两步内部用户威胁活动识别和分析策略  

Two-step Insider User Threat Activity Identification and Analysis Strategy

作　　者：范艺璇 阚秀[1] 曹乐 王夏霖 FAN Yi-xuan;KAN Xiu;CAO Le;WANG Xia-lin(School of Electronic and Electrical Engineering,Shanghai University of Engineering Science,Shanghai 201620,China)

机构地区：[1]上海工程技术大学电子电气工程学院,上海201620

出　　处：《小型微型计算机系统》2023年第6期1266-1273,共8页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(61703270)资助;科技创新2030-“新一代人工智能”重大项目(2020AAA0109301)资助.

摘　　要：由于内部人员具有访问组织内部资源的权限,其行为出现漏洞或故意威胁所产生的影响对组织而言可能是巨大的损失.因此,内部人员威胁行为研究对保障系统安全具有重要价值.针对大量内部威胁行为的具体识别,本文提出了一种两步用户威胁行为活动分析识别策略.首先,利用粒子群优化(Particle Swarm Optimization,PSO)算法优化具有噪声的基于密度的聚类方法(Density-Based Spatial Clustering of Applications with Noise,DBSCAN)来实现对偏离正常模式的离群点的精准查找.第2步,建立多特征权重联合评估策略,基于上一步的离群点分析结果,采用多指标评价方法实现对用户威胁行为的识别.实验结果表明,所提PSO-DBSCAN算法能更好地缩减初步离群点,并在特征约简后行为活动识别准确率最高达到99.58%,对威胁活动的识别具有有效性.As insiders have access to the internal resources of the organization,the impact of loopholes or intentional threats in their behavior may be a huge loss to the organization.Therefore,the research on insider threat behavior is of great value to ensure system security.For the specific identification of a large number of insider threat behaviors,this paper proposes a two-step user threat behavior activity analysis and identification strategy.Firstly,Particle Swarm Optimization(PSO)algorithm is used to optimize the Density-Based Spatial Clustering of Applications with Noise(DBSCAN)to accurately find outliers that deviate from the normal mode.The second step is to establish a multi-feature weight joint evaluation strategy.Based on the outlier analysis results in the previous step,the multi-indicator evaluation method is utilized to identify the user threat behavior.Experimental results show that the proposed PSO-DBSCAN algorithm can better reduce the initial outliers,and the highest accuracy of behavior activity recognition after feature reduction is 99.58%,which is effective for threat activity recognition.

关 键 词：内部威胁 离群点检测 粒子群算法 特征权重 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]