基于用户实体行为分析与人工智能的数据安全审计管理系统研究  

Design of data audit and security management system based on UEBA and AI

作　　者：薛亮 汪含笑 胡晓波 韩海庭 XUE Liang;WANG Hanxiao;HU Xiaobo;HAN Haiting(China Mobile Communications Group Jiangsu Co.,Ltd.,Nanjing 210029,China;Security Research Institute,China Academy of Information and Communications Technology,Beijing 100191,China;First Research Institute of the Ministry of Public Security,Beijing 100010,China;Intelligent IoT Laboratory,Zhejiang Ocean University,Zhoushan 316000,China)

机构地区：[1]中国移动通信集团江苏有限公司,南京210029 [2]中国信息通信研究院安全研究所,北京100191 [3]公安部第一研究所,北京100010 [4]浙江海洋大学海天智能物联网实验室,舟山316000

出　　处：《信息通信技术与政策》2024年第12期73-81,共9页Information and Communications Technology and Policy

摘　　要：基于用户实体行为分析数据安全审计管理系统,为应对企业内外部数据安全威胁提供了新的解决方案。通过对用户、设备和应用的行为进行持续监控,建立动态基线,并实时分析异常行为,有效识别潜在威胁。提出了包含实体、行为、基线和算法为核心4要素,以及数据采集、行为分析和处置响应为3步骤的框架系统,展示了如何将人工智能增强的用户实体行为分析构建智能化的数据安全审计体系,以增强数据保护能力和合规性。A data auditing and security management system based on user and entity behavior analysis offers an innovative solution to address internal and external data security threats in enterprises.By continuously monitoring the behaviors of users,devices,and applications,the system establishes dynamic baselines and performs real-time anomaly detection to identify potential threats effectively.This paper proposes a framework centered on four key elements—entities,behaviors,baselines,and algorithms—along with a three-step process comprising data collection,behavior analysis,as well as response and handling.It demonstrates how artificial intelligence-enhanced user and entity behavior analysis(UEBA)can be used to construct an intelligent data security auditing system,strengthening data protection capabilities and ensuring compliance.

关 键 词：用户实体行为分析 人工智能 数据安全 数据审计 

分 类 号：TP393[自动化与计算机技术—计算机应用技术] TP309.2[自动化与计算机技术—计算机科学与技术]