网络安全用户行为画像方案设计  

User Behavior Profiling Scheme for Network Security

作　　者：何雪海[1] 黄明浩[1] 宋飞[1] HE Xue-hai HUANG Ming-hao SONG Fei(Westone Information Industry, Ltd., Chengdu Sichuan 610041, China)

机构地区：[1]卫士通信息产业股份有限公司,四川成都610041

出　　处：《通信技术》2017年第4期789-794,共6页Communications Technology

摘　　要：用户行为分析是近年来网络安全领域研究的热点之一,但是一直受限于相关数据存储和分析的能力而用处不大。对历史行为数据建模,是这类安全分析应用的关键。计算机用户相关的行为数据对于预测用户行为、异常检测非常有用。因此,提出一种大数据网络安全用户行为画像设计方案。该方案结合用户角色和个人用户操作行为特征,利用用户日志历史信息勾勒出用户行为画像,并给出用户行为安全画像实例。该方案能有效利用用户历史行为数据,使得安全管理系统能准实时地判断用户行为异常,提高网络安全类产品的实时响应能力。实践表明,该方案能应用于异常检测、日志审计、网络安全评估等。User behavior analysis is now a hot topic in network security domain but could not play an key role due to the difficulty in saving and analyzing the relevant data. The key to its application is to model the historical user behavior data. Any related behavior data of computer users is very beneficial for predicting their future actions or detecting the intrusions. In view of this, an efficient user behavior profiling scheme is proposed, which could, in combination with user, roles in the team and actions profile the user behavior, and an profiling example is also given.The scheme make it easy to use historical behavior and determine anomalous behavior in real time or in near real-time. Experiment indicates that this scheme could be applied in intrusion detecting, log auditing, security assessing.

关 键 词：用户画像 用户行为分析 综合监督管理系统 大数据 日志分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]