrics to quantify the similarity between real-time and abnormal feature interactions. A high abnormal matching degree is indicated if a real-time feature interaction shows a high degree of consistency with a known abnormal feature interaction in key features.

[0049] Step S105: Determine whether the real-time data access behavior is abnormal based on the normal feature matching degree and the abnormal feature matching degree.

[0050] In this step, if the normal feature matching degree is greater than the abnormal feature matching degree, the real-time data access behavior is determined to be an abnormal data access behavior; if the normal feature matching degree is less than or equal to the abnormal feature matching degree, the real-time data access behavior is determined to be an abnormal data access behavior.

[0051] Alternatively, in some embodiments of this application, the behavior can be as follows: if the normal feature matching degree is lower than a preset normal matching degree threshold and the abnormal feature matching degree is higher than a preset abnormal matching degree threshold, then the real-time data access behavior is determined to be an abnormal data access behavior; otherwise, it is not an abnormal data access behavior. Alternatively, if the normal feature matching degree is higher than a preset normal matching degree threshold and the abnormal feature matching degree is lower than a preset abnormal matching degree threshold, then the real-time data access behavior is determined to be not an abnormal data access behavior; otherwise, it is an abnormal data access behavior.

[0052] Compared with related technologies, the abnormal data access behavior monitoring method provided in this application extracts features from historical access data to obtain access feature data, divides the access feature data into normal feature data and abnormal feature data, and then further performs feature interaction on the normal feature data and abnormal feature data to obtain corresponding normal feature interaction relationships and abnormal feature interaction relationships. Using the normal feature interaction relationships and abnormal feature interaction relationships as standards, for real-time access data of real-time data access behavior, the corresponding real-time feature interaction relationships are obtained, and the real-time feature interaction relationships are matched with the standard normal feature interaction relationships and abnormal feature interaction relationships. The system calculates the normal feature matching degree between real-time feature interaction relationships and normal feature interaction relationships, and the abnormal feature matching degree between real-time feature interaction relationships and abnormal feature interaction relationships. Finally, it determines whether real-time data access behavior is abnormal based on the normal feature matching degree and the abnormal feature matching degree. By constructing standard normal feature interaction relationships and abnormal feature interaction relationships, and calculating the matching degree between real-time feature interaction relationships and normal and abnormal feature interaction relationships to determine abnormal behavior, it can effectively identify abnormal patterns at the feature combination level, improve the accuracy and adaptability of abnormal data access behavior monitoring results, and reduce false alarm rate and false negative rate.

[0053] To better implement the abnormal data access behavior monitoring method in the embodiments of this application, based on the abnormal data access behavior monitoring method, correspondingly, such as Figure 3 As shown in the illustration, this application also provides an abnormal data access behavior monitoring device, which includes: The historical data acquisition module 301 is used to acquire historical access data, extract features from the historical access data to obtain access feature data, and divide the access feature data into normal feature data and abnormal feature data. The feature interaction module 302 is used to perform feature interaction on normal feature data to obtain normal feature interaction relationships, and to perform feature interaction on abnormal feature data to obtain abnormal feature interaction relationships. The real-time data acquisition module 303 is used to acquire real-time access data of real-time data access behavior and to acquire real-time feature interaction relationships of real-time access data. The interaction matching module 304 is used to calculate the normal feature matching degree between real-time feature interaction relationship and normal feature interaction relationship, and to calculate the abnormal feature matching degree between real-time feature interaction relationship and abnormal feature interaction relationship. The anomaly detection module 305 is used to determine whether real-time data access behavior is abnormal based on the normal feature matching degree and the abnormal feature matching degree.

[0054] The abnormal data access behavior monitoring device provided in the above embodiments can implement the technical solutions described in the above abnormal data access behavior monitoring method embodiments. The specific implementation principles of each module or unit can be found in the corresponding content in the above abnormal data access behavior monitoring method embodiments, and will not be repeated here.

[0055] Please refer to Figure 4 This application also provides an electronic device 400. The electronic device 400 includes: an input serial bus 401, an output serial bus 402, a memory 403, and a processor 404.

[0056] The input serial bus 401 is used to acquire historical access data and real-time access data of real-time data access behavior. The memory 403 is used for the abnormal data access behavior monitoring program and the historical and real-time access data acquired by the input serial bus 401. The processor 404, coupled to the memory 403, is used to execute the abnormal data access behavior monitoring program stored in the memory 403 to implement the steps in the abnormal data access behavior monitoring method provided in the aforementioned method embodiment, and to determine whether the real-time data access behavior is abnormal. The output serial bus 402 is used to output whether the real-time data access behavior is abnormal to result display devices such as the administrator's mobile phone or administrator's computer.

[0057] In some embodiments, processor 404 may be a central processing unit (CPU), microprocessor, or other data processing chip for running program code stored in memory 403 or processing data. In some embodiments, processor 404 may be a single server or a group of servers. The server group may be centralized or distributed. In some embodiments, processor 404 may be local or remote. In some embodiments, processor 404 may be implemented on a cloud platform. In one embodiment, the cloud platform may include a private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, internal cloud, multi-cloud, etc., or any combination thereof.

[0058] In one embodiment, when the processor 404 executes the abnormal data access behavior monitoring program in the memory 403, the following steps can be implemented: Obtain historical access data, extract features from the historical access data to obtain access feature data, and divide the access feature data into normal feature data and abnormal feature data. Normal feature interaction relationships are obtained by performing feature interaction on normal feature data, and abnormal feature interaction relationships are obtained by performing feature interaction on abnormal feature data. Obtain real-time access data of real-time data access behavior, and obtain real-time feature interaction relationships of real-time access data; Calculate the normal feature matching degree between real-time feature interaction relationships and normal feature interaction relationships, and calculate the abnormal feature matching degree between real-time feature interaction relationships and abnormal feature interaction relationships. Whether real-time data access behavior is abnormal is determined based on the matching degree of normal features and the matching degree of abnormal features.

[0059] It should be understood that when the processor 404 executes the abnormal data access behavior monitoring program in the memory 403, in addition to the functions mentioned above, it can also perform other functions, as can be found in the description of the corresponding method embodiments above.

[0060] Please refer to Figure 5 This application also provides an abnormal data access behavior monitoring system, including: a gateway device 501, an abnormal data access behavior monitoring device 502 as provided in the foregoing embodiments connected to the gateway device 501, and a data storage device 503 connected to the abnormal data access behavior monitoring device 502.

[0061] Gateway device 501 is used to receive real-time data access behavior, and abnormal data access behavior monitoring device 502 is used to monitor whether the real-time data access behavior is abnormal data access behavior. If the real-time data access behavior is abnormal, allow gateway device 501 to access data storage device 503.

[0062] The above provides a detailed description of the abnormal data access behavior monitoring method, device, and electronic device provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for monitoring abnormal data access behavior, characterized in that, include: Historical access data is obtained, and features are extracted from the historical access data to obtain access feature data. The access feature data is then divided into normal feature data and abnormal feature data. Normal feature interaction relationships are obtained by performing feature interaction on the normal feature data, and abnormal feature interaction relationships are obtained by performing feature interaction on the abnormal feature data. Obtain real-time access data of real-time data access behavior, and obtain the real-time feature interaction relationship of the real-time access data; Calculate the normal feature matching degree between the real-time feature interaction relationship and the normal feature interaction relationship, and calculate the abnormal feature matching degree between the real-time feature interaction relationship and the abnormal feature interaction relationship; Whether the real-time data access behavior is an abnormal data access behavior is determined based on the normal feature matching degree and the abnormal feature matching degree.

2. The method for monitoring abnormal data access behavior according to claim 1, characterized in that, The step of obtaining normal feature interaction relationships by performing feature interaction on the normal feature data includes: Based on a deep neural network, feature interactions are performed on the normal feature data, and the data interaction relationships between the normal feature data are extracted as the normal feature interaction relationships.

3. The method for monitoring abnormal data access behavior according to claim 1, characterized in that, The step of dividing the access feature data into normal feature data and abnormal feature data includes: Obtain labeled data from the historical access data, and determine a classification model based on the proportion of labeled data in the historical access data. Based on the classification model, the access feature data is divided into normal feature data and abnormal feature data.

4. The abnormal data access behavior monitoring method according to claim 3, characterized in that, The classification model determined based on the proportion of labeled data in the historical access data includes: If the proportion of the data volume is greater than the first set threshold, the classification model is determined to be a supervised algorithm model; If the proportion of the data volume is less than or equal to the first set threshold, the classification model is determined to be an unsupervised algorithm model.

5. The method for monitoring abnormal data access behavior according to claim 4, characterized in that, The classification model is a supervised algorithm model. The step of dividing the access feature data into normal feature data and abnormal feature data based on the classification model includes: If the proportion of the data volume is greater than the second set threshold, the supervised algorithm model is trained based on the labeled data to obtain the target classification model. Based on the target classification model, the access feature data is divided into normal feature data and abnormal feature data.

6. The method for monitoring abnormal data access behavior according to claim 5, characterized in that, The classification model is a supervised algorithm model. The step of dividing the access feature data into normal feature data and abnormal feature data based on the classification model includes: If the proportion of the data volume is less than or equal to the second set threshold, the supervised algorithm model is trained based on the labeled data to form a teacher model. Pseudo-label data is constructed based on the teacher model and the access feature data; The supervised algorithm model is trained based on the labeled data and the pseudo-label data to obtain the target classification model. Based on the target classification model, the access feature data is divided into normal feature data and abnormal feature data.

7. The method for monitoring abnormal data access behavior according to claim 1, characterized in that, The step of extracting features from the historical access data to obtain access feature data includes: Provides multiple preset feature dimensions; Feature extraction is performed on the historical access data to obtain historical data features; Each of the historical data features is matched to the preset feature dimension to form the access feature data.

8. A device for monitoring abnormal data access behavior, characterized in that, include: The historical data acquisition module is used to acquire historical access data, extract features from the historical access data to obtain access feature data, and divide the access feature data into normal feature data and abnormal feature data. The feature interaction module is used to perform feature interaction on the normal feature data to obtain normal feature interaction relationships, and to perform feature interaction on the abnormal feature data to obtain abnormal feature interaction relationships. A real-time data acquisition module is used to acquire real-time access data of real-time data access behavior and to acquire real-time feature interaction relationships of the real-time access data. An interaction matching module is used to calculate the normal feature matching degree between the real-time feature interaction relationship and the normal feature interaction relationship, and to calculate the abnormal feature matching degree between the real-time feature interaction relationship and the abnormal feature interaction relationship. An anomaly determination module is used to determine whether the real-time data access behavior is an abnormal data access behavior based on the normal feature matching degree and the abnormal feature matching degree.

9. An electronic device, characterized in that, include: The system consists of an input serial bus, an output serial bus, a memory, and a processor. The input serial bus is used to acquire historical access data and real-time access data of real-time data access behavior; The memory is used to store the program, the historical access data, and the real-time access data; The processor, coupled to the memory, is used to execute the program stored in the memory based on the actual concentration change data, so as to implement the steps in the abnormal data access behavior monitoring method according to any one of claims 1 to 7, and to determine whether the real-time data access behavior is abnormal data access behavior. The output serial bus is used to output to the result display device whether the real-time data access behavior is abnormal data access behavior.

10. An abnormal data access behavior monitoring system, characterized in that, include: A gateway device, an abnormal data access behavior monitoring device as described in claim 8 connected to the gateway device, and a data storage device connected to the abnormal data access behavior monitoring device; The gateway device is used to receive real-time data access behavior, and the abnormal data access behavior monitoring device is used to monitor whether the real-time data access behavior is abnormal data access behavior. If the real-time data access behavior is the abnormal data access behavior, the gateway device is allowed to access the data storage device.

Images