Method and device compatible with structured and unstructured privileged threat behavior data

Abstract

The invention discloses a method and a device compatible with structured and unstructured privilege threat behavior data. The method comprises the following steps: accessing privilege account sessionlog data and privilege account terminal operation audit log data; planning classified storage indexes for the privileged account session log data and the privileged account terminal operation audit log data as required, wherein the classified storage indexes comprise a structured log data structure and an unstructured log data structure; respectively defining corresponding analysis templates for the structured log data structure and the unstructured log data structure, and manually updating the analysis templates as required; according to the analysis template, carrying out isomorphism processing on various abnormal log data; and associating various types of heterogeneous privilege threat abnormal behavior data as required, and detecting privilege threat abnormal behaviors. According to the method, various heterogeneous log data can be accessed and analyzed in a perfect adaptation manner, and a guarantee is provided for subsequent privilege threat abnormal behavior detection and analysis, so that the risk of loss caused by privilege threat abnormal behaviors of enterprises is reduced to the minimum.

Description

technical field [0001] The invention relates to the field of privilege threat abnormal behavior detection, in particular to a method and device compatible with structured and unstructured privilege threat behavior data. Background technique [0002] Privileged accounts refer to accounts with high risk (such as administrator accounts that can start and stop devices) or high value (such as application accounts that can read business-sensitive data). More than half of major security incidents each year are due to privileged accounts being This behavior of using privileged accounts to cause damage or loss to enterprises is called privileged threat abnormal behavior. It is very difficult for traditional tools or systems to detect abnormal behaviors of privilege threats. The main reason is that the audit log data of various operating systems, applications, databases, network devices, security devices, etc. are not uniform, and there are many unstructured data, which is difficult t...

AI Technical Summary

Problems solved by technology

It is very difficult for traditional tools or systems to detect abnormal behaviors of privilege threats. The main reason is that the audit log data of various operating systems, applications, databases, network devices, security devices, etc. are not uniform, and there are many unstructured data, which is difficult to conduct Unified access, parsing, and association detection, resulting in data islands

Images