Network anomaly behavior management system based on big data

Abstract

A network anomaly behavior management system based on big data, relating to the technical fields of network security and big data analysis. The system comprises modules for data collection and ingestion, user and entity profiling, behavior feature extraction, an anomaly detection engine, policy and response, audit and reporting, visualization and alerting, and a policy and rule repository. The system aggregates and standardizes multi-source heterogeneous data, constructs dynamic user and entity profiles, extracts time-series and graph features, and utilizes a hybrid engine combining rules, statistics, and machine learning to calculate anomaly scores. Based on this, the system can execute automated response policies such as blocking and rate limiting, and provides visualized situational awareness and audit reports. The invention solves the problems in existing technology, such as data fragmentation, rule lag, lack of context, and low response efficiency, achieving precise identification, correlation analysis, and automated closed-loop handling of network anomaly behaviors, thereby significantly enhancing security protection capabilities and operational efficiency.