CN111597549A - A method and system for identifying network security behavior based on big data - Google Patents

Abstract

The invention discloses a network security behavior recognition method and system based on big data in the technical field of network security management, and aims to solve the technical problems that the risk behavior criterion is formulated in the prior art, a blacklist is manually configured mainly by operation and maintenance personnel, scientific basis is not available, possible risk behaviors cannot be exhausted, obvious limitation exists, and the safety of a power system is not guaranteed. The method comprises the following steps: constructing a normal behavior model based on historical data; and identifying the behaviors of the user based on the normal behavior model, and generating corresponding risk levels, wherein the risk levels comprise high-risk behaviors.

Description

A method and system for identifying network security behavior based on big data

technical field

The invention relates to a big data-based network security behavior identification method and system, and belongs to the technical field of network security management.

Background technique

In the network security management platform, in order to avoid wrong operation or unauthorized operation by users, it is necessary to use the monitoring device to judge the collected operation log according to the risk behavior criterion, to confirm whether the corresponding operation behavior is a risk behavior, so as to take corresponding protection. measure.

At present, the establishment of risk behavior criteria is mainly through the manual configuration of blacklists by operation and maintenance personnel. Most of the blacklists are set by factory defaults or set by operation and maintenance personnel based on personal experience. There is no scientific basis, and the possible risk behaviors cannot be exhausted. There are obvious limitations, which are not conducive to ensuring the safety of the power system.

SUMMARY OF THE INVENTION

In view of the deficiencies of the prior art, the purpose of the present invention is to provide a method and system for identifying network security behaviors based on big data, so as to solve the problem that in the prior art, the method of formulating risk behavior criteria is mainly through the manual configuration of blacklists by operation and maintenance personnel. There is no scientific basis, and at the same time, the possible risk behaviors cannot be exhausted, and there are obvious limitations, which are not conducive to the technical problems of ensuring the safety of the power system.

For solving the above-mentioned technical problems, the technical scheme adopted in the present invention is:

A method for identifying network security behaviors based on big data, comprising the following steps:

Build a normal behavior model based on historical data;

The user's behavior is identified based on the normal behavior model, and a corresponding risk level is generated, where the risk level includes high-risk behaviors.

Further, the construction method of the normal behavior model includes K-means algorithm and SVM algorithm.

Further, build a normal behavior model based on historical data, including:

Collect user behavior historical data and build a user behavior database;

Perform association analysis on the user behavior database to construct a user identity-based behavior data collection;

Abstracting the behavior data set, extracting the basic feature values of the user's daily behavior, and constructing a user behavior feature set based on user identity;

Combined with the authorization information of user roles, cluster analysis is performed on no less than two behavior feature sets, and a user behavior benchmark feature library based on user roles is constructed.

Further, the user's behavior is identified based on the normal behavior model, including:

The user's behavior is compared with the user behavior benchmark feature database to determine the user's role category.

Further, the user's behavior includes the operation directory or/and the operation command; the user's behavior is identified based on the normal behavior model, and also includes:

The user's behavior is compared with the user behavior database, and if the user's behavior does not conform to any operation catalogue or/and operation command in the user behavior database, it is determined as a high-risk behavior.

Further, identifying the user's behavior based on the normal behavior model also includes:

The user's behavior is compared with the authorization information corresponding to the determined role category. If the user's behavior exceeds the authorization information corresponding to the determined role category, it is determined as a high-risk behavior.

Further, identifying the user's behavior based on the normal behavior model further includes: performing outlier analysis on the user's behavior based on the determined role category, and determining the risk level according to the analysis result.

Further, the user behavior includes user behavior in the power monitoring system.

In order to achieve the above purpose, the present invention also provides a network security behavior identification system based on big data, including:

Normal behavior model building module: used to build a normal behavior model based on historical data;

Risk level generation module: used to identify the user's behavior based on the normal behavior model, and generate a corresponding risk level, where the risk level includes high-risk behaviors.

Further, the user's behavior includes an operation directory or/and an operation command, and the risk level generation module includes:

Role category determination sub-module: used to compare the user's behavior with the user behavior benchmark feature library to determine the user's role category;

Risk level determination sub-module: used to compare the user's behavior with the user behavior database. If the user's behavior does not conform to any operation catalogue or/and operation command in the user behavior database, it is determined as a high-risk behavior; Compare with the authorization information corresponding to the determined role category. If the user's behavior exceeds the authorization information corresponding to the determined role category, it is determined as a high-risk behavior; based on the determined role category, the user's behavior is analyzed for outliers , according to the analysis results to determine the risk level.

Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the method and system of the present invention use a combination of K-means algorithm and SVM algorithm to carry out big data machine learning, and make full use of the SVM algorithm to compare the classification effects of multiple data sets. Excellent features, and at the same time, some optimizations are made on the original basis. Through big data machine learning, a normal behavior model is constructed based on historical data, and then the model automatically discriminates and classifies the user's network security behavior. At the same time, it continuously learns and adjusts according to the characteristics of the power monitoring system, which significantly improves the production efficiency and simplifies the operation difficulty. , reducing the work of the relevant personnel of the power monitoring system, which is conducive to ensuring the safe operation of the power system.

Detailed ways

The present invention will be further described below in conjunction with the examples. The following examples are only used to illustrate the technical solutions of the present invention more clearly, and cannot be used to limit the protection scope of the present invention.

The specific embodiment of the present invention provides a network security behavior identification method based on big data, and the method of the present invention performs security analysis based on two aspects of business scenarios and historical data. Among them, security analysis based on business scenarios mainly defines and collects user behaviors, and analyzes users' daily reasonable behaviors based on historical data and builds a normal behavior model. Based on this normal behavior model, real-time analysis of user behaviors is performed to monitor abnormal behaviors. .

The method of the present invention mainly comprises the following steps:

1. Behavior Definition

Research the user behavior data in the power monitoring system, define which data is related to the user behavior, and determine the format and content range of the user behavior data.

2. Data collection

Combined with the logs or audit records of the business application system, determine the scope of user behavior data collection, collect the relevant user behavior data in the host server, database server, network equipment and security equipment through the data collection function of the network security management platform, and conduct preliminary classification Organized to form a user behavior database.

3. Data association

Using the data association technology based on data mining, the user behavior database is subjected to data mining-based association analysis based on the relevant information of the user identity, and the behavior data set of each user is aggregated and constructed, that is, the behavior data set is based on the user identity.

4. Feature extraction

The user behavior in each user's behavior data set is abstracted, the basic feature values of the user's daily behavior are extracted, and a user behavior feature set is constructed for each user.

5. Build the model

Combined with user authorization information, cluster analysis is performed on the user historical behavior feature values of the same category (role), and a user behavior benchmark feature library based on role division is constructed.

6. Classification assessment

Based on the role-based user behavior benchmark feature library, the current user behavior set is analyzed in real time, the role category to which it belongs is determined, and the reliability of the classification is evaluated for security.

7. Anomaly Analysis

Combined with business application scenarios, outlier analysis is performed on user behavior, and abnormal behavior monitoring based on user behavior model is realized.

In this embodiment, the user's behavior includes an operation directory and operation commands in the corresponding directory, and the risk level of the user's behavior is divided into four levels, namely: level 1 user behavior (risk-free behavior, green alert), level 2 User behavior (low risk behavior, yellow alert), level 3 user behavior (medium risk behavior, orange alert), level 4 user behavior (high risk behavior and abnormal behavior, red alert). Specific examples are as follows:

Level 1 User Behavior

Operate in the "/home" directory, the operation content is: the command only includes "ls, cd, ifconfig, netstat, ping", only searches for files, IP, ports, and tests the network connection operation;

Level 2 User Behavior

Operate in the "/opt or /usr or /etc or /var or /proc or /tmp" directory, the operation content is: do any operation command;

Level 3 User Behavior

(1) Operate in the "/home" directory, the operation content is: command "rm, cp, su, passwd, chown";

(2) The operation in the "/root" directory and the "/" operation, the operation content is: command "ls, cd, ifconfig, netstat, ping";

Level 4 User Behavior

(1) In the "/root" directory and the "/" operation, the operation content is: the input commands include the commands "rm, pwd, reboot, pkill, su, chown", delete files, change passwords, restart the system, terminate processes, modify permissions and other operations;

(2) Does not conform to any historical data or historical operation catalog;

(3) Implement the super-authorized instruction operation.

The risk level of the user's behavior is all judged in the aforementioned step 7, and when the above-mentioned judgment requirements on the risk level are met, the corresponding risk level is judged. in,

For the situation (2) in the user behavior of level 4, the judging process is as follows: compare the user behavior with the user behavior database, if the user behavior does not conform to any operation catalogue or/and operation command in the user behavior database, it is determined as high-risk behavior.

In the case (3) of level 4 user behavior, the judging process is as follows: compare the user's behavior with the authorization information corresponding to the determined role category, and determine if the user's behavior exceeds the authorization information corresponding to the determined role category. high-risk behavior.

More specifically, the aforementioned normal behavior model is constructed using the K-means algorithm. The K-means algorithm is a typical distance-based clustering algorithm, and the distance is used as the similarity evaluation index, that is, the closer the distance between two objects, the greater the similarity. Euclidean distance or cosine angle are often used when calculating distance. K represents the number of target clusters, means represents the mean, and K-means is an algorithm for clustering data points by the mean.

The K-means algorithm is divided into two steps: cluster assignment and moving cluster centers:

1) Randomly select k objects, each representing the mean of a cluster. For each remaining object, it is assigned to the nearest cluster based on its distance from the respective cluster center.

2) Recalculate the mean for each cluster. This process is repeated until the criterion function E converges, that is, the cluster centers no longer change significantly.

Usually, the error sum of squares criterion function E is used as a performance measure. The criterion function represents the sum of the distances from all sample points to the mean vector of their respective clusters. The smaller the E value, the higher the similarity of the sample values in the cluster. The minimization criterion function E is a nondeterministic polynomial (NP) problem, and the clustering algorithm can be regarded as a coordinate ascent algorithm, that is, by fixing one variable, adjusting another variable, and continuously adjusting through an iterative process, and finally get the local optimal solution.

After the clustering is completed, the data is converted from unlabeled data to labeled data, which satisfies the training data characteristics of supervised learning. For classification prediction, first of all, it is necessary to divide the training set and the test set, and it is necessary to ensure that the distribution of sample categories in the training set is as consistent as possible with the distribution of sample categories in the test set, otherwise it will affect the evaluation of the model. At the same time, the proportion of sample categories should be kept balanced, and the imbalance of the proportion of sample categories will lead to over-fitting or under-fitting of the model obtained by training. Therefore, in the initial stage of the sample training and test set, it is necessary to ensure that:

1) The proportions of the data sets where the sample categories in the training set and the test set are located are as consistent as possible;

2) The proportions of all categories in the samples in the dataset are kept as balanced as possible. Since Support Vector Machine (SVM) has excellent performance on many data sets, it is a typical hyperplane classifier, and its basic principles are as follows:

为客户输入数据，其中x是一个d维的向量用

来表示；Assume

Enter data for customers, where x is a d-dimensional vector with

To represent;

为映射规则，{c₁,...,c_k}为各个分类平面集合；c_k*＝C_w(x)为分类结果，其中k^*∈{1,..,k}，

为x基于模型w对应的分类结果。

is the mapping rule, {c ₁ ,...,c _k } is the set of each classification plane; c _k* =C _w (x) is the classification result, where k ^* ∈{1,..,k},

is the classification result corresponding to x based on model w.

The calculation process of the hyperplane is as follows:

(1) Preliminarily calculate the classification accuracy of the training samples, which is realized by the fitness function. The larger the fitness, the more reliable the SVM classification is. The fitness function is:

In the formula, just is the fitness value, d _i and d _j respectively represent the average distance from the classification to the respective plane, and d _max is the maximum distance in any two dissimilar classifications.

(2) The weight formula is added on the basis of the classification accuracy, as follows:

In the formula, weight is the weight value, n represents the number of classifications, and b represents the constant in the polynomial expression in the classification criteria. Calculate the weight of each feature, and remove some features with smaller weights.

(3) Class matching algorithm to find out the classification. The weight formula in the above is the coefficient of the matching algorithm, and the distance factor is added to the matching algorithm, as follows:

In the formula, α is the distance factor, md _i is the average distance, and the average distance is the mean of each point in the classification to the classification plane, using one of the arithmetic mean, geometric mean, square mean, harmonic mean, and weighted mean. One or more, _ci is the distance from the point to the classification plane.

For the distance of unknown samples in different classification planes, the calculation formula is as follows:

In the formula, d _ik is the distance from each point in the k classification to the classification plane, and weight _k is the weight coefficient in the kth classification. Find the k value when the distance is the largest, that is, to find the classification.

The specific embodiment of the present invention also provides a network security behavior recognition system based on big data. The system of the present invention is used to implement the aforementioned inventive method, and the system includes:

Normal behavior model building module: used to build a normal behavior model based on historical data;

Risk level generation module: used to identify the user's behavior based on the normal behavior model, and generate a corresponding risk level, where the risk level includes high-risk behaviors. Specifically, it includes the following sub-modules:

Role category determination sub-module: used to compare the user's behavior with the user behavior benchmark feature library to determine the user's role category;

Risk level determination sub-module: used to compare the user's behavior with the user behavior database. If the user's behavior does not conform to any operation catalogue or/and operation command in the user behavior database, it is determined as a high-risk behavior; Compare with the authorization information corresponding to the determined role category. If the user's behavior exceeds the authorization information corresponding to the determined role category, it is determined as a high-risk behavior; based on the determined role category, the user's behavior is analyzed for outliers , according to the analysis results to determine the risk level.

The above are only the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the technical principle of the present invention, several improvements and modifications can also be made. These improvements and modifications It should also be regarded as the protection scope of the present invention.

Claims (10)

1. a network security behavior identification method based on big data, is characterized in that, comprises the steps: Build a normal behavior model based on historical data; The user's behavior is identified based on the normal behavior model, and a corresponding risk level is generated, where the risk level includes high-risk behaviors. 2 . The big data-based network security behavior identification method according to claim 1 , wherein the construction method of the normal behavior model comprises K-means algorithm and SVM algorithm. 3 . 3. the network security behavior identification method based on big data according to claim 1, is characterized in that, builds normal behavior model based on historical data, comprises: Collect user behavior historical data and build a user behavior database; Perform association analysis on the user behavior database to construct a user identity-based behavior data collection; Abstracting the behavior data set, extracting the basic feature values of the user's daily behavior, and constructing a user behavior feature set based on user identity; Combined with the authorization information of user roles, cluster analysis is performed on no less than two behavior feature sets, and a user behavior benchmark feature library based on user roles is constructed. 4. the network security behavior identification method based on big data according to claim 3, is characterized in that, the behavior of user is identified based on normal behavior model, comprising: The user's behavior is compared with the user behavior benchmark feature database to determine the user's role category. 5. The method for identifying network security behavior based on big data according to claim 4, wherein the user's behavior includes an operation directory or/and an operation command; the user's behavior is identified based on a normal behavior model, further comprising: The user's behavior is compared with the user behavior database, and if the user's behavior does not conform to any operation catalogue or/and operation command in the user behavior database, it is determined as a high-risk behavior. 6. The network security behavior identification method based on big data according to claim 4, is characterized in that, based on normal behavior model, the behavior of user is identified, also comprising: The user's behavior is compared with the authorization information corresponding to the determined role category. If the user's behavior exceeds the authorization information corresponding to the determined role category, it is determined as a high-risk behavior. 7. The network security behavior identification method based on big data according to claim 4, wherein the behavior of the user is identified based on the normal behavior model, and further comprising: the behavior of the user is outlier based on the determined role category Point analysis, according to the analysis results to determine the risk level. 8 . The method for identifying network security behaviors based on big data according to claim 1 , wherein the user behaviors include user behaviors in a power monitoring system. 9 . 9. A network security behavior identification system based on big data, characterized by comprising: Normal behavior model building module: used to build a normal behavior model based on historical data; Risk level generation module: used to identify the user's behavior based on the normal behavior model, and generate a corresponding risk level, where the risk level includes high-risk behaviors. 10. The big data-based network security behavior identification system according to claim 9, wherein the user's behavior includes an operation directory or/and an operation command, and the risk level generation module includes: Role category determination sub-module: used to compare the user's behavior with the user behavior benchmark feature library to determine the user's role category; Risk level determination sub-module: It is used to compare the user's behavior with the user behavior database. If the user's behavior does not conform to any operation catalogue or/and operation command in the user behavior database, it is determined as a high-risk behavior; Compare with the authorization information corresponding to the determined role category. If the user's behavior exceeds the authorization information corresponding to the determined role category, it is determined as a high-risk behavior; based on the determined role category, the user's behavior is analyzed for outliers , according to the analysis results to determine the risk level.