TWI823657B - Monitoring system and monitoring method for abnormal behavior of user equipment - Google Patents

Abstract

A monitoring system and a monitoring method for an abnormal behavior of a user equipment are provided. The method includes: obtaining a first network traffic of a first user equipment and generating a domain white list corresponding to the first user equipment according to the first network traffic; obtaining a first current network traffic of the first user equipment and determining a access behavior of the first user equipment to a first domain according to the first current network traffic; in response to the first domain not being in the domain white list, determining whether the first user equipment is abnormal according to the access behavior; and in response to the first user equipment being abnormal, outputting an alarm message.

Description

Monitoring system and method for monitoring abnormal behavior of user equipment

The present invention relates to a monitoring system and a monitoring method for abnormal behavior of user equipment.

Since internal users have legal access rights to the system, it is difficult for today's common security information and event management and monitoring platforms that use correlation rules to effectively detect threats from internal users. Therefore, effectively monitoring users' networking behavior to prevent internal user threats and advanced persistent threats is an important issue to ensure corporate security and avoid leakage of corporate intelligence. In addition, a large number of 5G end-user devices are deployed in different enterprise private network fields. Automatic and dynamic detection of abnormal user equipment is bound to be an important trend in the future.

The present invention provides a monitoring system and method for monitoring abnormal behavior of user equipment, which can automatically analyze current network traffic and send out warning messages when user equipment is abnormal.

The present invention provides a monitoring system for abnormal behavior of user equipment, including a transceiver and a processor. The processor is coupled to the transceiver, wherein the processor is configured to perform: obtain first network traffic of the first user equipment through the transceiver, and generate a network domain whitelist corresponding to the first user equipment according to the first network traffic; Obtain the first current network traffic of the first user equipment through the transceiver, and determine the access behavior of the first user equipment to the first network domain based on the first current network traffic; in response to the fact that the first network domain is not in the network domain whitelist In the method, it is determined whether the first user equipment is abnormal according to the access behavior; and in response to determining that the first user equipment is abnormal, a warning message is output through the transceiver.

In an embodiment of the present invention, the above-mentioned processor is further configured to: input parameters in the first network traffic into the machine learning model to generate a network domain whitelist.

In an embodiment of the present invention, the above parameters include a user equipment identification code of the first user equipment, a network domain identification code of the first network domain, and a first rating of the first network domain by the first user equipment.

In an embodiment of the present invention, the above-mentioned processor is further configured to perform: counting a plurality of access times according to the first user equipment, wherein the plurality of access times respectively correspond to multiple network domains, and the multiple network domains Including the first domain; and calculating the percentage rank (Percentile Rank, PR) of the first domain based on multiple access times to generate the first score.

In an embodiment of the present invention, the above-mentioned processor is further configured to perform: training a machine learning model according to a loss function based on collaborative filtering, wherein the loss function based on collaborative filtering is associated with The correlation between user device identifiers, the correlation between domain identifiers, and the user device's rating of the domain.

In an embodiment of the present invention, the above-mentioned processor is further configured to perform: converting the first user equipment identification code into a first embedding vector (embedding vector), and converting the second user equipment identification code into a second embedding vector. vector; and calculating the distance between the first embedding vector and the second embedding vector to obtain the correlation between user identification codes.

In an embodiment of the present invention, the above-mentioned access behavior includes the number of accesses, and the above-mentioned processor is further configured to perform: in response to the number of accesses being greater than the threshold, determining that the first user equipment is abnormal.

In an embodiment of the present invention, the above-mentioned access behavior includes a first access count, and the above-mentioned processor is further configured to perform: obtain the current network traffic of each of the user equipment sets, wherein the user equipment set including a first user equipment; counting the number of accesses of each user equipment set to the first network domain according to the current network traffic, and calculating the average number of accesses based on the number of accesses; and responding to the first number of accesses and If the ratio of the average access times is greater than the threshold, it is determined that the first user equipment is abnormal.

In an embodiment of the present invention, the above-mentioned access behavior includes the amount of uploaded data, and the above-mentioned processor is further configured to perform: in response to the amount of uploaded data being greater than the threshold, determining that the first user equipment is abnormal.

In an embodiment of the present invention, the above-mentioned processor is further configured to perform: recording the first user equipment in one of multiple monitoring lists according to the access behavior, wherein the multiple monitoring lists respectively correspond to multiple Period; count multiple monitoring names The list includes the number of at least one monitoring list of the first user equipment; and in response to the number being greater than the threshold, determining that the first user equipment is abnormal.

A method of monitoring abnormal behavior of user equipment of the present invention includes: obtaining the first network traffic of the first user equipment, and generating a network domain whitelist corresponding to the first user equipment based on the first network traffic; obtaining the first network traffic of the first user equipment. the first current network traffic of the user equipment, and determine the access behavior of the first user equipment to the first network domain based on the first current network traffic; in response to the first network domain not being in the network domain whitelist, based on the access behavior Determine whether the first user equipment is abnormal; and in response to determining that the first user equipment is abnormal, output a warning message.

Based on the above, the monitoring system of the present invention can obtain the network domain whitelist of the first user equipment according to the machine learning model trained based on the loss function of collaborative filtering (Collaborative Filtering). Different from the previous methods of grouping and outliers, the present invention can quickly find abnormal user equipment from the network connection records of a large number of 5G user equipment by comparing the network domain whitelist and the access behavior of the first user equipment, and Send a warning signal. The present invention can provide abnormal user equipment to information security managers for analysis to find potential malicious attacks or activities, thereby improving enterprise security.

100:Monitoring system

110: Processor

120:Storage media

130:Transceiver

S201, S202, S203, S204, S205, S206, S207, S301, S302, S303, S304: steps

FIG. 1 is a schematic diagram of a monitoring system for abnormal behavior of user equipment according to an embodiment of the present invention.

Figure 2 illustrates an abnormal behavior of a user equipment according to an embodiment of the present invention. Flowchart of the method.

FIG. 3 illustrates a flow chart of a method for monitoring abnormal behavior of user equipment according to an embodiment of the present invention.

FIG. 1 illustrates a schematic diagram of a monitoring system 100 for abnormal behavior of user equipment according to an embodiment of the present invention. Monitoring system 100 may include processor 110, storage media 120, and transceiver 130.

The processor 110 is, for example, a central processing unit (CPU), or other programmable general-purpose or special-purpose micro control unit (MCU), microprocessor, or digital signal processing unit. Digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processing unit (GPU), image signal processor (ISP) ), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), field programmable gate array (field programmable gate array) , FPGA) or other similar components or a combination of the above components. The processor 110 may be coupled to the storage medium 120 and the transceiver 130 .

The storage medium 120 is, for example, any type of fixed or removable random access memory (RAM) or read-only memory. (read-only memory, ROM), flash memory (flash memory), hard disk drive (HDD), solid state drive (SSD) or similar components or a combination of the above components, and are used for Multiple modules or various application programs that can be executed by the processor 110 are stored to implement the method of monitoring abnormal behavior of user equipment of the present invention.

The transceiver 130 transmits and receives signals in a wireless or wired manner. Transceiver 130 may also perform, for example, low noise amplification, impedance matching, mixing, up or down frequency conversion, filtering, amplification, and similar operations.

FIG. 2 illustrates a flow chart of a method for abnormal behavior of user equipment according to an embodiment of the present invention, wherein the method can be implemented by the monitoring system 100 shown in FIG. 1 . In step S201, the processor 110 may receive first network traffic of the first user equipment through the transceiver 130. The processor 110 may perform feature extraction on the first network traffic to extract various traffic fields required by the monitoring system 100 . The processor 110 may perform field digitization on fields containing non-numeric information (eg, networking protocols) to give each field an optimal format. The first network traffic may include a field recording the URL. The processor 110 can use information expansion means to segment the corresponding network domain from the website, such as a Second Level Domain (Second Level Domain). The processor 110 counts a plurality of access times respectively corresponding to multiple network domains according to the first user equipment, wherein the multiple network domains include the first network domain. Specifically, the processor 110 may count the access times of the first user equipment to each network domain in the first network traffic, so as to obtain multiple access times corresponding to multiple network domains respectively. Assuming that the above-mentioned plurality of network domains include the first network domain, the processor 110 may use a feature extraction technology to extract the user equipment of the first user equipment from the first network traffic. The user device identification code and the domain identification code of the first network domain are obtained, and the advertising domain and noise in the first network traffic are eliminated. In one embodiment, the processor 110 can eliminate unnecessary columns by calculating the transmission traffic proportion of each of the plurality of network domains and calculating the correlation between fields according to the transmission traffic proportion. Bit.

In addition, the processor 110 may further calculate a percentage rank (Percentile Rank, PR) of the first network domain among all network domains accessed by the first user equipment based on the plurality of access times mentioned above to generate a first score. (rating). For example, among the multiple network domains that the first user device has accessed, if the first network domain has the highest number of accesses, the first network domain can be the one with the highest percentage rank and the highest percentage among the multiple network domains. Top rated domains. Since each user's networking behavior is different, the processor 110 can compare the popularity of multiple access times of multiple network domains browsed by each user device by calculating multiple access times of each user device. Percentage of access times to generate individual ratings. In this way, each user's unusual networking behavior can be immediately reflected and potentially malicious users can be effectively detected.

In step S202, the processor 110 inputs the parameters (information recorded in each field) in the first network traffic into the machine learning model to generate a network domain whitelist corresponding to the first user equipment. The parameters may include the above-mentioned user equipment identification code of the first user equipment, the network domain identification code of the first network domain, and the first score of the first user equipment for the first network domain. Specifically, the processor 110 may train a machine learning model according to a loss function based on collaborative filtering. The loss function based on collaborative filtering is associated with the correlation between user device identifiers, the correlation between network domain identifiers, or the user device's rating of the network domain. The domain whitelist is The monitoring system 100 recommends a list of network domains accessed by the first user device. The trained machine learning model can generate similar domain whitelists for user devices with similar access behaviors. For example, if the first user equipment and the second user equipment access the same network domain, and the scores of the first user equipment and the second user equipment for the network domain are similar, then the machine trained based on the loss function of collaborative filtering The learning model may generate a whitelist of network domains for the first user device that have similar preferences to those of the second user device.

In one embodiment, the processor 110 converts the first user equipment identification code and the second user equipment identification code into a first embedding vector (embedding vector) and a second embedding vector respectively through embedding techniques (Embedding Techniques), and calculates The distance between the first embedding vector and the second embedding vector is used to obtain the correlation between user identification codes. Similarly, the processor 110 converts the domain identification codes of each network domain into an embedding vector through embedding technology, and obtains the correlation between the domain identification codes of each network domain.

The processor 110 can obtain a loss function based on collaborative filtering through historical parameters in historical network traffic, and train the machine learning model for multiple days to automatically generate predicted network domain data for the next day, and then combine the next day's predicted network domain data with The predicted domain data is compared with the actual domain data of the next day, and the training of the machine learning model is completed until the error value of the comparison is lower than the threshold value.

After training the machine learning model, the processor 110 can compare the error values of the machine learning model with other recommendation models generated by other common algorithms.

In addition, a common algorithm can be singular value decomposition (Singular Value Algorithms such as Decomposition (SVD), K-Nearest Neighbor (KNN) or Non-Negative Matrix Factorization (Non-Negative Matrix Factorization) are not limited by the present invention.

In response to the error value of the machine learning model being greater than the error values of other recommended models, the processor 110 may continue to update the machine learning model to reduce the error value of the machine learning model.

In response to the error value of the machine learning model being less than the error values of other recommended models, the processor 110 may perform normalization processing on the machine learning model, and input parameters in the first network traffic to the machine learning model to generate a third A whitelist of domains for a user's device. The domain whitelist may include multiple expected scores corresponding to multiple domains and multiple domain identifiers corresponding to multiple domains.

In step S203, the processor 110 may receive the first current network traffic of the first user equipment through the transceiver 130. In step S204, the processor 110 determines the access behavior of the first user equipment to the first network domain according to the first current network traffic.

In step S205, the processor 110 determines whether the first network domain is in the network domain whitelist. If the first network domain is not in the network domain whitelist of the first user equipment, step S206 is entered. If the first network domain is in the network domain whitelist of the first user device, the process ends. In step S206, the processor 110 determines whether the first user equipment is abnormal according to the access behavior. If the processor 110 determines that the first user equipment is abnormal, step S207 is entered. If the processor 110 determines that the first user equipment is normal, the process ends.

In one embodiment, the access behavior includes the number of times the first user equipment accesses the first network domain. If the number of accesses is greater than the threshold, the processor 110 determines that the first user The device's access behavior to the first network domain is abnormal. Therefore, the first user equipment is abnormal. If the number of accesses is less than or equal to the threshold, the processor 110 determines that the access behavior of the first user equipment to the first network domain is normal. Therefore, the first user equipment is normal.

In one embodiment, the access behavior includes a first number of accesses to the first network domain by the first user equipment. The processor 110 may obtain the current network traffic of each of the user equipment sets, where the user equipment set includes the first user equipment. Then, the processor 110 can count the number of accesses to the first network domain by each of the user equipment sets according to the current network traffic and calculate the average number of accesses based on the counted number of accesses. If the ratio of the first number of accesses to the average number of accesses is greater than the threshold, the processor 110 may determine that the access behavior of the first user equipment to the first network domain is abnormal. Therefore, the first user equipment is abnormal. If the ratio is less than or equal to the threshold, the processor 110 may determine that the access behavior of the first user equipment to the first network domain is normal. Therefore, the first user equipment is normal.

For example, when the number of accesses of the first user equipment to the first network domain is abnormally high, the processor 110 can determine the number of accesses of the first network domain by other user equipments in the user equipment set. Whether a user's equipment is abnormal. If the access times of other user devices to the first network domain are also abnormally high, the first user device can be determined to be normal, and vice versa. Therefore, the average number of accesses can be calculated based on the number of accesses to the first network domain by each user device set, and in response to the ratio of the first number of accesses to the average number of accesses being greater than the threshold, it is determined that the first user Equipment abnormality.

In one embodiment, the access behavior further includes the amount of uploaded data. The processor 110 may determine that the first user equipment is abnormal in response to the amount of uploaded data being greater than the threshold. On the other hand, the processor 110 may determine that the first user equipment is normal in response to the amount of uploaded data being less than or equal to the threshold.

In an embodiment, the processor 110 may record the first user equipment in one of multiple monitoring lists according to the access behavior, where the multiple monitoring lists respectively correspond to multiple time periods. The processor 110 may count the number of at least one monitoring list including the first user equipment in the plurality of monitoring lists, and determine that the first user equipment is abnormal in response to the number being greater than the threshold. On the other hand, the processor 110 may determine that the first user equipment is abnormal in response to the number being less than or equal to the threshold.

For example, when an abnormality is detected in the first user equipment, the processor 110 will record the first user equipment in one of the multiple monitoring lists. Multiple monitoring lists correspond to multiple time periods, such as each day of the past week. Therefore, when the threshold is "4", it means that if the first user equipment is recorded in the monitoring list for more than 4 days in a week, the processor 110 determines that the first user equipment is abnormal.

In step S207, the processor 110 may output a warning message to prompt the network administrator to check the abnormal status of the first user equipment.

FIG. 3 illustrates a flow chart of a method for monitoring abnormal behavior of user equipment according to an embodiment of the present invention, where the monitoring method can be implemented by the monitoring system 100 shown in FIG. 1 . In step S301, first network traffic of the first user equipment is obtained, and a network domain whitelist corresponding to the first user equipment is generated according to the first network traffic. In step S302, obtain the first current network traffic of the first user equipment, And judging the access behavior of the first user equipment to the first network domain according to the first current network traffic. In step S303, in response to the fact that the first network domain is not in the network domain whitelist, it is determined whether the first user equipment is abnormal based on the access behavior. In step S304, in response to determining that the first user equipment is abnormal, a warning message is output.

To sum up, the monitoring system of the present invention can obtain the network domain whitelist of user equipment through digitized scoring and a machine learning model trained by a loss function based on collaborative filtering. Different from the previous methods of grouping and outliers, the present invention can quickly find abnormal user equipment from the network connection records of a large number of 5G user equipment by comparing the network domain whitelist and the access behavior of the user equipment, and issue a warning signal. Therefore, the present invention can effectively reduce the workload of network monitoring personnel. In addition, the present invention can compare the access behavior of the user equipment with a preset threshold, and can determine whether the user equipment is abnormal based on the comparison result, and then send a warning message to the network manager. The present invention can provide abnormal user equipment to information security managers for analysis to find potential malicious attacks or activities, thereby improving enterprise security. The present invention can be applied to network environments with huge amounts of data. Pre-processing technology can take advantage of deep learning exploration to obtain usable features from huge amounts of data. Accordingly, the present invention can detect blind spots that cannot be detected by traditional monitoring systems using correlation or static rules, thereby preventing emerging attack methods such as attacks from internal users or advanced persistent attacks.

S301, S302, S303, S304: steps

Claims (11)

A monitoring system for abnormal behavior of user equipment, including: transceiver; and a processor coupled to the transceiver and configured to perform: Obtain the first network traffic of the first user equipment through the transceiver, and generate a network domain whitelist corresponding to the first user equipment based on the first network traffic; Obtain the first current network traffic of the first user equipment through the transceiver, and determine the access behavior of the first user equipment to the first network domain based on the first current network traffic; In response to the first network domain not being in the network domain whitelist, determining whether the first user equipment is abnormal based on the access behavior; and In response to determining that the first user equipment is abnormal, a warning message is output through the transceiver. The monitoring system of claim 1, wherein the processor is further configured to perform: Input parameters in the first network traffic into a machine learning model to generate the network domain whitelist. The monitoring system of claim 2, wherein the parameters include the user equipment identification code of the first user equipment, the network domain identification code of the first network domain, and the first user equipment's response to the first network domain. The domain's first rating. The monitoring system of claim 3, wherein the processor is further configured to perform: Count a plurality of access times according to the first user equipment, wherein the plurality of access times respectively correspond to multiple network domains, wherein the multiple network domains include the first network domain; and Calculating a percentile rank of the first network domain based on the plurality of access times to generate the first score. The monitoring system of claim 2, wherein the processor is further configured to perform: The machine learning model is trained according to a loss function based on collaborative filtering, wherein the loss function based on collaborative filtering is associated with the correlation between user device identification codes, the correlation between network domain identification codes, and the correlation between user equipment and network domains. 's rating. The monitoring system of claim 5, wherein the processor is further configured to perform: converting the first user equipment identification code into a first embedding vector, and converting the second user equipment identification code into a second embedding vector; and The distance between the first embedding vector and the second embedding vector is calculated to obtain the correlation between the user identification codes. The monitoring system of claim 1, wherein the access behavior includes access times, and wherein the processor is further configured to perform: In response to the number of accesses being greater than a threshold, it is determined that the first user equipment is abnormal. The monitoring system of claim 1, wherein the access behavior includes a first number of accesses, and wherein the processor is further configured to perform: Obtain the current network traffic of each of the user equipment sets, wherein the user equipment set includes the first user equipment; Count the number of accesses to the first network domain by each of the user equipment sets according to the current network traffic, and calculate the average number of accesses based on the number of accesses; and In response to the ratio of the first number of accesses to the average number of accesses being greater than a threshold, it is determined that the first user equipment is abnormal. The monitoring system of claim 1, wherein the access behavior includes uploading an amount of data, and wherein the processor is further configured to perform: In response to the amount of uploaded data being greater than a threshold, it is determined that the first user equipment is abnormal. The monitoring system of claim 1, wherein the processor is further configured to perform: Record the first user equipment in one of multiple monitoring lists according to the access behavior, wherein the multiple monitoring lists respectively correspond to multiple time periods; and Count the number of at least one monitoring list including the first user equipment in the plurality of monitoring lists; and In response to the number being greater than the threshold, it is determined that the first user equipment is abnormal. A method for monitoring abnormal behavior of user equipment, including: Obtain the first network traffic of the first user equipment, and generate a network domain whitelist corresponding to the first user equipment according to the first network traffic; Obtain the first current network traffic of the first user equipment, and determine the access behavior of the first user equipment to the first network domain based on the first current network traffic; In response to the first network domain not being in the network domain whitelist, determining whether the first user equipment is abnormal based on the access behavior; and In response to determining that the first user equipment is abnormal, a warning message is output.

Images