基于机器学习的用户与实体行为分析技术综述  

Overview of User and Entity Behavior Analytics Technology Based on Machine Learning

作　　者：崔景洋 陈振国[3] 田立勤[3] 张光华[1] CUI Jingyang;CHEN Zhenguo;TIAN Liqin;ZHANG Guanghua(School of Information Science and Engineering,Hebei University of Science and Technology,Shijiazhuang 050018,China;Topsec Network Technology Ltd.,Beijing 100085,China;Hebei IoT Monitoring Engineering Technology Research Center,North China Institute of Science and Technology,Langfang,Hebei 065201,China)

机构地区：[1]河北科技大学信息科学与工程学院,石家庄050018 [2]北京天融信网络安全技术有限公司,北京100085 [3]华北科技学院河北省物联网监控工程技术研究中心,河北廊坊065201

出　　处：《计算机工程》2022年第2期10-24,共15页Computer Engineering

基　　金：国家重点研发计划项目(2018YFB0804701);国家自然科学基金(62072239);河北省科技厅科技计划项目(20377725D)。

摘　　要：随着网络安全技术的更新迭代,新型攻击手段日益增加,企业面临未知威胁难以识别的问题。用户与实体行为分析是识别用户和实体行为中潜在威胁事件的一种异常检测技术,广泛应用于企业内部威胁分析和外部入侵检测等任务。基于机器学习方法对用户和实体的行为进行模型建立与风险点识别,可以有效解决未知威胁难以检测的问题,增强企业网络安全防护能力。回顾用户与实体行为分析的发展历程,重点讨论用户与实体行为分析技术在统计学习、深度学习、强化学习等3个方面的应用情况,研究具有代表性的用户与实体行为分析算法并对算法性能进行对比分析。介绍4种常用的公共数据集及特征工程方法,总结两种增强行为表述准确性的特征处理方式。在此基础上,阐述归纳典型异常检测算法的优劣势,指出内部威胁分析与外部入侵检测的局限性,并对用户与实体行为分析技术未来的发展方向进行展望。With the continuous development of network security technology,new attacking methods are becoming increasingly numerous,exposing enterprises to unknown threats that are difficult to identify.User Entity Behavior Analytics(UEBA)is an anomaly detection technology to identify potential threat events in user and entity behavior.It has been widely used in external intrusion detection and internal threat analysis of enterprises.By using machine learning methods to model user and entity behavior and identify risk points,UEBA can address unknown threats that are difficult to detect,and enhance the defense of enterprise networks.This paper introduces the development history of UEBA,and discusses its applications in statistical learning,deep learning and reinforcement learning.Then the paper presents the studies of typical UEBA algorithms,and gives comparative analysis of their performance.The paper also describes several commonly used public datasets,feature engineering methods,and two feature processing methods that enhance the accuracy of behavior representation.On this basis,this paper summarizes the advantages and disadvantages of typical anomaly detection algorithms,and the limitations of internal threat analysis and external intrusion detection.Finally,the future research directions in this field are discussed.

关 键 词：网络安全 用户与实体行为分析 异常检测 统计学习 深度学习 强化学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]