Risk behavior identification method and apparatus, storage medium, and computer device

Abstract

The present application relates to the technical field of big data processing, and discloses a risk behavior identification method and apparatus, a storage medium, and a computer device. The method comprises: acquiring access traffic data of sensitive data, and on the basis of service categories to which access users corresponding to the access traffic data belong, classifying the access traffic data to obtain sensitive data access data of a plurality of service categories; on the basis of the sensitive data access data of each service category, updating model parameters of a risk assessment model of the service category; by means of the risk assessment model of the service category and on the basis of the sensitive data access data of the service category, calculating a risk behavior assessment value of each access user under the service category; and on the basis of the risk behavior assessment value of each access user under the service category, obtaining a risk behavior identification result of each access user. The method can improve the adaptability, the practicability and the assessment accuracy of risk behavior assessment in service scenarios, and provides visual assessment results.

Description

Risk behavior identification method, device, storage medium and computer equipment

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on October 25, 2023, with application number 202311396844.8 and application name “Risk Behavior Identification Method, Device, Storage Medium and Computer Equipment”, the entire contents of which are incorporated by reference into the application. Technical Field

[0002] The present application relates to the field of big data processing technology, and in particular to a risk behavior identification method, device, storage medium and computer equipment. Background Art

[0003] With the rise of big data technology, data has become a crucial core asset within enterprises. Currently, enterprises hold a vast amount of data, including some sensitive data (also known as "information-related data"), such as user mobile phone numbers and service order numbers that the enterprise has authorized. To prevent this sensitive data from being leaked by internal personnel, enterprises often employ technical means to detect unusual behaviors that could lead to the leakage of sensitive data.

[0004] In existing technologies, enterprises mainly detect whether internal personnel are at risk of leaking sensitive data by comparing their confidential access data with pre-established behavioral baselines or security thresholds.

[0005] However, the abnormal behavior of internal personnel in an enterprise will show more complexity in different scenarios. It is difficult to combine the detection of abnormal behavior through behavioral baseline or security threshold comparison with actual business behavior, resulting in a high false alarm rate. The feedback alarm data is very limited and cannot truly feedback the actual situation of sensitive data leaked by internal personnel. It is difficult to quantify and evaluate long-term threat behaviors.

[0006] Application Contents

[0007] In view of this, the present application provides a risk behavior identification method, device, storage medium and computer equipment, the main purpose of which is to solve the technical problems of inaccurate behavior detection of internal employees leaking sensitive data, high false alarm rate, and difficulty in quantifying and evaluating detection results.

[0008] According to a first aspect of the present application, a method for identifying risky behaviors is provided, the method comprising:

[0009] Collecting access traffic data involving sensitive data, classifying the access traffic data according to the business category to which the accessing user corresponding to the access traffic data belongs, and obtaining sensitive data access data of multiple business categories;

[0010] updating the model parameters of the risk assessment model of the business category based on the sensitive data access data of the business category;

[0011] Calculate the risk behavior assessment value of each access user under the business category based on the sensitive data access data of the business category using the risk assessment model of the business category;

[0012] According to the risk behavior evaluation value of each access user under the business category, a risk behavior identification result of each access user is obtained.

[0013] According to a second aspect of the present application, a risk behavior identification device is provided, the device comprising:

[0014] A traffic data collection module is used to collect access traffic data of sensitive data, classify the access traffic data according to the business category of the access user corresponding to the access traffic data, and obtain sensitive data access data of multiple business categories;

[0015] A model parameter updating module, configured to update the model parameters of the risk assessment model of the business category according to the sensitive data access data of the business category;

[0016] An evaluation value calculation module, configured to calculate a risk behavior evaluation value of each accessing user under the business category based on the risk assessment model of the business category and the sensitive data access data of the business category;

[0017] The identification result output module is used to obtain the risk behavior identification result of each access user according to the risk behavior evaluation value of each access user under the business category.

[0018] According to a third aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned risk behavior identification method is implemented.

[0019] According to a fourth aspect of the present application, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned risk behavior identification method when executing the program.

[0020] The present application provides a risk behavior identification method, device, storage medium and computer equipment. By classifying the access traffic data according to the business category of the access personnel and performing risk behavior assessment on the access personnel of each business category through the risk assessment model of each business category, the risk assessment results can be adapted to the business category to which the access personnel belong, thereby avoiding the problem of data standard imbalance caused by performing risk behavior assessment on all access users through all access traffic data, and improving the adaptability and practicality of risk behavior assessment in business scenarios. In addition, the above method updates the model parameters of the risk assessment model of each business category through the sensitive data access data of each business category, and then obtains the risk behavior assessment value of each access user under each business category through the updated risk assessment model, and then determines the risk behavior identification result of each access user, so that the risk assessment model of each business category can be optimized according to the real-time changes of the data, thereby improving the accuracy of the model prediction and reducing the false alarm rate. Moreover, by valuing the risk behavior, it is convenient to quantitatively evaluate the risk behavior of the access user, making the evaluation result more intuitive.

[0021] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] FIG1 is a schematic diagram showing a flow chart of a risk behavior identification method provided in an embodiment of the present application;

[0024] FIG2 is a flow chart showing another risk behavior identification method provided in an embodiment of the present application;

[0025] FIG3 shows a schematic structural diagram of a risk behavior identification device provided in an embodiment of the present application;

[0026] FIG4 shows a schematic structural diagram of another risk behavior identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that, unless there is a conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0028] In one embodiment, as shown in FIG1 , a risk behavior identification method is provided. The method is described using a computer device as an example, and includes the following steps:

[0029] 101. Collect access traffic data involving sensitive data, classify the access traffic data according to the business category to which the accessing user corresponding to the access traffic data belongs, and obtain sensitive data access data of multiple business categories.

[0030] Sensitive data refers to data on an internally monitored list, including personal privacy data and data that is inappropriate for companies or social organizations to release. For example, sensitive data may include a user's name, ID number, address, phone number, bank account number, email address, password, medical information, educational background, and other personal privacy data. It may also include company operating conditions, network structure, IP address lists, and other data that is inappropriate for companies or social organizations to release.

[0031] Furthermore, the access traffic data of sensitive data refers to the traffic data generated when each accessing user accesses sensitive data through websites, applications, etc., which is collected by traffic monitoring tools within the enterprise, including the content and data level of the sensitive data accessed by the accessing personnel, the number of sensitive requests initiated, and the number of sensitive data interfaces accessed, etc. In this embodiment, the accessing user refers to the user whose traffic data can be monitored by the enterprise after authorization, mainly referring to the internal employees who have the authority to access sensitive data. Among them, the business category to which the accessing user belongs can be divided according to the business department to which the employee belongs and / or the category of the system accessed. For example, customer service department employees need to access the customer management system, sales department employees also need to access the customer management system, finance department employees need to access the financial system, and so on.

[0032] Specifically, the computer device can collect the access traffic data of each visiting user through at least one traffic monitoring tool, such as a website analysis tool, a log analysis tool, a third-party API interface, a custom script, and other tools. In this embodiment, data such as sensitive data, sensitive requests, and sensitive interfaces are provided with preset sensitive labels. Through these labels, the access traffic data of sensitive data can be filtered out from a large amount of traffic data. In addition, the access traffic data of sensitive data also includes the user identification of the visiting user. Through the user identification, the access traffic data of each visiting user and the business category to which the visiting user belongs can be found. Furthermore, the access traffic data of sensitive data can be classified through the business category of the visiting user, thereby obtaining sensitive data access data of multiple business categories.

[0033] For example, by classifying the collected access traffic data of sensitive data according to the business category of the accessing users, the access traffic data can be divided into sensitive data access data of customer service department employees to the customer management system, sensitive data access data of sales department employees to the customer management system, and sensitive data access data of finance department employees to the financial system, etc.

[0034] 102. Update the model parameters of the risk assessment model of the business category based on the sensitive data access data of the business category.

[0035] Specifically, after obtaining sensitive data access data for multiple business categories, the model parameters of the risk assessment model for each business category can be updated based on the sensitive data access data for each business category. In this embodiment, the number of risk assessment models corresponds to the number of business categories, that is, each business category corresponds to an independent risk assessment model, and the risk assessment model for each business category is obtained through statistical analysis of the sensitive traffic data for that business category. Furthermore, the model parameters of the risk assessment model need to be continuously optimized as data is continuously updated.

[0036] For example, data on customer service employees' access to sensitive data in the customer management system can be used to optimize the model parameters of the customer service department's corresponding risk assessment model. Data on sales employees' access to sensitive data in the customer management system can be used to optimize the model parameters of the sales department's corresponding risk assessment model. Data on finance employees' access to sensitive data in the finance system can be used to optimize the model parameters of the finance department's corresponding risk assessment model, and so on. Furthermore, the risk assessment model for each business category can be a weighted sum model of multiple data. By collecting sensitive data access data for each business category, the weight coefficients corresponding to each data point in the risk assessment model for that business category can be adjusted, thereby improving the prediction accuracy of each risk assessment model.

[0037] 103. Using the risk assessment model of the business category and based on the sensitive data access data of the business category, the risk behavior assessment value of each accessing user under the business category is calculated.

[0038] Specifically, after updating the model parameters of the risk assessment model for each business category, the collected sensitive data access data of each business category can be preprocessed according to the preset data preprocessing method, so that the sensitive data access data of each business category can meet the requirements of the model input parameters. Then, the preprocessed data can be input into the risk assessment model of the corresponding category to obtain the risk behavior assessment value of each access user under each business category.

[0039] For example, taking the risk assessment model corresponding to the customer service department as an example, suppose the customer service department has a total of 100 customer service personnel. These 100 customer service personnel need to access the customer management system according to actual business needs during their work, thereby coming into contact with sensitive data. Therefore, as the customer service department employees work, the company will monitor the access traffic data of each employee to sensitive data, thereby obtaining sensitive data access data for the entire customer service department. Furthermore, by breaking down the sensitive data access data of the customer service department according to the employee dimension, each employee's sensitive data access data can be obtained, such as the content and data level of the sensitive data accessed by each employee, the number of sensitive requests initiated, the number of sensitive data interfaces accessed, etc. By inputting each employee's sensitive data access data into the risk assessment model corresponding to the customer service department, the risk behavior assessment value of each employee in the customer service department can be obtained.

[0040] 104. Obtain a risk behavior identification result for each access user based on the risk behavior evaluation value of each access user under the business category.

[0041] Specifically, the computer device can compare the risk behavior assessment value of each accessing user under each business category with the preset risk behavior assessment conditions to obtain the risk behavior identification results for each accessing user under each business category. The risk behavior identification results may include multiple results such as no risk of sensitive data leakage, suspected risk of sensitive data leakage, and the presence of sensitive data leakage risk. Generally speaking, the higher the risk behavior assessment value of the accessing user, the higher the risk of the accessing user leaking sensitive data. In this embodiment, the risk behavior assessment conditions can be set according to the actual business scenario, and the risk behavior assessment conditions corresponding to each business category can be the same or different, which is not specifically limited in this embodiment.

[0042] For example, based on the actual business scenario, you can set a risk behavior assessment threshold corresponding to each business category, and compare the risk behavior assessment value of each accessing user under each business category with the risk behavior assessment threshold under the corresponding business category, so as to obtain the risk behavior identification result of each accessing user under each business category. Alternatively, you can also obtain the risk behavior identification result of each accessing user based on data such as the number of times and frequency at which the risk behavior assessment value of the accessing user reaches the risk behavior assessment threshold, so as to improve the accuracy of risk behavior identification. In addition, you can also perform a statistical analysis of the access time and request frequency of each accessing user to sensitive data, and make a comprehensive judgment based on the statistical analysis results of the access time and request frequency of sensitive data combined with the risk behavior assessment value of each accessing user, so as to obtain the risk behavior identification result of each accessing user.

[0043] The risk behavior identification method provided in this embodiment, by classifying the access traffic data according to the business category of the access personnel, and performing risk behavior assessment on the access personnel of each business category through the risk assessment model of each business category, can make the risk assessment results adapt to the business category to which the access personnel belong, thereby avoiding the problem of data standard imbalance caused by performing risk behavior assessment on all access users through all access traffic data, and improving the adaptability and practicality of risk behavior assessment in business scenarios. In addition, the above method updates the model parameters of the risk assessment model of each business category through the sensitive data access data of each business category, and then obtains the risk behavior assessment value of each access user under each business category through the updated risk assessment model, and then determines the risk behavior identification result of each access user, so that the risk assessment model of each business category can be optimized according to the real-time changes of the data, thereby improving the accuracy of the model prediction and reducing the false alarm rate. Moreover, by valuing the risk behavior, it is convenient to quantitatively evaluate the risk behavior of the access user, making the evaluation result more intuitive.

[0044] Furthermore, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the implementation process of this embodiment, a risk behavior identification method is provided, as shown in FIG2 , which includes the following steps:

[0045] 201. Collect historical access traffic data of sensitive data, classify the historical access traffic data according to the business category to which the user corresponding to the historical access traffic data belongs, and obtain historical sensitive data access data of multiple business categories.

[0046] Specifically, the computer device can use at least one traffic monitoring tool to collect historical access traffic data of sensitive data in the past period (such as the past three months or six months, etc.), or directly obtain historical access traffic data of sensitive data in the past period from the database, and then, based on the user identifier in the historical access traffic data, find the historical access traffic data of each user and the business category to which the user belongs, and then classify the historical access traffic data according to the business category to which each user belongs, to obtain historical sensitive data access data of multiple business categories.

[0047] 202. Based on the historical sensitive data access data of each business category, train multiple user behavior baselines corresponding to each business category.

[0048] Among them, the user behavior baseline may include at least one user behavior baseline among the sensitive data access volume baseline, the sensitive request number baseline and the sensitive interface access volume baseline.

[0049] Specifically, the user behavior baseline for each business category can be obtained by classifying and analyzing the historical sensitive data access data of each business category. For example, the historical sensitive data access data of a certain business category can be classified to obtain the user behavior data of each user under that business category, including the historical sensitive data access volume, historical sensitive data access level, historical sensitive request count, and historical sensitive interface access volume of each user under that business category, etc. Then, based on the various user behavior data of each user, each type of user behavior data under that business type is analyzed and statistically analyzed, such as performing kernel density estimation (KDE, Kernel Density Estimation, a type of probability theory used to estimate unknown density functions) to obtain the probability distribution of each type of user behavior data. Finally, based on the probability distribution of each type of user behavior data, the user behavior baseline corresponding to each type of user behavior data is obtained.

[0050] For example, taking the historical sensitive data access data of the customer service department as an example, assuming that the customer service department has a total of 100 customer service personnel, and the number of sensitive data accessed by these 100 customer service personnel in the past three months is between 1,000 and 10,000, of which 90% of the customer service employees have accessed between 3,000 and 6,000 sensitive data in the past three months. Based on this, the sensitive data access baseline corresponding to the customer service department can be set to 3,000 to 6,000.

[0051] 203. Determine multiple model parameters of a risk assessment model for each business category based on multiple user behavior baselines corresponding to each business category.

[0052] The multiple model parameters include at least one of a weight coefficient for sensitive data access volume, a weight coefficient for sensitive request count, and a weight coefficient for sensitive interface access volume. The weight coefficient refers to the score corresponding to each numerical range after dividing certain user behavior data into numerical ranges.

[0053] Specifically, after determining multiple user behavior baselines corresponding to each business category, weight coefficients for multiple user behavior data for each business category can be determined based on the multiple user behavior baselines. For example, for a numerical range within a user behavior baseline, the minimum score corresponding to the user behavior data can be set. For other numerical ranges, the corresponding score can be set based on the degree of deviation of the numerical value from the user behavior baseline. Furthermore, based on the weight coefficients of the multiple user behavior data for each business category, multiple model parameters for the risk assessment model for each business category can be obtained.

[0054] For example, taking the historical sensitive data access data of the customer service department as an example, assuming that the customer service department has a total of 100 customer service personnel, the baseline of sensitive data access volume corresponding to the customer service department is 3,000 to 6,000 items. The weight coefficient of the sensitive data access volume of the customer service department can be set as follows: when the sensitive data access volume is less than 2,000, the corresponding score is 10 points; when the sensitive data access volume is between 2,000 and 3,000, the corresponding score is 5 points; when the sensitive data access volume is between 3,000 and 6,000, the corresponding score is 0 points; when the sensitive data access volume is between 6,000 and 7,000, the corresponding score is 5 points; when the sensitive data access volume is between 7,000 and 8,000, the corresponding score is 10 points; when the sensitive data access volume is between 8,000 and 9,000, the corresponding score is 20 points; when the sensitive data access volume is between 9,000 and 10,000, the corresponding score is 25 points; when the sensitive data access volume is greater than 10,000, the corresponding score is 30 points.

[0055] 204. Construct a risk assessment model for each business category based on multiple model parameters of the risk assessment model for each business category and a preset mapping relationship between the sensitive data level and the risk value.

[0056] The "sensitive data level" refers to the highest data security level for sensitive data accessed by a user. Data security levels are assigned to sensitive data based on the potential impact of a breach. Data security levels can be set based on data security regulations, industry regulations, or internal enterprise regulations. For example, data security levels can be categorized as Level 5, Level 4, Level 3, Level 2, and Level 1, with lower values ​​indicating higher data security levels.

[0057] Specifically, after obtaining the weight coefficients of multiple user behavior data of each business category, multiple model parameters of the risk assessment model of each business category are obtained. Furthermore, the mapping relationship between the preset sensitive data level and the risk value can also be obtained. For example, scores from low to high can be assigned to each sensitive data level according to the order of sensitive data levels from large to small. Finally, the risk assessment model of each business category can be obtained based on the multiple model parameters of the risk assessment model of each business category and the mapping relationship between the preset sensitive data level and the risk value. In this embodiment, the mapping relationship between the sensitive data level and the risk value in the risk assessment model of each business category can be the same, or it can be set to be different according to the actual business scenario, and this embodiment does not impose any restrictions.

[0058] For example, taking the historical sensitive data access data of the customer service department as an example, assuming that the highest data security level of the sensitive data that the customer service department needs to access is generally above level 3, the mapping relationship between the sensitive data level and the risk value of the customer service department can be set as: when the sensitive data level is level 1, the corresponding risk value is 10 points, when the sensitive data level is level 2, the corresponding risk value is 7 points; when the sensitive data level is level 3, the corresponding risk value is 3 points; when the sensitive data level is level 4 and level 5, the corresponding risk value is 2 points.

[0059] This embodiment uses historical access traffic data of sensitive data to train multiple user behavior baselines corresponding to each business category, and uses this to determine multiple model parameters of the risk assessment model for each business category. Then, a mapping relationship between the sensitive data level and the risk value is set to obtain a risk assessment model for each business category. This allows the risk assessment model for each business category to meet the actual business needs of the business category, thereby improving the practicality, applicability, and prediction accuracy of the model in each business category. In addition, the risk assessment model can quantitatively evaluate the behavioral risk of each user leaking sensitive data. After splitting the assessment scores, it can also improve the interpretability of the behavioral assessment results.

[0060] 205. Collect access traffic data of sensitive data, classify the access traffic data according to the business category of the accessing user corresponding to the access traffic data, and obtain sensitive data access data of multiple business categories.

[0061] Specifically, the computer device can collect access traffic data of sensitive data periodically (for example, once a day or half a day, etc.), and then classify the access traffic data of sensitive data according to the user identifier corresponding to the access traffic data of sensitive data to obtain the access traffic data of each accessing user, and then analyze and count the access traffic data of each accessing user to obtain the sensitive data access volume, number of sensitive requests, sensitive data level and sensitive interface access volume of each accessing user, and then use the sensitive data access volume, number of sensitive requests, sensitive data level and sensitive interface access volume of each accessing user as the sensitive data access data of each accessing user, and finally classify the sensitive data access data of multiple accessing users according to the business category to which each accessing user belongs to obtain sensitive data access data of multiple business categories.

[0062] In this embodiment, the number of visits to sensitive data, the number of sensitive requests, the level of sensitive data, and the number of visits to sensitive interfaces are all cumulative amounts since data collection, rather than the amount of data within a cycle. By calculating the cumulative amount, the accuracy of model parameter optimization and the accuracy of user risk behavior identification can be improved.

[0063] This embodiment divides the access traffic data of sensitive data into the access traffic data of each accessing user according to the user identification, and then analyzes and counts the access traffic data of each accessing user to obtain the sensitive data access volume, number of sensitive requests, sensitive data level and sensitive interface access volume of each accessing user, which can effectively improve the efficiency of data processing. Furthermore, by taking the sensitive data access volume, number of sensitive requests, sensitive data level and sensitive interface access volume of each accessing user as the sensitive data access data of each accessing user, and classifying the sensitive data access data of multiple accessing users according to the business category to which each accessing user belongs, to obtain sensitive data access data of multiple business categories, it is convenient to optimize the model parameters of the risk assessment model of each business category through the sensitive data access data of each business category, and it is also convenient to calculate the risk behavior assessment value of each accessing user through the risk assessment model, thereby improving the efficiency of user behavior risk assessment.

[0064] Furthermore, the method of analyzing and counting the access traffic data of each visiting user to obtain the sensitive data access volume, number of sensitive requests, sensitive data level and sensitive interface access volume of each visiting user can be achieved through the following steps: based on the access traffic data of the visiting user, the number of sensitive requests initiated by the visiting user, the access data of the visiting user to each sensitive data and the access data of the visiting user to each sensitive interface are obtained, and then the number of sensitive requests of the visiting user is obtained based on the number of sensitive requests initiated by the visiting user, and then the access data of the visiting user to each sensitive data is clustered to obtain the sensitive data access volume of the visiting user, and the access data of the visiting user to each sensitive interface is clustered to obtain the sensitive interface access volume of the visiting user, and finally the sensitive data level of the visiting user is obtained based on the highest level of the data security level of each sensitive data accessed by the visiting user.

[0065] In this embodiment, sensitive data access refers to the cumulative number of visits to sensitive data by a user, and sensitive interface access refers to the cumulative number of visits to sensitive interfaces by a user. The clustering algorithm can deduplicate duplicate data in the sensitive data access and sensitive interface access. For example, before clustering, a user had 10,000 cumulative visits over the past three months. After clustering and deduplication, the user's actual number of sensitive data visits is 5,000. This approach can avoid false alarms caused by users accessing large amounts of duplicate data in a short period of time due to business needs.

[0066] The above embodiment can enrich the types of user behavior data by counting the sensitive data access volume, sensitive request number, sensitive data level and sensitive interface access volume of each accessing user, thereby improving the accuracy of user behavior risk identification. In addition, by calculating the sensitive interface access volume and sensitive interface access volume of each accessing personnel through a clustering algorithm, the access trend and total access volume of each accessing personnel for each different sensitive data (such as mobile phone number, business order number, etc.) can be distinguished, thereby objectively ensuring the accuracy of the deduplication data volume of the accessing personnel accessing sensitive data, thereby avoiding false alarms caused by some personnel accessing a large amount of duplicate data in a short period of time due to business demands, and improving the accuracy of risk behavior identification.

[0067] 206. Based on the sensitive data access data of each business category, the model parameters of the risk assessment model of each business category are updated.

[0068] Specifically, the computer device can update multiple user behavior baselines corresponding to the business category based on the sensitive data access data of the business category, wherein the user behavior baseline can include a sensitive data access volume baseline, a sensitive request count baseline, and a sensitive interface access volume baseline. Furthermore, the computer device can update multiple model parameters of the risk assessment model of the business category based on the multiple user behavior baselines corresponding to the business category, wherein the multiple model parameters include a sensitive data access volume weight coefficient, a sensitive request count weight coefficient, and a sensitive interface access volume weight coefficient. Updating the weight coefficient refers to updating each numerical range in the weight coefficient and / or the score value corresponding to each numerical range.

[0069] In this embodiment, by superimposing the sensitive data access data of each business category collected during the current period onto the historical sensitive data access data of each business category, and thereby updating multiple user behavior baselines corresponding to each business category, and then updating multiple model parameters of the risk assessment model of each business category, the real-time nature of the data can be guaranteed, so that the various model parameters of the risk assessment model can be continuously optimized as the data changes, thereby improving the accuracy of the model in predicting behavioral risks.

[0070] 207. Through the risk assessment model of each business category, based on the sensitive data access data of each business category, the risk behavior assessment value of each accessing user under each business category is calculated.

[0071] Specifically, the computer device can obtain the sensitive data access risk value of the visiting user based on the sensitive data access weight coefficient corresponding to the sensitive data access volume of the visiting user, obtain the sensitive request number risk value of the visiting user based on the sensitive request number weight coefficient corresponding to the sensitive request number of the visiting user, obtain the sensitive data level risk value of the visiting user based on the sensitive data level of the visiting user through the mapping relationship between the sensitive data level and the risk value, obtain the sensitive interface access risk value of the visiting user based on the sensitive interface access weight coefficient corresponding to the sensitive interface access volume of the visiting user, and obtain the risk behavior assessment value of each visiting user under the business category based on the sum of the sensitive data access risk value, the sensitive request number risk value, the sensitive data level risk value and the sensitive interface access risk value.

[0072] For example, suppose the customer service department has three customer service personnel, namely A, B, and C. The sensitive data access data of the three customer service personnel are:

[0073] A: The number of sensitive data accessed is 10,000, the total number of sensitive requests is 1,000, the highest level of sensitive data accessed is level 3, and the number of sensitive interfaces accessed is 25;

[0074] B: The number of sensitive data accessed is 5,000, the total number of sensitive requests is 500, the highest level of sensitive data accessed is level 2, and the number of sensitive interfaces accessed is 10;

[0075] C: The number of sensitive data accessed is 2,000, the total number of sensitive requests is 300, the highest level of sensitive data accessed is level 2, and the number of sensitive interface accesses is 8.

[0076] By inputting the above three sets of data into the risk assessment model corresponding to the customer service department respectively, the risk behavior assessment values ​​of the three customer service personnel can be obtained as follows: A is 95 points, B is 45 points, and C is 20 points.

[0077] 208. Obtain a risk behavior identification result for each access user based on the risk behavior evaluation value of each access user under each business category.

[0078] Specifically, after obtaining the risk behavior assessment value of each accessing user under each business category, the risk behavior identification result of each accessing user can be obtained by the following method: First, determine whether the risk behavior assessment value of each accessing user is greater than a preset risk threshold, and determine whether the number of times the risk behavior assessment value of the accessing user is greater than the risk threshold is greater than a preset number. If the risk behavior assessment value of the accessing user is less than or equal to the risk threshold and the number of times the risk behavior assessment value of the accessing user is greater than the risk threshold is less than or equal to the preset number, then the risk behavior identification result of the accessing user is determined to be that there is no risk of sensitive data leakage; if the risk behavior assessment value of the accessing user is greater than the risk threshold and the number of times the risk behavior assessment value of the accessing user is greater than the risk threshold is less than or equal to the preset number, then the risk behavior identification result of the accessing user is determined to be that there is a suspected risk of sensitive data leakage; if the risk behavior assessment value of the accessing user is greater than the risk threshold and the number of times the risk behavior assessment value of the accessing user is greater than the risk threshold is greater than the preset number, then the risk behavior identification result of the accessing user is determined to be that there is a risk of sensitive data leakage.

[0079] This embodiment judges the risk behavior identification results of each visiting user by setting two risk behavior assessment conditions: the comparison relationship between the risk behavior assessment value and the risk threshold, and the comparison relationship between the number of times the risk behavior assessment value is greater than the risk threshold and the preset number. This can effectively avoid the problem of misjudgment of risk behavior caused by a short-term increase in the business needs of the visiting personnel. At the same time, it can also identify risk behaviors that leak sensitive data slowly over a long period of time, thereby improving the accuracy of user risk behavior identification.

[0080] The risk behavior identification method proposed in this embodiment trains risk assessment models for each business category based on the business category to which the accessing user belongs, and after collecting new access traffic data, uses the newly collected sensitive data access data to optimize the various parameters of the model, and then evaluates the user's risk behavior through the optimized risk assessment models. Finally, based on the user's risk behavior assessment value and a variety of risk assessment conditions, it determines whether the behavior of each accessing person has the risk of leaking sensitive data. By increasing the classification and grouping of sensitive data access data, the above method can circumvent the problem of imbalance in data standards, thereby allowing the risk behavior identification method to be combined with actual business behavior, effectively reducing the false alarm rate and limitations of risk behavior assessment, and can provide more realistic feedback on the actual situation of sensitive data leakage by internal personnel of the enterprise. In addition, the above method can perform quantitative assessments on long-term threat behaviors, thereby improving the accuracy and interpretability of risk behavior assessments.

[0081] Furthermore, as a specific implementation of the method shown in Figures 1 and 2, this embodiment provides a risk behavior identification device, as shown in Figure 3, which includes: a traffic data acquisition module 31, a model parameter update module 32, an evaluation value calculation module 33 and an identification result output module 34.

[0082] The traffic data collection module 31 can be used to collect access traffic data of sensitive data, classify the access traffic data according to the business category of the access user corresponding to the access traffic data, and obtain sensitive data access data of multiple business categories;

[0083] A model parameter updating module 32, which can be used to update the model parameters of the risk assessment model of the business category according to the sensitive data access data of the business category;

[0084] An evaluation value calculation module 33 may be configured to calculate a risk behavior evaluation value for each accessing user under the business category based on the risk assessment model of the business category and the sensitive data access data of the business category;

[0085] The identification result output module 34 can be used to obtain the risk behavior identification result of each access user according to the risk behavior evaluation value of each access user under the business category.

[0086] In a specific application scenario, the traffic data collection module 31 can be specifically used to classify the access traffic data according to the user identifier corresponding to the access traffic data to obtain the access traffic data of each access user; analyze and count the access traffic data of each access user to obtain the sensitive data access volume, number of sensitive requests, sensitive data level and sensitive interface access volume of each access user; use the sensitive data access volume, number of sensitive requests, sensitive data level and sensitive interface access volume of each access user as the sensitive data access data of each access user; classify the sensitive data access data of multiple access users according to the business category to which each access user belongs to obtain sensitive data access data of multiple business categories.

[0087] In a specific application scenario, the traffic data collection module 31 can also be used to obtain the number of sensitive requests initiated by the visiting user, the access data of the visiting user to each sensitive data, and the access data of the visiting user to each sensitive interface based on the access traffic data of the visiting user; obtain the number of sensitive requests of the visiting user based on the number of sensitive requests initiated by the visiting user; cluster the access data of the visiting user to each sensitive data to obtain the sensitive data access volume of the visiting user; cluster the access data of the visiting user to each sensitive interface to obtain the sensitive interface access volume of the visiting user; obtain the sensitive data level of the visiting user based on the highest level of the data security level of each sensitive data accessed by the visiting user.

[0088] In a specific application scenario, as shown in Figure 4, the device also includes an evaluation model training module 35, which can be specifically used to collect historical access traffic data of sensitive data, classify the historical access traffic data according to the business category to which the user corresponding to the historical access traffic data belongs, and obtain historical sensitive data access data of multiple business categories; based on the historical sensitive data access data of the business category, train multiple user behavior baselines corresponding to the business category, wherein the user behavior baseline includes a sensitive data access volume baseline, a sensitive request number baseline, and a sensitive interface access volume baseline; based on the multiple user behavior baselines corresponding to the business category, determine multiple model parameters of the risk assessment model of the business category, wherein the multiple model parameters include a sensitive data access volume weight coefficient, a sensitive request number weight coefficient, and a sensitive interface access volume weight coefficient; based on the multiple model parameters of the risk assessment model of the business category and the preset mapping relationship between the sensitive data level and the risk value, construct a risk assessment model for the business category.

[0089] In a specific application scenario, the model parameter update module 32 can be specifically used to update multiple user behavior baselines corresponding to the business category based on the sensitive data access data of the business category, wherein the user behavior baseline includes a sensitive data access volume baseline, a sensitive request number baseline, and a sensitive interface access volume baseline; based on the multiple user behavior baselines corresponding to the business category, update multiple model parameters of the risk assessment model of the business category, wherein the multiple model parameters include a sensitive data access volume weight coefficient, a sensitive request number weight coefficient, and a sensitive interface access volume weight coefficient.

[0090] In a specific application scenario, the sensitive data access data includes sensitive data access volume, sensitive request number, sensitive data level and sensitive interface access volume; the evaluation value calculation module 33 can be specifically used to obtain the sensitive data access volume risk value of the accessing user according to the sensitive data access volume weight coefficient corresponding to the sensitive data access volume of the accessing user; obtain the sensitive request number risk value of the accessing user according to the sensitive request number weight coefficient corresponding to the sensitive request number of the accessing user; obtain the sensitive data level risk value of the accessing user through the mapping relationship between the sensitive data level and the risk value according to the sensitive data level of the accessing user; obtain the sensitive interface access volume risk value of the accessing user according to the sensitive interface access volume weight coefficient corresponding to the sensitive interface access volume of the accessing user; obtain the risk behavior evaluation value of each accessing user under the business category according to the sum of the sensitive data access volume risk value, sensitive request number risk value, sensitive data level risk value and sensitive interface access risk value of the accessing user.

[0091] In a specific application scenario, the identification result output module 34 can be specifically used to determine whether the risk behavior assessment value of each visiting user is greater than a preset risk threshold, and whether the number of times the risk behavior assessment value of the visiting user is greater than the risk threshold is greater than the preset number; if the risk behavior assessment value of the visiting user is less than or equal to the risk threshold and the number of times the risk behavior assessment value of the visiting user is greater than the risk threshold is less than or equal to the preset number, then the risk behavior identification result of the visiting user is determined to be that there is no risk of sensitive data leakage; if the risk behavior assessment value of the visiting user is greater than the risk threshold and the number of times the risk behavior assessment value of the visiting user is greater than the risk threshold is less than or equal to the preset number, then the risk behavior identification result of the visiting user is determined to be that there is a suspected risk of sensitive data leakage; if the risk behavior assessment value of the visiting user is greater than the risk threshold and the number of times the risk behavior assessment value of the visiting user is greater than the risk threshold is greater than the preset number, then the risk behavior identification result of the visiting user is determined to be that there is a risk of sensitive data leakage.

[0092] It should be noted that for other corresponding descriptions of the functional units involved in the risk behavior identification device provided in this embodiment, reference can be made to the corresponding descriptions in Figures 1 and 2, and no further details will be given here.

[0093] Based on the above-mentioned method as shown in FIG. 1 and FIG. 2 , this embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the above-mentioned risk behavior identification method as shown in FIG. 1 and FIG. 2 is implemented.

[0094] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product. The software product to be identified can be stored in a non-volatile storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0095] Based on the above-mentioned method shown in Figures 1 and 2, and the risk behavior identification device embodiment shown in Figures 3 and 4, in order to achieve the above-mentioned purpose, this embodiment also provides a computer device for risk behavior identification, which can be specifically a personal computer, server, smart phone, tablet computer, smart watch, or other network device, etc. The computer device includes a storage medium and a processor; the storage medium is used to store computer programs and operating systems; the processor is used to execute computer programs to implement the above-mentioned method shown in Figures 1 and 2.

[0096] Optionally, the computer device may further include an internal memory, a communication interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a Wi-Fi module, a display, an input device such as a keyboard, etc. Optionally, the communication interface may further include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a Wi-Fi interface), etc.

[0097] Those skilled in the art will understand that the computer device structure for identifying an operation action provided in this embodiment does not constitute a limitation on the computer device, and may include more or fewer components, or a combination of certain components, or different component arrangements.

[0098] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the computer device hardware and the software resources to be identified, supporting the execution of the information processing program and other software and / or programs to be identified. The network communication module is used to enable communication between components within the storage medium and with other hardware and software in the information processing computer device.

[0099] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform, or can be implemented by hardware. By applying the technical solution of the present application, firstly, the access traffic data of sensitive data is collected, and the access traffic data is classified according to the business category to which the accessing user corresponding to the access traffic data belongs, to obtain sensitive data access data of multiple business categories, and then according to the sensitive data access data of the business category, the model parameters of the risk assessment model of the business category are updated, and then, through the risk assessment model of the business category, according to the sensitive data access data of the business category, the risk behavior assessment value of each accessing user under the business category is calculated, and finally, according to the risk behavior assessment value of each accessing user under the business category, the risk behavior identification result of each accessing user is obtained. Compared with the prior art, the above method can improve the adaptability, practicality and assessment accuracy of risk behavior assessment in business scenarios, and the assessment results are more intuitive.

[0100] Those skilled in the art will understand that the accompanying drawings are only schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily required to implement the present application. Those skilled in the art will understand that the modules in the devices in the implementation scenario can be distributed in the devices of the implementation scenario according to the implementation scenario description, or can be changed accordingly and located in one or more devices different from the implementation scenario. The modules of the above-mentioned implementation scenario can be combined into one module, or can be further split into multiple sub-modules.

[0101] The serial numbers of the above application are for descriptive purposes only and do not represent the advantages or disadvantages of the implementation scenarios. The above disclosure only discloses several specific implementation scenarios of the present application, but the present application is not limited thereto. Any changes that can be conceived by those skilled in the art should fall within the scope of protection of the present application.

Claims

1. A method for identifying risky behavior, wherein: The method comprises: Collect access traffic data of sensitive data, classify the access traffic data according to the business category to which the accessing user corresponding to the access traffic data belongs, and obtain sensitive data access data of multiple business categories; According to the sensitive data access data of the business category, the model parameters of the risk assessment model of the business category are updated; By using the risk assessment model of the business category and based on the sensitive data access data of the business category, a risk behavior assessment value of each access user under the business category is calculated; According to the risk behavior evaluation value of each access user under the business category, a risk behavior identification result of each access user is obtained.

2. The method according to claim 1, wherein: The access traffic data is classified according to the business category to which the access user corresponding to the access traffic data belongs, to obtain sensitive data access data of multiple business categories, including: Classifying the access traffic data according to the user identifier corresponding to the access traffic data to obtain the access traffic data of each access user; Analyze and count the access traffic data of each access user to obtain the sensitive data access volume, sensitive request number, sensitive data level and sensitive interface access volume of each access user; The sensitive data access volume, sensitive request number, sensitive data level and sensitive interface access volume of each accessing user are used as the sensitive data access data of each accessing user; According to the business category to which each of the accessing users belongs, the sensitive data access data of multiple accessing users are classified to obtain the sensitive data access data of multiple business categories.

3. The method according to claim 2, wherein: The access traffic data of each access user is analyzed and counted to obtain the sensitive data access volume, sensitive request number, sensitive data level and sensitive interface access volume of each access user, including: According to the access traffic data of the accessing user, the number of sensitive requests initiated by the accessing user, the access data of each sensitive data by the accessing user, and the access data of each sensitive interface by the accessing user are obtained; According to the number of sensitive requests initiated by the visiting user, the number of sensitive requests initiated by the visiting user is obtained; Clustering the access data of each sensitive data by the accessing user to obtain the access volume of the sensitive data by the accessing user; Clustering the access data of the access user to each sensitive interface to obtain the access volume of the sensitive interface by the access user; The sensitive data level of the accessing user is obtained according to the highest level among the data security levels of each piece of sensitive data accessed by the accessing user.

4. The method according to claim 1, wherein: Before updating the model parameters of the risk assessment model of the business category according to the sensitive data access data of the business category, the method further includes: Collecting historical access traffic data of sensitive data, classifying the historical access traffic data according to the business category to which the user corresponding to the historical access traffic data belongs, and obtaining historical sensitive data access data of multiple business categories; According to the historical sensitive data access data of the business category, multiple user behavior baselines corresponding to the business category are trained, wherein the user behavior baselines include a sensitive data access volume baseline, a sensitive request number baseline, and a sensitive interface access volume baseline; Determine multiple model parameters of the risk assessment model of the business category according to multiple user behavior baselines corresponding to the business category, wherein the multiple model parameters include a weight coefficient of sensitive data access volume, a weight coefficient of sensitive request times, and a weight coefficient of sensitive interface access volume; A risk assessment model for the business category is constructed based on multiple model parameters of the risk assessment model for the business category and a preset mapping relationship between the sensitive data level and the risk value.

5. The method according to claim 1 or 4, wherein: The updating of the model parameters of the risk assessment model of the business category according to the sensitive data access data of the business category includes: According to the sensitive data access data of the business category, multiple user behavior baselines corresponding to the business category are updated, wherein the user behavior baselines include a sensitive data access volume baseline, a sensitive request number baseline, and a sensitive interface access volume baseline; Based on the multiple user behavior baselines corresponding to the business category, multiple model parameters of the risk assessment model of the business category are updated, wherein the multiple model parameters include a weight coefficient for sensitive data access volume, a weight coefficient for sensitive request frequency, and a weight coefficient for sensitive interface access volume.

6. The method according to claim 5, wherein: The sensitive data access data includes the amount of sensitive data access, the number of sensitive requests, the level of sensitive data and the amount of sensitive interface access; Then, the risk assessment model of the business category is used to calculate the risk behavior assessment value of each access user under the business category according to the sensitive data access data of the business category, including: Obtaining a sensitive data access risk value of the access user according to a sensitive data access weight coefficient corresponding to the sensitive data access of the access user; Obtaining a risk value of the number of sensitive requests of the visiting user according to a weight coefficient of the number of sensitive requests corresponding to the number of sensitive requests of the visiting user; According to the sensitive data level of the accessing user, a sensitive data level risk value of the accessing user is obtained through a mapping relationship between the sensitive data level and the risk value; According to the sensitive interface access volume weight coefficient corresponding to the sensitive interface access volume of the accessing user, the sensitive interface access volume risk value of the accessing user is obtained; According to the risk value of the sensitive data access volume, the risk value of the number of sensitive requests, The risk behavior assessment value of each access user under the business category is obtained by summing the risk value of the sensitive data level and the risk value of the sensitive interface access volume.

7. The method according to claim 1, wherein: The step of obtaining the risk behavior identification result of each access user according to the risk behavior evaluation value of each access user under the business category includes: Determine whether the risk behavior assessment value of each accessing user is greater than a preset risk threshold, and whether the number of times the risk behavior assessment value of the accessing user is greater than the risk threshold is greater than a preset number; If the risk behavior assessment value of the accessing user is less than or equal to the risk threshold and the number of times the risk behavior assessment value of the accessing user is greater than the risk threshold is less than or equal to the preset number of times, then it is determined that the risk behavior identification result of the accessing user is that there is no risk of sensitive data leakage; If the risk behavior assessment value of the accessing user is greater than the risk threshold and the number of times the risk behavior assessment value of the accessing user is greater than the risk threshold is less than or equal to the preset number of times, then the risk behavior identification result of the accessing user is determined to be suspected of having a risk of sensitive data leakage; If the risk behavior assessment value of the accessing user is greater than the risk threshold and the number of times the risk behavior assessment value of the accessing user is greater than the risk threshold is greater than the preset number of times, then the risk behavior identification result of the accessing user is determined to be that there is a risk of sensitive data leakage.

8. A risk behavior identification device, wherein: The device comprises: A flow data collection module is used to collect access flow data of sensitive data, classify the access flow data according to the business category to which the access user corresponding to the access flow data belongs, and obtain sensitive data access data of multiple business categories; A model parameter updating module, used to update the model parameters of the risk assessment model of the business category according to the sensitive data access data of the business category; An evaluation value calculation module, used to calculate the risk behavior evaluation value of each access user under the business category according to the sensitive data access data of the business category through the risk evaluation model of the business category; The identification result output module is used to obtain the risk behavior identification result of each access user according to the risk behavior evaluation value of each access user under the business category.

9. A storage medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images