A system and method for detecting abnormal user behavior based on principal component analysis

Abstract

A user behavior anomaly detection system and method based on principal component analysis belongs to the field of computer technology. The system includes a user behavior preprocessing module, a user behavior training module, a PCA module, a user behavior detection module, and a user behavior anomaly processing module. The method includes a user behavior training stage and a user behavior detection stage. The user behavior training stage is used to generate a user behavior abnormality threshold; the user behavior detection stage uses the user behavior abnormality threshold to determine whether the real-time user behavior is abnormal; the present invention uses the PCA method to detect user anomalies Behavior, PCA is very sensitive to changes in abnormal values. Abnormal user behavior has a large impact on the main direction, making the user behavior detection results more effective; the detection process does not repeat operations, which increases detection efficiency and is easy to implement; use thresholds to detect whether real-time user behavior Abnormalities make detection efficient and convenient.

Description

technical field [0001] The invention belongs to the field of computer technology, and in particular relates to a system and method for abnormal user behavior detection based on principal component analysis. Background technique [0002] With the advancement of informatization and the rapid development of the Internet and network data services, more and more people begin to use the Internet to obtain information. Network users can store files, browse websites, establish remote video interaction, order train tickets and shop through the network. However, while enjoying the convenience of the network, we are also facing the threats brought by various network attack methods. Traditional user identity authentication mechanisms, such as access control, data encryption, identity authentication, etc., all use passwords for user authentication, and passwords are easily cracked by illegal users, resulting in poor security of these mechanisms, which cannot guarantee the security of us...

AI Technical Summary

Problems solved by technology

Most of the existing user behavior anomaly detection methods are based on data mining methods and machine learning methods. The methods mainly focus on correlation analysis, cluster analysis, and sequence pattern analysis. Massive data source audits are required, resulting in slow system operation and system failure. The response time is long, and the phenomenon of suspended animation often occurs

At the same time, the process design of existing data mining methods and machine learning methods is relatively complicated, and it takes a long time to obtain results. For example, a user behavior detection method based on a hidden Markov model (Hidden Markov Model, HMM). Use HMM to establish the normal behavior profile of legitimate users at the user interface layer, and use the Baum-Welch algorithm to train HMM, use the approximate forward-backward algorithm and Bayesian criterion in the detection stage to judge whether the user's current behavior is abnormal, although This method can detect user behavior, but it requires a large amount of calculation, and the detection efficiency and real-time performance are poor; the user behavior detection method based on neural network has low operating efficiency in the detection process, and the process requires human intervention, which is practical. poor sex

Images