Mining method for discovering dependency relationship between threat behaviors, terminal and storage medium

Abstract

The invention provides a mining method for discovering a dependency relationship between threat behaviors, a terminal and a storage medium, and the method comprises the steps: collecting log files ofall users a in a system, cleaning and arranging data in the log files, forming an employee behavior set S = {behai}, and carrying out the statistics of the time span wt in the set S; counting a behavior occurrence probability P (behai) and a behavior co-occurrence probability P (behai, behaj) based on S and wt; calculating dependency relationship values depai, aj based on the two probabilities, wherein the depai, aj reflects the dependency degree of the behavior behai on the behavior behaj; constructing an attack dependence matrix M according to all depai and aj, wherein the matrix M reflectsthe dependence relationship between every two of all behaviors of one employee; and obtaining an attack behavior path pahag -> ak through the M, wherein the pahag -> ak represents a series of completeattack actions which are most likely to occur. According to the method, the potential relationship among employee behaviors is found out, and the dependency relationship is quantified. Enterprises can quickly find out two behaviors with the closest relationship through the dependency relationship numerical value, early warning is conducted on threat behaviors according to a preset danger threshold value, and the enterprises are prevented from suffering from some threat attacks from the inside.

Description

technical field [0001] The present invention relates to the technical field of data security, in particular to a mining method, a terminal and a storage medium for discovering dependencies among threat behaviors. Background technique [0002] Insider threats are generally considered to be malicious activities by disgruntled employees or ex-employees of a business, institution, or organization that compromise systems. The saboteur obtains access to the enterprise system or network, finds the weak position of the system defense by infiltrating the system structure and operating status, and attacks it. There are many forms of internal threat attacks, such as using Trojan horses, worms, viruses and other program tools to invade the system; stealing confidential information within the enterprise; modifying, deleting or destroying key data of the company; stealing the identity information of employees within the company, etc. The occurrence of any of these acts will cause incalcu...

AI Technical Summary

Problems solved by technology

[0007] With the advent of big data, more attack behaviors are no longer a single operation, and there are inextricably linked among many attack behaviors. It is difficult for the traditional attack matrix to identify and quantify these attack relationships. At the same time as the threat, these preventive measures may release another attack related to the constant threat, causing incalculable damage to the computer

Images