TW202036341A - Device and method for detecting abnormal operation behavior wherein the device includes a personnel database, an operation record database, a recording module, a communication module, and a processing module - Google Patents

Abstract

A device for detecting abnormal operation behavior is disclosed. The device includes a personnel database, an operation record database, a recording module, a communication module, and a processing module. The recording module detects and receives operation events from a user device to record a data code of the operation event and personnel data corresponding to the user's code to the operation record database. The processing module analyzes and retrieves personnel codes determined to be abnormal operation behaviors according to multiple operation records, and transmits the personnel codes to an administrator through the communication module.

Description

Device for detecting abnormal operation behavior

The present invention relates to a device for detecting abnormalities, in particular to a device capable of detecting abnormalities based on operation patterns.

With the current introduction of more and more work processes into electronic organizations, internal information systems have become increasingly large. Based on the consideration of simplified account management, centralized account management systems are generally used, such as Active Directory, NIS.. . And so on, in order to centrally manage each user account.

The centralized account management system mainly provides an account application channel and stores all accounts in the account database to verify the legitimacy of the accounts used by users. However, the traditional centralized account management system can only perform centralized management and legality verification for authorized accounts. Unauthorized accounts cannot be discovered and blocked in time. Therefore, it cannot maintain the confidentiality, integrity, and integrity of corporate resources in terms of information security. And availability.

Therefore, in order to avoid threats to corporate resource information security by unauthorized accounts in account management, first of all, each user must be linked to his actions and make him responsible for his actions. In order to achieve this goal, each user must be required to use a unique set of account and password to use the company's internal host system resources, that is, single account management.

In addition to account management, what is more important is the operational behavior in the process of using the account, such as a large number of deletions of data, intent to cause damage and other improper behavior. .

For this reason, the applicant, in view of the shortcomings of conventional technology, invented the "device for detecting abnormal operation behavior" in this case to improve the aforementioned shortcomings.

In order to overcome the problems existing in the prior art, the present invention provides a device for detecting abnormal operation behavior, which mainly includes a personnel database, an operation log database, a recording module, a communication module, and a processing module. The recording module detects and receives the operation event from the user equipment to record the data code and the personnel data corresponding to the personnel code in the operation event to the operation record database. The processing module summarizes the code of the person judged to have abnormal behavior based on a plurality of operation records, and transmits the code of the person with abnormal behavior to the administrator through the communication module.

The device for detecting abnormal operation behavior provided by the present invention proposes a device that can summarize other persons with the same nature based on the persons who have been browsed during browsing, so as to quickly find other persons worth seeing and avoid users It took a lot of time and energy to find these recommended personnel.

5‧‧‧User equipment

10‧‧‧Detecting abnormal operation behavior device

101‧‧‧Personnel Database

102‧‧‧Operation record database

103‧‧‧Record Module

104‧‧‧Communication Module

105‧‧‧Processing Module

The first figure shows a system schematic diagram of a specific embodiment of the device for detecting abnormal operation behaviors of the present invention.

The present invention will be advanced through the following preferred embodiments and their matching drawings Detailed instructions in one step.

It should be noted that the communication module 104 is a combination of software and hardware.

Refer to the first figure, which shows a system schematic diagram of a specific embodiment of the operation behavior device for detecting abnormality according to the present invention. The device 10 for detecting abnormal operation behavior and the personnel database 101 storing plural personnel data can transmit information to each other through unspecified communication means, and the device 10 for detecting abnormal operation behavior includes at least a personnel database 101, an operation record database 102, A communication module 104 for receiving user input from the user equipment 5 and a recording module 103 for recording browsing behaviors.

Each personnel data in the personnel database 101 has a personnel code and a plurality of personnel attributes to which the personnel code belongs, and the plural personnel attributes include at least abnormal, normal, and pending determination. The personnel code with abnormal personnel attributes is determined to be abnormal by the system, while the pending determination is close to the abnormal threshold, but has not yet fully reached the abnormal threshold. That is to say, 80% of the abnormal threshold value, for example, will be judged as pending. If the personnel attribute is abnormal, the corresponding personnel code will no longer be able to log in to the system, nor can it enter the system to perform various operations. Personnel attributes are normal and to be determined, and the relative personnel code will be able to log in to the system, but the personnel code to be determined will be more stringent in judging abnormal behavior.

In order to make the above abnormal judgment, it is necessary to record the relative operation behavior and set the threshold value for judgment. The operation record database 102 stores a plurality of operation records. The recording module 103 is coupled to the personnel database 101 and the operation record database 102, and is used to detect and receive operation events from the user equipment 5. The operation event includes the data code and the personnel code to record the operation event The data code and the personnel data corresponding to the personnel code are stored in the operation record database 102.

Each operation record is the personnel code, operation status, and operation time corresponding to the data code. The operation status includes at least addition, deletion, and modification. The addition, deletion, or modification of this operation state has priority, and the higher the priority, the more abnormal the priority is. For example, if the priority of deletion is higher than that of modification and addition, the system finds that the number or frequency of deletion is not high, even if the number or frequency of addition or modification is quite high, the system Still will not judge the relative personnel code as abnormal.

The user equipment 5 exchanges data with the abnormal operation behavior device 10 provided by the present invention through the Internet. Specifically, the presentation module (not shown) transmits the screen to be presented to the user equipment 5 for presentation through the communication module 104, and the information operated by the user in the various screens presented by the presentation module is The communication module 104 receives and further transmits the information to related modules, but this does not mean that the abnormal operation behavior device 10 of the present invention must include a presentation module. The aforementioned user equipment 5 may be a desktop computer, a notebook computer, a tablet computer, or a smart phone.

To put it simply, when the user uses the functions provided by the user equipment 5 to browse the system to log in and perform operations, the recording module 103 will detect and receive operation events from the client device. Since the operation event includes the data code and the personnel code, the data code and the personnel data corresponding to the personnel code in the operation event can be recorded in the operation record database 102. The processing module 105 summarizes the personnel code determined to have abnormal behavior based on a plurality of operation records, and transmits the personnel code of the abnormal behavior to the administrator through the communication module 104.

For example, when the user uses the user equipment 5 to operate, The user device 5 will list the operation result of the user's operation (may be one of adding, deleting or modifying), and an operation event will be triggered, so that the recording module 103 will use the data code and the data in the operation event The personnel data corresponding to the personnel code is stored in the operation record database 102.

Furthermore, when the processing module 105 judges the personnel code with abnormal behavior, the main problem is that the number of additions, deletions, or modifications in the operating state of the specific personnel code exceeds the threshold. For example, when the number of deletions exceeds 100 times, the processing module 105 determines that the person code has abnormal behavior. However, the user may deliberately delete data in batches at different times to avoid system monitoring. Therefore, the processing module 105 can also determine that the person code with abnormal behavior is related to the operation state of the person code. The number of additions, deletions, or modifications exceeds the threshold within the reservation time. However, the operation behavior that needs to be monitored is likely to only be deleted, so the person code determined to have abnormal behavior is the deletion in the operation state that is only related to the person code.

The present invention is disclosed with the above-mentioned preferred embodiments and examples as references, and readers should understand that these examples are for description rather than limitation. Anyone who is familiar with this technique can make various combinations and modifications without departing from the spirit and scope of the present invention, and it should still fall within the scope of the patent of the present invention.

5‧‧‧User equipment

10‧‧‧Detecting abnormal operation behavior device

101‧‧‧Personnel Database

102‧‧‧Operation record database

103‧‧‧Record Module

104‧‧‧Communication Module

105‧‧‧Processing Module

Claims (10)

An operation behavior device for detecting abnormalities, including: a personnel database storing plural personnel data, each personnel data has a personnel code and a plurality of personnel attributes to which the personnel code belongs, and the plural personnel attributes include at least anomalies, Normal and pending an operation record database, configured to store a plurality of operation records, each operation record is the person code, an operation state, and an operation time corresponding to a data code. The operation state includes at least new Add, delete, modify; a record module, coupled to the personnel database and the operation record database, and used to detect and receive an operation event from a user equipment, the operation event includes the data code, the person Code to record the data code in the operation event and the personnel data corresponding to the personnel code to the operation record in the operation record database; a communication module; and a processing module, coupled to the communication module, The operation record database is configured to summarize the personnel code determined to have abnormal behavior based on a plurality of operation records, and transmit the personnel code of the abnormal behavior to an administrator through the communication module. For example, the abnormal operation behavior detection device described in item 1 of the scope of patent application, wherein the code of the person judged to have abnormal behavior is that the number of times of addition, deletion or modification in the operation state related to the person code exceeds one Threshold value. For the abnormal operation behavior detection device described in item 1 of the scope of patent application, the person code determined to have abnormal behavior is the number of times of addition, deletion, or modification in the operation state related to the person code. A threshold is exceeded within the booking time. For the abnormal operation behavior detection device described in item 2 of the scope of patent application, the person code determined to have abnormal behavior is the deletion in the operation state only related to the person code. For example, in the operation behavior device for detecting abnormality described in item 2 of the scope of patent application, the addition, deletion, or modification of the operation state has a priority, and the higher the priority, the more abnormal the priority is. A method for detecting abnormal operation behaviors includes: detecting and receiving an operation event from a user equipment, the operation event including a data code and a personnel code, to record the data code and the personnel code in the operation event The corresponding personnel data becomes an operation record. Each personnel data has the personnel code and multiple personnel attributes to which the personnel code belongs. The plural personnel attributes include at least abnormal, normal, and pending determination, and each operation record It is the personnel code, an operating state, and an operating time corresponding to a data code. The operating state includes at least addition, deletion, and modification; and based on a plurality of operation records, summarizing the abnormal behavior The personnel code, and the abnormal behavior of the personnel code is transmitted to an administrator through the communication module. For example, the method for detecting abnormal operation behavior described in item 6 of the scope of patent application, wherein the code of the person judged to have abnormal behavior is that the number of times of addition, deletion or modification in the operation state related to the code of the person exceeds one Threshold value. For example, in the method for detecting abnormal operation behavior described in item 6 of the scope of patent application, the code of the person judged to have abnormal behavior is the number of times of addition, deletion, or modification in the operation state related to the person code. A threshold is exceeded within the booking time. For the abnormal operation behavior detection device described in item 7 of the scope of patent application, the person code determined to have abnormal behavior is a deletion in the operation state only related to the person code. For example, the operation behavior method for detecting abnormality described in item 7 of the scope of patent application, wherein the addition, deletion or modification of the operation state has a priority, and the higher the priority, the more abnormality will be prioritized.

Images