ABSTRACT

To improve the performance of enterprise network information security, we proposed a behaviour analytics model that established a unique behaviour pattern for each user and identifies untrusted interactive behaviour. First, a series of behaviour characteristics was constructed by observing user behaviours. These characteristics were then used by a big data analysis method called hidden Markov model to model the behaviour of trusted users. Next, a forward algorithm calculated the probability of observation sequences from users with the same and different positions. Finally, untrusted interactive behaviours were identified by comparing the observation sequence probability sets of trusted and untrusted users. The proposed method was applied to the Enterprise Resource Planning system used by a publishing house to identify the credibility of its user behaviour. The highest false positive rates obtained were 0.74% and 5.26% for users in different positions and the same position, respectively. These results verify that the model is effective in identifying untrusted interactive behaviours.

摘要

为了提高企业网络信息安全的性能，我们提出了一种行为分析模型，该模型为每个用户建立了独特的行为模式，并识别出不可信的交互行为。首先，通过观察用户行为，构建一系列行为特征。这些特征随后被一种称为隐马尔可夫模型的大数据分析方法用于对受信任用户的行为进行建模。接下来，前向算法计算来自具有相同和不同位置的用户的观察序列的概率。最后，通过比较可信和不可信用户的观察序列概率集，识别不可信交互行为。将所提出的方法应用于一家出版社使用的企业资源规划系统，以识别其用户行为的可信度。对于不同位置和相同位置的用户，获得的最高误报率分别为 0.74% 和 5.26%。这些结果验证了该模型在识别不受信任的交互行为方面是有效的。