WO2019214511A1

WO2019214511A1 - Method for analyzing abnormal file operation behavior through clustering, system and terminal

Info

Publication number: WO2019214511A1
Application number: PCT/CN2019/085190
Authority: WO
Inventors: 郭景楠; 王建磊; 何华荣; 王志
Original assignee: 深圳市联软科技股份有限公司
Priority date: 2018-05-11
Filing date: 2019-04-30
Publication date: 2019-11-14
Also published as: CN108717510A

Abstract

The present invention belongs to the technical field of information security, and particularly relates to a method for analyzing the abnormal file operation behavior through clustering, a system and a terminal, comprising the following steps: obtaining current operation behavior data for operating a file; inputting the current operation behavior data into a clustering model for analysis to obtain an analyzing result for whether the operation behavior is abnormal, and if so, calculating a comprehensive abnormality index. The present invention can monitor and determine whether the file operation behavior is abnormal, compared with the prior art, the present invention has incomparable automaticity, timeliness and accuracy.

Description

Method, system and terminal for analyzing abnormal operation behavior of files by clustering

Technical field

The invention belongs to the technical field of information security, and particularly relates to a method, a system and a terminal for analyzing an abnormal operation behavior of a file by clustering.

Background technique

With the development and advancement of information technology, various data documents are usually stored in electronic files on various terminals or remote servers. For some sensitive files or confidential documents, in order to prevent unauthorized persons from obtaining file information or authorized personnel to perform abnormal operations, it is usually necessary to monitor and judge the file operation behavior.

The prior art mainly uses rules or strategies to judge whether the file operation behavior is abnormal, but the rules and policies cannot cover all abnormal behaviors, so the prior art is mechanical, and the new abnormal behavior is ignored or cannot be recognized in time.

Summary of the invention

In view of the defects in the prior art, the present invention provides a method, system and terminal for analyzing abnormal behavior of a file by clustering, which can monitor and judge whether the file operation behavior is abnormal, which is incomparable compared with the prior art. Automated, timeliness and accuracy.

In a first aspect, the present invention provides a method for analyzing an abnormal operation behavior of a file by clustering, comprising the following steps:

Get the current operational behavior data that operates on the file;

The current operational behavior data is input into the clustering model for analysis, and the analysis result of whether the operation behavior is abnormal is obtained, and if it is abnormal, the comprehensive abnormality index is calculated.

Preferably, the current operational behavior data is input into a clustering model for analysis, to obtain an analysis result of whether the operational behavior is abnormal, and if the abnormality is, the comprehensive abnormality index is calculated, specifically:

The current operational behavior data is input into the single clustering model to obtain an analysis result of whether the operational behavior is abnormal, and if it is abnormal, a single abnormality index is obtained;

The current operational behavior data is input into the group clustering model to obtain an analysis result of whether the operational behavior is abnormal, and if it is abnormal, the group abnormality index is obtained;

According to the single anomaly index and the group anomaly index, the comprehensive anomaly index is calculated by the weighting calculation formula.

Preferably, the method for establishing the single clustering model is as follows:

Collect historical operational behavior data for operating files on a single terminal;

Data normalization preprocessing of historical operational behavior data, obtaining sample data of a single terminal, and calculating a single distance matrix of sample data;

According to the single distance matrix, the sample data is clustered by the hierarchical clustering method;

Get clustering results: single class center and single class radius for each single class.

Preferably, the method for establishing the clustering model is as follows:

Using the Pearson correlation coefficient, the group distance matrix between the group terminals is calculated according to several sample data of a plurality of single terminals;

According to the group distance matrix, several sample data are clustered by hierarchical clustering method;

Get clustering results: group center and group radius for each group.

Preferably, the current operation behavior data is input into the single cluster model to obtain an analysis result of whether the operation behavior is abnormal, and if it is abnormal, a single abnormality index is obtained, specifically:

Input the current operational behavior data into the single cluster model, find the nearest single center center from the current operational behavior data, and calculate the distance H1 between the current operational behavior data and the single class center;

If the distance H1 is less than or equal to the single class radius corresponding to the single class center, it is determined that the current operation behavior is normal;

If the distance H1 is greater than the single-class radius corresponding to the single-class center, it is determined that the current operational behavior is abnormal, and the excess single abnormality index is calculated according to the distance H1 and the single-class radius.

Preferably, the current operation behavior data is input into the group clustering model to obtain an analysis result of whether the operation behavior is abnormal. If the abnormality is obtained, the group abnormality index is obtained, specifically:

Input the current operational behavior data into the cluster model to find the group center closest to the current operational behavior data, and calculate the distance H2 between the current operational behavior data and the group center;

If the distance H2 is less than or equal to the group class radius corresponding to the group center, it is determined that the current operation behavior is normal;

If the distance H2 is greater than the group class radius corresponding to the group center, it is determined that the current operation behavior is abnormal, and the excess group abnormality index is calculated according to the distance H2 and the group class radius.

Preferably, the weighting calculation formula is as follows:

Result=a*score_single+(1-a)*score_community;

Where a is the exponential coefficient, score_single is the single anomaly index, and score_community is the group anomaly index.

Preferably, the method for establishing the single cluster model and the group cluster model includes the steps of model correction, and the steps of the model modification are specifically:

The modified sample data of the mark is input into the model. If the result of the model recognition is different from the mark, the class center and class radius closest to the corrected sample data are updated accordingly.

In a second aspect, the present invention provides a system for analyzing an abnormal operation behavior of a file by clustering, and is applicable to the method for analyzing an abnormal operation behavior of a file by clustering according to the first aspect, including:

a data acquisition unit, configured to acquire current operation behavior data for operating the file;

The abnormality analyzing unit is configured to input the current operational behavior data into the clustering model for analysis, to obtain an analysis result of whether the operational behavior is abnormal, and if the abnormality is, calculate a comprehensive abnormality index.

In a third aspect, the present invention provides a terminal for analyzing an abnormal operation behavior of a file by clustering, comprising a processor, an input device, an output device, and a memory, wherein the processor, the input device, the output device, and the memory are connected to each other, wherein The memory is for storing a computer program, the computer program comprising program instructions, the processor being configured to invoke the program instructions to perform the method of the first aspect.

The invention has the beneficial effects that the invention can monitor and judge whether the file operation behavior is abnormal, and has incomparable automaticness, timeliness and accuracy compared with the prior art.

DRAWINGS

In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the specific embodiments or the description of the prior art will be briefly described below. In all the figures, like elements or parts are generally identified by like reference numerals. In the figures, elements or parts are not necessarily drawn to scale.

FIG. 1 is a flowchart of a method for analyzing an abnormal operation behavior of a file by clustering in the embodiment;

2 is a structural block diagram of a system for analyzing an abnormal operation behavior of a file by clustering in the embodiment;

FIG. 3 is a block diagram of a terminal module for analyzing an abnormal operation behavior of a file by clustering in the embodiment.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The use of the terms "comprising", "comprising", "","," The presence or addition of a plurality of other features, integers, steps, operations, elements, components, and/or collections thereof.

It is also to be understood that the terminology of the present invention is to be construed as a The singular forms "", ",",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

In particular implementations, the terminals described in this embodiment of the invention include, but are not limited to, other portable devices such as mobile phones, laptop computers or tablet computers having touch sensitive surfaces (e.g., touch screen displays and/or touch pads). It should also be understood that in some embodiments, the device is not a portable communication device, but a desktop computer having a touch sensitive surface (eg, a touch screen display and/or a touch pad).

Embodiment 1:

This embodiment provides a method for analyzing an abnormal operation behavior of a file by clustering, and the method needs to apply a single cluster model and a cluster cluster model.

Wherein, the method for establishing the single clustering model is as follows:

In this embodiment, the operation behavior includes, but is not limited to, creation, transmission, copying, deletion, and the like of a file. The operational behavior data, such as: operator identity, operation time, process name, file name, file type, disk where the file is located, file size, read and write data size, number of operations, duration of each, and the like. The data standardization preprocessing, such as data cleaning, data integration, data transformation, data reduction, etc., obtains higher quality sample data after data preprocessing. Calculating the single distance matrix of the sample data, the single distance matrix of this embodiment is a matrix containing the distance between the two sample data (ie, a two-dimensional array), and then using the hierarchical clustering method to perform sample data according to the single distance matrix. Clustering, and get a number of single-class, single-class centers of each single class and corresponding single-class radii.

The method for establishing the clustering model is as follows:

Get clustering results: group center and group radius for each group.

In this embodiment, after the sample data of each terminal is obtained, a sample data set of a plurality of terminals is obtained, and a group distance matrix between the plurality of terminals is calculated. Similar to the above method, after clustering, several group classes, group class centers of each group class and corresponding group class radii are obtained.

In order to make the established model more accurate, the method for establishing the single cluster model and the group cluster model includes the steps of model correction, and the steps of the model modification are specifically:

After the model is established, the manager marks the modified sample data, which is an abnormal operation behavior or a normal operation behavior. After the sample data input model is corrected, the model is identified. If the result of the model recognition is different from the mark, it indicates that the model is incorrect, and the model is corrected. If the marked behavior is abnormal and the model recognition result is also abnormal, the recognition is correct, and the operation behavior is classified as an abnormality; if the operation behavior is abnormal, but the model recognition is normal, the recognition is incorrect, and the update distance correction is correct. The model center is corrected by the nearest class center and class radius. Enter a plurality of modified samples marked in the model until the result of the model recognition is correct, thereby improving the accuracy of the model recognition.

In this embodiment, the method for analyzing the abnormal operation behavior of the file by clustering includes two steps of S1 and S2:

S1, obtaining current operational behavior data for operating the file. For example, a computer terminal monitors the user's operation behavior in real time, and monitors that the user opens a word document under the directory (computer D disk/company file/confidential category/development data) and copies the content of the word document. The computer terminal monitors the current operational behavior data collected by the user to operate the word document, and sends the operation behavior data to the remote server, and the remote server further acquires the current operation data.

S2, the current operational behavior data is input into the clustering model for analysis, and the analysis result of whether the operation behavior is abnormal is obtained, and if it is abnormal, the comprehensive abnormality index is calculated. The S2 includes three steps of S21, S22 and S23:

S21: Input the current operation behavior data into the single cluster model to obtain an analysis result of whether the operation behavior is abnormal, and if it is abnormal, obtain a single abnormality index. Step S21 is specifically:

Input the current operational behavior data into the single cluster model, find the nearest class center from the current operational behavior data, and calculate the distance H1 between the current operational behavior data and the single class center;

In this embodiment, the current operation behavior data that the user operates on the word document is input into the single cluster model, and the single class center closest to the current operation behavior data in the model is found, and the distance between the current operation behavior and the single class center is calculated. H1=21, the single class center corresponds to a single class radius of 19, and because the distance 21 is greater than the single class radius 19, the current operational behavior is judged to be abnormal, and the single anomaly index is calculated: (21-19)/19=0.105.

S22: Input the current operation behavior data into the group clustering model to obtain an analysis result of whether the operation behavior is abnormal, and if the abnormality is obtained, obtain the group abnormality index. Step S22 is specifically:

In this embodiment, the current operation behavior data of the user operating the word document is input into the group clustering model, and the group center center closest to the current operation behavior data is found, and the distance between the current operation behavior and the group center is calculated. H2=20, the group class radius corresponding to the group center is 18, and since the distance 20 is greater than the group radius 18, the current operational behavior is judged to be abnormal, and the group abnormality index is calculated: (20-18)/18=0.111. If any of the single class model and the group class model is recognized as an abnormality, the operation behavior is abnormal.

S23. Calculate the comprehensive anomaly index by a weighting calculation formula according to the single anomaly index and the group anomaly index. The weighting calculation formula is as follows:

Result=a*score_single+(1-a)*score_community;

Where a is the exponential coefficient, score_single is the single anomaly index, and score_community is the group anomaly index. In the present embodiment, a is an exponential coefficient set according to experiments and experience. If a is 0.6, the comprehensive abnormality index is=0.6*0.105+(1-0.6)*0.111=0.063+0.0444=0.107. Therefore, the user's operation behavior on the word document is abnormal through analysis, and the abnormality index is 0.107. The remote server sends the current operational behavior data and the analysis result to the management terminal. The management personnel finds that the company's confidential file is copied, which may result in the disclosure of the confidential file, so as to collect the solution in time.

Under normal circumstances, it can be determined that most of the operational behaviors should be normal operational behaviors, only specific or a small number of operational behaviors, which are abnormal operational behaviors, which may involve leaking problems. After the single clustering model and the group clustering model are established in this embodiment, the obtained current operational behavior data is input into the single clustering model, and the deviation of the current operational behavior from the historical operation behavior of the single user is used to detect whether the operational behavior is abnormal; The obtained current operational behavior data is input into the cluster model, and the deviation of the current operational behavior from the historical operational behavior of the group user is used to detect whether the operational behavior is abnormal. Finally, the weighting algorithm is used to synthesize the two, and then the operational behavior is comprehensively evaluated. .

This embodiment is capable of monitoring and judging whether the file operation behavior is abnormal, and has incomparable automaticness, timeliness, and accuracy compared to the prior art. This embodiment has clustering anomaly detection, which can not only identify whether an abnormality is but also recognize the degree of abnormality. This embodiment not only clusters from the behavior patterns of a single end user, but also clusters the behavior patterns of the group users, thereby improving the interpretability and richness of the abnormality detection of the file operation behavior, and also improving the accuracy.

Embodiment 2:

The embodiment provides a system for analyzing abnormal behavior of a file by clustering, and is applicable to the method for analyzing abnormal behavior of a file by clustering according to the first embodiment, including a data acquiring unit and an abnormality analyzing unit.

The data acquisition unit is configured to acquire current operation behavior data for performing operations on the file. For example, a computer terminal monitors the user's operation behavior in real time, and monitors that the user opens a word document under the directory (computer D disk/company file/confidential category/development data) and copies the content of the word document. The computer terminal monitors the current operational behavior data of the user's operation on the word document, and sends the operation behavior data to the remote server, and the remote server acquires the current operation data.

The abnormality analyzing unit is configured to input the current operational behavior data into the clustering model for analysis, to obtain an analysis result of whether the operational behavior is abnormal, and calculate an integrated abnormality index if the abnormality is abnormal.

The abnormality analysis unit is specifically configured to:

A. The current operational behavior data is input into the single clustering model to obtain an analysis result of whether the operational behavior is abnormal, and if it is abnormal, a single abnormality index is obtained.

B. The current operational behavior data is input into the group clustering model to obtain an analysis result of whether the operational behavior is abnormal, and if it is abnormal, the group abnormality index is obtained.

C. Calculate the comprehensive anomaly index by weighting calculation formula according to the single anomaly index and the group anomaly index. The weighting calculation formula is as follows:

Result=a*score_single+(1-a)*score_community;

Embodiment 3:

The embodiment provides a terminal for analyzing abnormal behavior of a file by clustering, comprising a processor 42, an input device 41, an output device 44, and a memory 43, the processor 42, the input device, the output device 41, and the memory 43 mutually A connection, wherein the memory 43 is for storing a computer program, the computer program comprising program instructions, the processor 42 being configured to invoke the program instructions to perform the method of the first embodiment.

It should be understood that in the embodiments of the present invention, the so-called memory 43 may include read only memory and random access memory, and provide instructions and data to the processor 42. A portion of the memory 43 may also include a non-volatile random access memory. For example, the memory 43 can also store related information of the device type.

The processor 42 is operative to execute or execute an operating system, various software programs, and its own set of instructions stored in the internal memory 43, and to process data received from the touch input device or from other external input paths and Instructions to implement various functions. Processor 42 may include, but is not limited to, a central processing unit (CPU), a general purpose image processor (GPU), a microprocessor (MCU), a digital signal processor (DSP), a field programmable logic gate array (FPGA), application specific One or more of an integrated circuit (ASIC). In some embodiments, processor 42 and memory 43 can be implemented on a single chip. In some other implementations, they can be implemented on separate chips from each other.

The input device 41 may include a touch panel, a fingerprint sensor (for collecting fingerprint information of the user and direction information of the fingerprint), a microphone, and the like, and the output device 44 may include a display (LCD or the like), a speaker, and the like.

Those of ordinary skill in the art will appreciate that the elements and method steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software or a combination of both, in order to clearly illustrate hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

In the several embodiments provided herein, it should be understood that the described systems and methods can be implemented in other ways. For example, the system embodiment described above is merely illustrative. For example, the division of the unit is only a logical function division, and the actual implementation may have another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. The scope is intended to be included within the scope of the claims and the description of the invention.

Claims

A method for analyzing an abnormal operation behavior of a file by clustering, comprising the steps of:

Get the current operational behavior data that operates on the file;

The current operational behavior data is input into the clustering model for analysis, and the analysis result of whether the operation behavior is abnormal is obtained, and if it is abnormal, the comprehensive abnormality index is calculated.
The method for analyzing an abnormal operation behavior of a file by clustering according to claim 1, wherein the current operation behavior data is input into a cluster model for analysis, and an analysis result of whether the operation behavior is abnormal is obtained, and if the abnormality is Then calculate the comprehensive anomaly index, specifically:

The current operational behavior data is input into the single clustering model to obtain an analysis result of whether the operational behavior is abnormal, and if it is abnormal, a single abnormality index is obtained;

The current operational behavior data is input into the group clustering model to obtain an analysis result of whether the operational behavior is abnormal, and if it is abnormal, the group abnormality index is obtained;

According to the single anomaly index and the group anomaly index, the comprehensive anomaly index is calculated by the weighting calculation formula.
The method for analyzing abnormal behavior of a file by clustering according to claim 2, wherein the method for establishing the single clustering model is as follows:

Collect historical operational behavior data for operating files on a single terminal;

Data normalization preprocessing of historical operational behavior data, obtaining sample data of a single terminal, and calculating a single distance matrix of sample data;

According to the single distance matrix, the sample data is clustered by the hierarchical clustering method;

Get clustering results: single class center and single class radius for each single class.
The method for analyzing abnormal behavior of a file by clustering according to claim 3, wherein the method for establishing the clustering model is as follows:

Using the Pearson correlation coefficient, the group distance matrix between the group terminals is calculated according to several sample data of a plurality of single terminals;

According to the group distance matrix, several sample data are clustered by hierarchical clustering method;

Get clustering results: group center and group radius for each group.
The method for analyzing an abnormal operation behavior of a file by clustering according to claim 4, wherein the current operation behavior data is input into a single cluster model to obtain an analysis result of whether the operation behavior is abnormal, and if the abnormality is Get a single anomaly index, specifically:

Input the current operational behavior data into the single cluster model, find the nearest single center center from the current operational behavior data, and calculate the distance H1 between the current operational behavior data and the single class center;

If the distance H1 is less than or equal to the single class radius corresponding to the single class center, it is determined that the current operation behavior is normal;

If the distance H1 is greater than the single-class radius corresponding to the single-class center, it is determined that the current operational behavior is abnormal, and the excess single abnormality index is calculated according to the distance H1 and the single-class radius.
The method for analyzing abnormal behavior of a file by clustering according to claim 5, wherein the current operational behavior data is input into a clustering model to obtain an analysis result of whether the operational behavior is abnormal, and if the abnormality is Get the group anomaly index, specifically:

Input the current operational behavior data into the cluster model to find the group center closest to the current operational behavior data, and calculate the distance H2 between the current operational behavior data and the group center;

If the distance H2 is less than or equal to the group class radius corresponding to the group center, it is determined that the current operation behavior is normal;

If the distance H2 is greater than the group class radius corresponding to the group center, it is determined that the current operation behavior is abnormal, and the excess group abnormality index is calculated according to the distance H2 and the group class radius.
A method for analyzing an abnormal operation behavior of a file by clustering according to claim 6, wherein the weighting calculation formula is as follows:

Result=a*score_single+(1-a)*score_community;

Where a is the exponential coefficient, score_single is the single anomaly index, and score_community is the group anomaly index.
The method for analyzing abnormal behavior of a file by clustering according to claim 6, wherein the method for establishing the single cluster model and the cluster cluster model includes steps of model correction, and the model is modified. The steps are specifically as follows:

The modified sample data of the mark is input into the model. If the result of the model recognition is different from the mark, the class center and class radius closest to the corrected sample data are updated accordingly.
A system for analyzing an abnormal operation behavior of a file by clustering, the method for analyzing an abnormal operation behavior of a file by clustering according to any one of claims 1-8, comprising:

a data acquisition unit, configured to acquire current operation behavior data for operating the file;

The abnormality analyzing unit is configured to input the current operational behavior data into the clustering model for analysis, to obtain an analysis result of whether the operational behavior is abnormal, and if the abnormality is, calculate a comprehensive abnormality index.
A terminal for analyzing a file abnormal operation behavior by clustering, comprising a processor, an input device, an output device, and a memory, wherein the processor, the input device, the output device, and the memory are connected to each other, wherein the memory is used to store a computer program The computer program includes program instructions, the processor being configured to invoke the program instructions to perform the method of any of claims 1-8.