User identification system and method based on heterogeneous information network embedding algorithms

Abstract

The invention relates to a user identification system and method based on heterogeneous information network embedding algorithms. The user identification system comprises a data processing module, a joint embedding module and an evaluation analysis module. According to the invention, multi-source heterogeneous user behavior data is utilized for constructing a normal behavior model based on the thought of behavior analysis, and user identification is executed by comparing the similarity between a current behavior and the normal behavior model when behavior data of a new time period arrives. Forthe condition of identification errors, suspicious behavior sorting is given based on dot product similarity operation. The system and method can be applied to an enterprise intranet to detect potential internal threats, a more comprehensive and accurate behavior model can be obtained by combining two heterogeneous information network embedding algorithms, and the user identification accuracy isimproved by about 10%. In addition, event-level traceability clues can be provided for further analysis of the safety monitoring personnel.

Description

technical field [0001] The invention relates to a user identification system and method based on a heterogeneous information network embedding algorithm, belongs to the technical field of information security detection, and is used in an enterprise intranet environment. Background technique [0002] Today's most damaging security threats come not from malicious people or malware from the outside, but from trusted insiders. Members in the organization obtain certain access control rights according to their responsibilities, and effective identity authentication is an important way to defend against internal attacks. However, the identity authentication mechanism mainly includes account password, fingerprint recognition, etc., which are only valid when logging in, and there are still many security risks. Existing research usually establishes a user's normal behavior model based on behavior analysis, so as to obtain continuous and effective user identity monitoring after login...

AI Technical Summary

Problems solved by technology

[0005] The technology of the present invention solves the problem: to solve the problem of difficult association modeling of multi-source heterogeneous behavior data existing in the existing user identification method based on behavior analysis, the present invention provides a user identification system and method based on heterogeneous information network embedding algorithm , can build a more comprehensive behavior model, greatly improve the accuracy of user identification, and can analyze suspicious situations, providing event-level suspicious operation sorting

Images