Anomalous user detection method, apparatus and device for data security, storage medium and product

Abstract

The present application relates to the technical field of data security, and discloses an anomalous user detection method, apparatus and device for data security, a storage medium, and a product. The method comprises: determining operation behaviors corresponding to users to be detected and feature vectors corresponding to the operation behaviors; determining an operation similarity between said users, using the operation behaviors as nodes, and constructing graph structures on the basis of the feature vectors and the operation similarity; and on the basis of the graph structures, determining feature representation vectors corresponding to the nodes, and performing anomalous user detection on the basis of the feature representation vectors. In the present application, operation behaviors and feature vectors corresponding to users to be detected are first determined, the operation behaviors are used as nodes, graph structures are constructed on the basis of the feature vectors and an operation similarity, the graph structures related to the operation behaviors corresponding to said users can be constructed, and then anomalous user detection is performed on the basis of a feature representation vector corresponding to each node, so that anomalous users can be detected more quickly and accurately, and most normal users are excluded.

Description

Methods, apparatus, equipment, storage media, and products for detecting abnormal users for data security.

[0001] Cross-reference to related applications

[0002] This application is based on and claims priority to Chinese Patent Application No. 202411189697.1, filed on August 27, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of data security technology, and in particular to an abnormal user detection method, apparatus, device, storage medium and product for data security. Background Technology

[0004] Currently, the exponential growth of internal enterprise data has brought significant data security risks. However, detecting anomalous users within enterprises is challenging, primarily because their actions resemble those of legitimate users, making them difficult to distinguish and identify. Furthermore, the sheer volume and complexity of internal enterprise data pose a significant challenge to the timeliness of anomalous user detection. Therefore, how to detect anomalous users more quickly and accurately, and eliminate the vast majority of legitimate users, has become an urgent problem to be solved. Summary of the Invention

[0005] The main purpose of this application is to provide a method, apparatus, device, storage medium and product for detecting abnormal users for data security, aiming to solve the technical problem of how to detect abnormal users faster and more accurately and eliminate the vast majority of normal users.

[0006] To achieve the above objectives, this application provides a method for detecting abnormal users for data security, the method comprising:

[0007] Determine the user's operational behavior and the feature vector corresponding to the operational behavior;

[0008] Determine the operation similarity between each of the users to be detected, and use the operation behavior as a node to construct a graph structure based on the feature vector and the operation similarity;

[0009] The feature representation vector corresponding to the node is determined based on the graph structure, and abnormal user detection is performed based on the feature representation vector.

[0010] Furthermore, to achieve the above objectives, this application also provides an abnormal user detection device for data security, the abnormal user detection device for data security comprising:

[0011] The vector determination module is used to determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior;

[0012] The graph structure construction module is used to determine the operation similarity between each of the users to be detected, and to construct a graph structure based on the operation behavior as nodes, according to the feature vector and the operation similarity.

[0013] An abnormal user detection module is used to determine the feature representation vector corresponding to the node based on the graph structure, and to perform abnormal user detection based on the feature representation vector.

[0014] Furthermore, to achieve the above objectives, this application also proposes an abnormal user detection device for data security, the abnormal user detection device for data security comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the operation of the abnormal user detection method for data security as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the operation of the abnormal user detection method for data security as described above.

[0016] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the operation of the abnormal user detection method for data security as described above. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0019] Figure 1 is a flowchart illustrating the first embodiment of the abnormal user detection method for data security according to this application;

[0020] Figure 2 is a flowchart illustrating the second embodiment of the abnormal user detection method for data security in this application.

[0021] Figure 3 is a schematic diagram of the abnormal user detection system for data security in this application;

[0022] Figure 4 is a structural block diagram of the first embodiment of the abnormal user detection device for data security in this application;

[0023] Figure 5 is a schematic diagram of the structure of an abnormal user detection device for data security in the hardware operating environment involved in the embodiment of this application.

[0024] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0025] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0026] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0027] The main solution of this application embodiment is: to determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior; to determine the operation similarity between each user to be detected, and to construct a graph structure based on the operation behavior as a node, according to the feature vector and the operation similarity; to determine the feature representation vector corresponding to the node according to the graph structure, and to perform abnormal user detection according to the feature representation vector.

[0028] Currently, while internal enterprise data is growing exponentially, it also brings enormous data security risks. However, detecting abnormal users within enterprises is quite difficult, mainly because the actions of abnormal users are similar to the business behaviors of normal users, making them difficult to distinguish and identify. Moreover, the sheer volume and complexity of internal enterprise data also pose a significant challenge to the timeliness of abnormal user detection.

[0029] This application determines the user's operational behavior and its corresponding feature vector, then determines the operational similarity between users, and uses operational behaviors as nodes. A graph structure is constructed based on the feature vectors and operational similarity. The feature representation vectors corresponding to each node are then determined based on the graph structure, and abnormal user detection is performed based on these feature representation vectors. This application first determines the operational behavior and feature vectors for each user, then constructs a graph structure related to the operational behaviors of each user, and finally determines the feature representation vectors for each node. This allows for faster and more accurate detection of abnormal users, eliminating the vast majority of normal users.

[0030] It should be noted that the executing entity of this application can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer or personal computer, or an electronic device or abnormal user detection device capable of performing the above functions. The following description uses an abnormal user detection device as an example to illustrate this embodiment and the subsequent embodiments.

[0031] Based on this, this application provides an abnormal user detection method for data security. Referring to Figure 1, Figure 1 is a flowchart of the first embodiment of the abnormal user detection method for data security of this application.

[0032] In this embodiment, the abnormal user detection method for data security includes the following operations:

[0033] Operation S10: Determine the operation behavior of the user to be detected and the feature vector corresponding to the operation behavior.

[0034] Understandably, "users to be detected" refers to users who require anomaly detection, and "abnormal users" refers to users who exhibit abnormal behavior. Operational behavior refers to the actions taken by each user to be detected during operation, and this behavior can be represented by data. A feature vector is a vector composed of several features corresponding to the operational behavior.

[0035] Furthermore, in order to accurately obtain the feature vector, in this embodiment, the operation S10 includes: determining the operation behavior of the user to be detected within a preset period; preprocessing the behavior log data corresponding to the operation behavior to obtain processed log data; dividing the processed log data to obtain the log dataset of the user to be detected within the preset period; extracting behavioral features from the log dataset, and determining the feature vector based on the extracted behavioral features.

[0036] It should be understood that the preset period can be a pre-set period, such as a day, a week, a month, etc. This embodiment uses a week as an example for explanation. This embodiment can obtain the weekly operation behavior of the user to be detected and obtain the corresponding behavior log data.

[0037] Understandably, when the user under test uses the internal business system, six typical log types can be generated: internal business system and platform login / logout logs, file operation logs, database operation logs, web page access logs, email logs, and mobile device connection logs. These six types of logs cover all operation scenarios related to internal user business data. Data security incidents such as data leakage and unauthorized operation of business data will be reflected in these six types of logs. The following are descriptions of these six types of logs in some embodiments: Internal Business System and Platform Login / Logout Logs: Record the login and logout status of internal users in various business systems, including time, user ID, device ID, system name, and login / logout operation; File Operation Logs: Record the file operation behavior of internal users, including time, user ID, device ID, file name, file content, and file operation type; Database Operation Logs: Record the database operation behavior of internal users, including time, user ID, device ID, database / table / field operated on, and operation command; Webpage Access Logs: Record the internet access behavior of internal users, including time, user ID, device ID, webpage URL (Uniform Resource Locator), and webpage content; Email Logs: Record the email communication behavior of internal users, including time, user ID, device ID, recipient, recipient domain name, sender, email size, number of attachments, and email content; Mobile Device Connection Logs: Record the mobile device connection behavior of internal users, including time, user ID, device ID, mobile device type, and connection / disconnection operation.

[0038] In some implementations, the six types of behavior log data can be preprocessed. In some embodiments, the timestamps of all behavior log data can first be standardized by converting the time into year, month, day, hour, minute, and second format. Then, the six types of behavior log data are integrated according to user ID and timestamp to construct a complete internal user activity log, i.e., the processed log data. The processed log data is then partitioned. In some embodiments, the processed log data for each week is grouped according to user ID to obtain the weekly log dataset for each user to be monitored.

[0039] In addition, behavioral features can be extracted from the weekly log dataset of each user under test. This involves extracting multiple behavioral features from each user's weekly log dataset. These features accurately reflect the periodicity and regularity of user behavior and can include the following 19 features: Behavior Time Period: The time period during which the user's actions occur, categorized as working hours, off-hours, and weekends; Device Type: The type of host device from which the user's actions occur, categorized as personal host, host belonging to another user, and shared host; Total Number of Logins to the Business System: The total number of times the user logs into the business system within a week; Total Number of Logins to the Business System Outside of Working Hours: The total number of times the user logs into the business system outside of working hours within a week; Average Login Duration: The average duration of each login to the business system within a week; Total Login Duration: The average duration of each login to the business system within a week; Database / Table Types Called: The types of databases the user has called within a week. Total number of data table types; Number of database commands called: the total number of database commands called by the user within a week; Database data volume called: the total amount of data called by the user through the database within a week; Mobile device usage frequency: the total number of times the user used a mobile device within a week; Average mobile device usage time: the duration of each mobile device usage session within a week; Average email size: the average size of all emails; Total number of email recipients: the total number of recipients in emails sent by the user within a week; Total number of email attachments: the total number of attachments in emails sent by the user; Number of emails sent outside of working hours: the total number of emails sent by the user outside of working hours; Number of files: the total number of files operated on by the user within a week; Average file size: the average size of files operated on by the user within a week; Total number of file types: the total number of file types operated on by the user; File operation type: the type of file operation performed by the user, including upload, download, modification, and deletion. These 19 behavioral features are represented as a feature vector. in This represents the k-th behavioral feature of the i-th user to be detected in the j-th week.

[0040] Operation S20: Determine the operation similarity between each of the users to be detected, and use the operation behavior as a node to construct a graph structure based on the feature vector and the operation similarity.

[0041] Understandably, operation similarity refers to the similarity between the operation behaviors of each user to be detected. Operation behaviors are used as nodes, feature vectors are used as the node features corresponding to the nodes, and operation similarity is used as the edge weights between nodes to construct a graph structure.

[0042] Furthermore, in order to effectively construct a graph structure, in this embodiment, operation S20 includes: extracting a set of operation objects from the log dataset within the preset period; performing Jaccard similarity calculation on each set of operation objects to obtain the operation similarity between each user to be detected; using the operation behavior as a node, the feature vector as the node feature corresponding to the node, and the operation similarity as the edge weight between the nodes; and constructing a graph structure based on the nodes, the node features, and the edge weights.

[0043] It should be understood that a set of operation objects can be extracted from the log dataset within a preset period, that is, from the weekly log dataset of the user to be tested. Business systems, files, databases, mobile devices, etc., are all considered operation objects. The set of operation objects is represented as follows: This represents the set of operation objects for the i-th user in the j-th week.

[0044] Understandably, the KVM (K-Minimum Hash Values) algorithm can be used to calculate Jaccard similarity for each set of operation objects. While the KVM algorithm has lower computational efficiency and storage requirements, it can efficiently calculate Jaccard similarity, i.e., operation similarity. In some embodiments, a set of hash functions h can be selected first. i Where i∈{1,…,n}. Then, for sets A and B, where set A is the set of weekly operation objects corresponding to user A to be detected, and set B is the set of weekly operation objects corresponding to user B to be detected, calculate the hash values ​​under these hash functions respectively, and keep the k smallest hash values ​​of each set to obtain two hash value sets K of size k. A and K B The calculation formula is k = h i (s), where s is an object in the set of operation objects. Here, the operation type object is uniquely encoded, and the specific encoding value is determined by the type of operation object. Then, two hash value sets K are calculated. A and K B The size of the intersection, c, i.e., c = |K A ∩K B | and calculate the Jaccard similarity between the two sets according to the formula, i.e.

[0045] In some implementations, the operation behavior can be used as a node, and each feature vector can be used as the node feature corresponding to each node. The operation similarity between each user to be detected can be used as the edge weight between each node, so that a graph structure can be constructed based on the nodes, node features and edge weights.

[0046] Operation S30: Determine the feature representation vector corresponding to the node based on the graph structure, and perform abnormal user detection based on the feature representation vector.

[0047] Furthermore, in order to effectively detect abnormal users, in this embodiment, operation S30 includes: determining the feature representation vector corresponding to the node according to the graph structure; dividing the node into datasets using a random forest model to obtain abnormal nodes; and determining abnormal users based on the abnormal nodes.

[0048] Understandably, by combining the edge weights between nodes in a graph structure and using a Graph Convolutional Neural Network (GCNN) for node embedding learning, the similarities and differences between all user behaviors can be captured. Weekly operations with high similarity should have stronger correlations. Finally, the features of neighboring nodes are passed to each node through the edge weights, resulting in a feature representation vector for each node.

[0049] It should be understood that this embodiment can use a random forest model to partition the dataset of several nodes in the graph structure. The random forest model is an unsupervised learning model that constructs multiple isolated trees to form an isolated forest and partitions the dataset by randomly selecting features. Abnormal nodes will be isolated at a lower tree depth.

[0050] In some implementations, isolated outliers are sets of user weekly behaviors that deviate from the normal baseline, and the users involved are considered to be individuals with abnormal behavior, i.e., abnormal users.

[0051] This embodiment determines the user's operational behavior and its corresponding feature vector, then determines the operational similarity between users, and uses operational behaviors as nodes. A graph structure is constructed based on the feature vectors and operational similarity. The feature representation vectors corresponding to each node are then determined based on the graph structure, and abnormal user detection is performed based on these feature representation vectors. This embodiment first determines the operational behavior and feature vectors for each user, then constructs a graph structure related to the operational behaviors of each user, and finally determines the feature representation vectors for each node. This allows for faster and more accurate detection of abnormal users, eliminating the vast majority of normal users.

[0052] Referring to Figure 2, Figure 2 is a flowchart illustrating the second embodiment of the abnormal user detection method for data security according to this application.

[0053] Based on the first embodiment described above, in this embodiment, after operation S30, the method further includes:

[0054] Operation S40: Encode the current operation behavior of the abnormal user to obtain the original feature vector.

[0055] Understandably, after detecting an abnormal user, it is necessary to analyze the specific actions of the abnormal user. However, since the vast majority of normal users have already been filtered out, the scale of log data to be processed is greatly reduced. This embodiment can detect the daily behavior of abnormal users and locate specific abnormal events by constructing a baseline behavior of normal users.

[0056] It should be understood that this embodiment can encode the current operational behavior corresponding to abnormal users. The encoding features include time, device, and activity type. In some embodiments, time is defined as follows: weekday working hours as 1; weekday off-hours as 2; and non-working day hours as 3. Device is defined as follows: personal host device as 1; shared host device as 2; and other host devices as 3. Activity type is encoded according to the six activity types involved in the logs, which will not be detailed here. After encoding the current operational behavior corresponding to abnormal users in the above manner, the original feature vector can be obtained.

[0057] Operation S50: Input the original feature vector into the preset autoencoder model and output the reconstructed feature vector.

[0058] In some implementations, the original feature vector is input into a preset autoencoder model to obtain the reconstructed feature vector.

[0059] Furthermore, in order to accurately construct the preset autoencoder model, in this embodiment, before the operation S50, the method further includes: encoding the normal operating behavior corresponding to a normal user to obtain a normal feature vector; and training the initial autoencoder model based on the normal feature vector to obtain the preset autoencoder model.

[0060] Understandably, a subset of normal users can be randomly selected from all users excluding abnormal users in the user pool to be tested. The normal operational behaviors of these normal users can then be encoded using the method described above to obtain normal feature vectors. These normal feature vectors are then used to train an initial autoencoder model. This initial autoencoder model can be an AE (Autoencoder) model. An autoencoder is an unsupervised neural network model that uses the normal feature vectors as supervision to guide the neural network in learning mapping relationships. The reconstruction error of a well-trained pre-defined autoencoder model will tend to stabilize and eventually fall below a certain threshold.

[0061] Operation S60: Determine whether the current operation is an abnormal operation based on the reconstruction error between the original feature vector and the reconstructed feature vector.

[0062] It should be understood that since the neural network of the autoencoder model has learned the normal operating behavior of normal users, the reconstruction error between the original feature vector of all normal operating behavior and its reconstructed feature vector will be less than the threshold. However, after the features of abnormal behavior are reconstructed, the difference between the two will be relatively large, that is, the reconstruction error between the original feature vector of abnormal operating behavior and its reconstructed feature vector will be greater than the threshold.

[0063] Understandably, all operations with reconstruction errors greater than or equal to the threshold will be judged as abnormal operations, and the result of abnormal event detection will be obtained.

[0064] In some embodiments, referring to Figure 3, which is a structural schematic diagram of the abnormal user detection system for data security according to this application, the abnormal user detection system for data security may include a data processing and analysis module, an internal abnormal personnel detection module, an internal abnormal event detection module, and a data security event analysis module. First, the coarse-grained internal abnormal personnel detection module identifies all internal abnormal personnel whose behavior deviates from the normal behavior baseline. Then, the fine-grained internal abnormal event detection module detects the specific behaviors of these abnormal personnel that deviate from normal operations. The functions of the data processing and analysis module, the internal abnormal personnel detection module, and the internal abnormal event detection module have been described above. The data processing and analysis module is responsible for associating the abnormal personnel and abnormal event detection results, combining the personnel's user role, the data involved, and the abnormal operation time, analyzing and confirming the data security event caused by the personnel, and displaying the final detection results. The operation of this module is as follows: Operation 1: Enrich the abnormal event record by combining user role, the sensitivity level of the data involved, and the abnormal operation event. First, associate the list of abnormal personnel with the corresponding user role, and then, based on the data involved in the abnormal event and the sensitivity level of the associated data, finally obtain a detailed record of the data security event. Step 2: Based on the detailed records of the data security incident, determine the category of the incident, including the following: Active leak by internal personnel: Data leaks caused by the subjective actions of internal personnel; Passive leak by internal personnel: Data leaks caused by the malicious control of internal personnel accounts by external parties due to weak security awareness; Unauthorized operation by internal personnel: Unauthorized operations on business data by internal personnel. Step 3: Combining the data security incident category and the data security incident records, a complete data security incident report can be output.

[0065] This embodiment encodes the current operation behavior corresponding to an abnormal user to obtain an original feature vector. This original feature vector is then input into a preset autoencoder model, which outputs a reconstructed feature vector. Finally, the reconstruction error between the original and reconstructed feature vectors is used to determine whether the current operation behavior is abnormal. This embodiment, by inputting the original feature vector into a preset autoencoder model and then determining whether the current operation behavior is abnormal based on the reconstruction error between the original and reconstructed feature vectors, can analyze the current operation behavior corresponding to an abnormal user and accurately determine whether the current operation behavior is abnormal.

[0066] Referring to Figure 4, which is a structural block diagram of the first embodiment of the abnormal user detection device for data security of this application.

[0067] As shown in Figure 4, the abnormal user detection device for data security proposed in this application includes:

[0068] Vector determination module 10 is used to determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior;

[0069] Graph structure construction module 20 is used to determine the operation similarity between each of the users to be detected, and to construct a graph structure based on the feature vector and the operation similarity, using the operation behavior as nodes.

[0070] The abnormal user detection module 30 is used to determine the feature representation vector corresponding to the node based on the graph structure, and to perform abnormal user detection based on the feature representation vector.

[0071] This embodiment determines the user's operational behavior and its corresponding feature vector, then determines the operational similarity between users, and uses operational behaviors as nodes. A graph structure is constructed based on the feature vectors and operational similarity. The feature representation vectors corresponding to each node are then determined based on the graph structure, and abnormal user detection is performed based on these feature representation vectors. This embodiment first determines the operational behavior and feature vectors for each user, then constructs a graph structure related to the operational behaviors of each user, and finally determines the feature representation vectors for each node. This allows for faster and more accurate detection of abnormal users, eliminating the vast majority of normal users.

[0072] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this application. In practical applications, those skilled in the art can select some or all of it to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0073] In addition, for technical details not described in detail in this embodiment, please refer to the abnormal user detection method for data security provided in any embodiment of this application, which will not be repeated here.

[0074] Based on the first embodiment of the abnormal user detection device for data security described above in this application, a second embodiment of the abnormal user detection device for data security in this application is proposed.

[0075] In this embodiment, the vector determination module 10 is further configured to determine the operation behavior of the user to be detected within a preset period; preprocess the behavior log data corresponding to the operation behavior to obtain processed log data; divide the processed log data to obtain the log dataset of the user to be detected within the preset period; extract behavioral features from the log dataset, and determine feature vectors based on the extracted behavioral features.

[0076] Furthermore, the graph structure construction module 20 is also used to extract a set of operation objects from the log dataset within the preset period; perform Jaccard similarity calculation on each set of operation objects to obtain the operation similarity between each user to be detected; take the operation behavior as a node, take the feature vector as the node feature corresponding to the node, take the operation similarity as the edge weight between the nodes; and construct a graph structure based on the node, the node feature and the edge weight.

[0077] Furthermore, the abnormal user detection module 30 is also used to determine the feature representation vector corresponding to the node based on the graph structure; to partition the node into datasets using a random forest model to obtain abnormal nodes; and to determine abnormal users based on the abnormal nodes.

[0078] Furthermore, the abnormal user detection device for data security also includes an operation judgment module, which is used to encode the current operation behavior corresponding to the abnormal user to obtain an original feature vector; input the original feature vector into a preset autoencoder model and output a reconstructed feature vector; and determine whether the current operation behavior is an abnormal operation behavior based on the reconstruction error between the original feature vector and the reconstructed feature vector.

[0079] Furthermore, the operation judgment module is also used to encode the normal operation behavior corresponding to normal users to obtain normal feature vectors; and to train the initial autoencoder model based on the normal feature vectors to obtain a preset autoencoder model.

[0080] Other embodiments or implementations of the abnormal user detection device for data security described in this application can be found in the above-described method embodiments, and will not be repeated here.

[0081] This application provides an abnormal user detection device for data security. The abnormal user detection device for data security includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the abnormal user detection method for data security in the above embodiment 1.

[0082] Referring to Figure 5 below, a schematic diagram of a structurally suitable device for implementing the embodiments of this application for abnormal user detection of data security is shown. The abnormal user detection device for data security in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs (Televisions), desktop computers, etc. The abnormal user detection device for data security shown in Figure 5 is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0083] As shown in Figure 5, the abnormal user detection device for data security may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the abnormal user detection device for data security. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus 1005. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the abnormal user detection device for data security to exchange data wirelessly or via wired communication with other devices. Although the figure shows an abnormal user detection device for data security with various systems, it should be understood that it is not required to implement or possess all of the systems shown. More or fewer systems may be implemented alternatively.

[0084] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0085] The abnormal user detection device for data security provided in this application, employing the abnormal user detection method for data security described in the above embodiments, can solve the technical problem of how to detect abnormal users more quickly and accurately, and eliminate the vast majority of normal users. Compared with related technologies, the beneficial effects of the abnormal user detection device for data security provided in some embodiments of this application are the same as the beneficial effects of the abnormal user detection method for data security provided in the above embodiments, and other technical features in this abnormal user detection device for data security are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0086] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0087] The above description is only a partial embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0088] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the abnormal user detection method for data security in the above embodiments.

[0089] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. Further examples of computer-readable storage media include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (Radio Frequency), etc., or any suitable combination thereof.

[0090] The aforementioned computer-readable storage medium may be included in an abnormal user detection device for data security; or it may exist independently and not assembled into an abnormal user detection device for data security.

[0091] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by an abnormal user detection device for data security, the abnormal user detection device for data security causes the device to: determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior; determine the operation similarity between each user to be detected, and construct a graph structure based on the operation behavior as a node, according to the feature vector and the operation similarity; determine the feature representation vector corresponding to the node according to the graph structure, and perform abnormal user detection according to the feature representation vector.

[0092] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0093] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0094] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0095] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described abnormal user detection method for data security. This solves the technical problem of how to detect abnormal users more quickly and accurately, and eliminate the vast majority of normal users. Compared with related technologies, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the abnormal user detection method for data security provided in the above embodiments, and will not be repeated here.

[0096] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the operation of the abnormal user detection method for data security described above.

[0097] The computer program product provided in this application can solve the technical problem of how to detect abnormal users more quickly and accurately, and eliminate the vast majority of normal users. Compared with related technologies, the beneficial effects of the computer program product provided in this application are the same as those of the abnormal user detection method for data security provided in the above embodiments, and will not be repeated here.

[0098] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for detecting abnormal users for data security, comprising: Determine the user's operational behavior and the feature vector corresponding to the operational behavior; Determine the operation similarity between each of the users to be detected, and use the operation behavior as a node to construct a graph structure based on the feature vector and the operation similarity; The feature representation vector corresponding to the node is determined based on the graph structure, and abnormal user detection is performed based on the feature representation vector.

2. The abnormal user detection method for data security as described in claim 1, wherein, The process of determining the user's operation behavior and the feature vector corresponding to the operation behavior includes: Determine the user's operational behavior within a preset period; The behavior log data corresponding to the operation behavior is preprocessed to obtain the processed log data; The processed log data is divided to obtain the log dataset of the user to be detected within the preset period; Behavioral features are extracted from the log dataset, and feature vectors are determined based on the extracted behavioral features.

3. The abnormal user detection method for data security as described in claim 2, wherein, The step of determining the operation similarity between each of the users to be detected, and using the operation behavior as a node, and constructing a graph structure based on the feature vector and the operation similarity includes: Extract the set of operation objects from the log dataset within the preset period; Jaccard similarity calculation is performed on each set of operation objects to obtain the operation similarity between each user to be detected; The operation behavior is taken as a node, the feature vector is taken as the node feature corresponding to the node, and the operation similarity is taken as the edge weight between the nodes; A graph structure is constructed based on the nodes, the node features, and the edge weights.

4. The abnormal user detection method for data security as described in claim 1, wherein, The step of determining the feature representation vector corresponding to the node based on the graph structure, and performing abnormal user detection based on the feature representation vector, includes: Determine the feature representation vector corresponding to the node based on the graph structure; The dataset is partitioned using a random forest model to identify anomalous nodes. The abnormal user is determined based on the abnormal node.

5. The abnormal user detection method for data security as described in any one of claims 1 to 4, wherein, After determining the feature representation vector corresponding to the node based on the graph structure and performing abnormal user detection based on the feature representation vector, the method further includes: Encode the current operational behavior of abnormal users to obtain the original feature vector; The original feature vector is input into a preset autoencoder model, and the reconstructed feature vector is output. The current operation behavior is determined as an abnormal operation behavior based on the reconstruction error between the original feature vector and the reconstructed feature vector.

6. The abnormal user detection method for data security as described in claim 5, wherein, Before inputting the original feature vector into the preset autoencoder model and outputting the reconstructed feature vector, the method further includes: Encode the normal operational behaviors of normal users to obtain normal feature vectors; The initial autoencoder model is trained based on the normal feature vectors to obtain the preset autoencoder model.

7. The abnormal user detection method for data security as described in claim 2, wherein, The preprocessing of the behavior log data corresponding to the operation to obtain processed log data includes: The timestamps of the behavior log data are formatted in a unified manner, and the behavior log data is integrated according to the user ID and the timestamps to obtain the processed log data.

8. The abnormal user detection method for data security as described in claim 2, wherein, The behavior log data includes: internal business system and platform login / logout logs, file operation logs, database operation logs, web page access logs, email logs, and mobile device connection logs; The extracted behavioral features include: time period, device type, total number of times logging into the business system, total number of times logging into the business system outside of working hours, average duration of logging into the business system, total duration of logging into the business system, types of databases / tables called, number of database commands called, amount of data called, number of times mobile devices are used, average duration of mobile device use, average size of emails, total number of email recipients, total number of email attachments, number of emails outside of working hours, number of files, average file size, total number of file types, and file operation type.

9. The abnormal user detection method for data security as described in claim 3, wherein, The calculation of Jaccard similarity for each set of operation objects includes: Choose a set of hash functions; For a first set of operation objects corresponding to one user to be detected and a second set of operation objects corresponding to another user to be detected, calculate the hash values ​​of the first set of operation objects and the second set of operation objects under the set of hash functions respectively. The smallest k hash values ​​calculated for the first set of operation objects are taken as the first hash value set, and the smallest k hash values ​​calculated for the second set of operation objects are taken as the second hash value set; and Calculate the Jaccard similarity between the first set of hash values ​​and the second set of hash values.

10. The abnormal user detection method for data security as described in claim 5, wherein, When the reconstruction error between the original feature vector and the reconstructed feature vector is greater than or equal to a threshold, the current operation behavior is determined to be an abnormal operation behavior.

11. The abnormal user detection method for data security as described in claim 1, wherein, Determining the feature representation vector corresponding to the node based on the graph structure includes: Based on the edge weights between each node and its neighboring nodes in the graph structure, a graph convolutional neural network (GCNN) is used for node embedding learning; and The node features of the neighboring nodes are passed to each node through the edge weights to obtain the feature representation vector corresponding to each node.

12. An abnormal user detection device for data security, comprising: The vector determination module is used to determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior; The graph structure construction module is used to determine the operation similarity between each of the users to be detected, and to construct a graph structure based on the operation behavior as nodes, according to the feature vector and the operation similarity. An abnormal user detection module is used to determine the feature representation vector corresponding to the node based on the graph structure, and to perform abnormal user detection based on the feature representation vector.

13. The abnormal user detection device for data security as described in claim 12, wherein, The vector determination module is also used for: Determine the user's operational behavior within a preset period; The behavior log data corresponding to the operation behavior is preprocessed to obtain the processed log data; The processed log data is divided to obtain the log dataset of the user to be detected within the preset period; Behavioral features are extracted from the log dataset, and feature vectors are determined based on the extracted behavioral features.

14. The abnormal user detection device for data security as described in claim 13, wherein, The graph structure construction module is also used for: Extract the set of operation objects from the log dataset within the preset period; Jaccard similarity calculation is performed on each set of operation objects to obtain the operation similarity between each user to be detected; The operation behavior is taken as a node, the feature vector is taken as the node feature corresponding to the node, and the operation similarity is taken as the edge weight between the nodes; A graph structure is constructed based on the nodes, the node features, and the edge weights.

15. The abnormal user detection device for data security as described in claim 12, wherein, The abnormal user detection module is also used for: Determine the feature representation vector corresponding to the node based on the graph structure; The dataset is partitioned using a random forest model to identify anomalous nodes. The abnormal user is determined based on the abnormal node.

16. The abnormal user detection device for data security as described in any one of claims 12 to 15, wherein, Also includes: The operation judgment module is used to encode the current operation behavior of abnormal users and obtain the original feature vector; The original feature vector is input into a preset autoencoder model, and the reconstructed feature vector is output. The current operation behavior is determined as an abnormal operation behavior based on the reconstruction error between the original feature vector and the reconstructed feature vector.

17. The abnormal user detection device for data security as described in claim 16, wherein, The operation determination module is also used for: Encode the normal operational behaviors of normal users to obtain normal feature vectors; The initial autoencoder model is trained based on the normal feature vectors to obtain the preset autoencoder model.

18. An abnormal user detection device for data security, comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the operation of the abnormal user detection method for data security as claimed in any one of claims 1 to 11.

19. A storage medium, said storage medium being a computer-readable storage medium, said storage medium storing a computer program, said computer program, when executed by a processor, implementing the operation of the abnormal user detection method for data security as described in any one of claims 1 to 11.

20. A computer program product comprising a computer program that, when executed by a processor, implements the operation of the abnormal user detection method for data security as described in any one of claims 1 to 11.

Images