Method of detecting abnormal behavior of user of computer network system
AssigneeHan Si An Xin (Beijing) Software Technology Co., Ltd
InventorsXiaochuan WAN, Hanzhao GAO, Rui WU
Life of this patent
Estimating the term…
Abstract
Provided in the present invention is a method of detecting an abnormal behavior of a user of a computer network system, the method comprising: selecting at least two data sources in the computer network system; extracting data of user behaviors respectively from the corresponding data sources using a configured tensor data structure, and aggregating the extracted data; and detecting abnormality of user behaviors on the basis of the aggregated tensor data. The method of the present invention can efficiently integrate a large volume of irrelevant security data and identify an abnormal behavior automatically.
Claims20
A method for detecting an abnormal behavior of a user of a computer network system, comprising:
- selecting at least two data sources from the computer network system, the at least two data sources having respective records regarding a user's behavior;
- configuring a tensor data structure corresponding to each data source according to the type of each data source, wherein the tensor data structure defines a plurality of data about the user's behavior which need to be extracted from the corresponding data source;
- extracting the plurality of data about the user's behavior from the corresponding data sources respectively by using the configured tensor data structure and performing multidimensional aggregation on the extracted data;
- and
- performing anomaly detection on the user's behavior based on the tensor data obtained through aggregation.
Dependencies are inferred from the claim text.