Dragging-based privileged threat behavior track associated playback method and device

Abstract

The invention discloses a dragging-based privileged threat behavior track associated playback method and device, being applied to a privileged account threat analysis system. The dragging-based privileged threat behavior track associated playback method comprises the following steps: A) accessing privileged account session log data, and accessing privileged account terminal operation audit log data; B) processing the privileged account session log data and the privileged account terminal operation audit log data; C) visualizing each dimension index related to privilege threat abnormal behaviors into a draggable field block; D) selecting related dimension indexes through a mouse dragging mode according to needs; E) selecting a track playback time range as required; and F) associating the selected dimension index with the trajectory playback time range, and restoring the privileged threat abnormal behavior trajectory. According to the dragging-based privileged threat behavior track associated playback method, even related personnel who do not understand technologies or are not deep in technologies can rapidly achieve track playback analysis of privilege threat abnormal behaviors in asimple mouse dragging combination association mode, and timeliness and usability are improved.

Description

technical field [0001] The invention relates to the field of privilege security, in particular to a drag-and-drop-based method and device for associated playback of privilege threat behavior tracks. Background technique [0002] Privileged accounts refer to accounts with high risk (such as administrator accounts that can start and stop devices) or high value (such as application accounts that can read business-sensitive data). More than half of major security incidents each year are due to privileged accounts being This behavior of using privileged accounts to cause damage or loss to enterprises is called privileged threat abnormal behavior. In the traditional sense, privileged threat abnormal behavior detection analysis and track playback are generally done through tool rule configuration or command filtering, which requires relatively high personal technical skills for administrators, making it impossible for some administrators and leadership personnel to do so. It canno...

AI Technical Summary

Problems solved by technology

In the traditional sense, privileged threat abnormal behavior detection analysis and track playback are generally done through tool rule configuration or command filtering, which requires relatively high personal technical skills for administrators, making it impossible for some administrators and leadership personnel to do so. It can only be carried out after the relevant technical personnel are in place, so it is easy to cause timeliness and usability problems, causing corporate privileges to threaten abnormal behavior security risks

Images