Threat behavior detection and model establishment method and device thereof, electronic equipment and storage medium

Abstract

The invention provides a threat behavior detection and model establishment method and a device, electronic equipment and a storage medium, and relates to the technical field of network security. The threat behavior detection model establishment method comprises the steps of establishing a training set and a verification set based on attribute features and behavior features in a user data set; calling an LGBMClassifier interface instantiation model, and setting model parameters of the interface instantiation model; and training the interface instantiation model based on the training set and theverification set to obtain a LightGBM-based threat behavior detection model; the detection model is used for outputting an illegal probability based on an input detection feature, and the detection feature comprises an attribute feature and a behavior feature of a to-be-detected user. Threat behavior detection is performed through the threat behavior detection model without setting a separate detection model for each user, and the LightGBM algorithm has the characteristic of parallel calculation, so that the detection efficiency is improved, and the consumption of computing resources is reduced.

Description

technical field [0001] The present application relates to the technical field of network security, in particular, to a threat behavior detection and model building method, device, electronic equipment and storage medium. Background technique [0002] Internal threats refer to internal personnel or external attackers disguised as internal personnel who use legal identities and permissions to destroy systems or data, steal information, abuse resources, etc., and pose a security hazard to enterprises or organizations. With the gradual strengthening of security protection technologies such as firewalls, internal threats have gradually become a common method for attackers to implement internal threat behaviors through password theft and profit inducement. [0003] Internal threat detection is usually based on user log data in the internal network. In related research, machine learning algorithms such as K-Means, isolation forest, long-term short-term memory network, and Bayesian ...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the purpose of the embodiments of the present application is to provide a threat behavior detection and model building method, device, electronic equipment, and storage medium to improve the low efficiency of internal threat behavior detection and occupy many computing resources in the prior art.

Images