A mining method, terminal and storage medium for discovering dependencies between threat behaviors

Abstract

The present invention provides a mining method, a terminal and a storage medium for discovering dependencies between threat behaviors, collects log files of all users a in the system, cleans and organizes the data in the log files, and forms an employee behavior set S={ beh ai }, the time span w in the statistical set S t ; based on S and w t The probability of occurrence of statistical behavior P(beh ai ) and the behavior co-occurrence probability P(beh ai ,beh aj ); calculates the dependency value dep based on the two probabilities ai,aj , dep ai,aj reflects the behavior beh ai on behavior beh aj degree of dependence; according to all dep ai,aj Construct the attack dependency matrix M, which reflects the dependency between all behaviors of an employee; the attack behavior path path is obtained from M ag→ak , path ag→ak Represents a complete, most likely series of attack actions. The present invention finds potential connections between employee behaviors and quantifies such dependencies. Enterprises can quickly find out the two most closely related behaviors through the value of the dependency relationship, and warn the threat behavior according to the pre-specified risk threshold to prevent the enterprise from being attacked by some internal threats.

Description

technical field [0001] The invention relates to the technical field of data security, and in particular, to a mining method, a terminal and a storage medium for discovering dependencies between threat behaviors. Background technique [0002] Insider threats are generally considered malicious activities that compromise the system by disgruntled employees or former employees of a business, institution, or organization. A saboteur gains access to an enterprise system or network, finds and attacks weak points in the system's defenses by infiltrating the system's structure and operating state. There are many forms of insider threat attacks, such as using Trojans, worms, viruses and other program tools to intrude into the system; stealing confidential information within the enterprise; modifying, deleting or destroying key company data; stealing the identity information of the company's internal employees, etc. The occurrence of any of these behaviors will cause incalculable loss...

AI Technical Summary

Problems solved by technology

[0007] With the advent of big data, more attack behaviors are no longer a single operation, and there are inextricably linked among many attack behaviors. It is difficult for the traditional attack matrix to identify and quantify these attack relationships. At the same time as the threat, these preventive measures may release another attack related to the constant threat, causing incalculable damage to the computer

Images