为应对医疗数据面临的内外部爬取威胁,构建了一套基于用户和实体行为分析(User and Entity Behavior Analytics,UEBA)的协同防护体系。该体系通过建立用户与实体的动态行为基线,并融合流量异常、异地登录、高频访问等多维度特征,实现了...为应对医疗数据面临的内外部爬取威胁,构建了一套基于用户和实体行为分析(User and Entity Behavior Analytics,UEBA)的协同防护体系。该体系通过建立用户与实体的动态行为基线,并融合流量异常、异地登录、高频访问等多维度特征,实现了对外部恶意数据爬取与内部数据窃取行为的有效识别。在医院OA、互联网挂号及医院信息系统(Hospital Information System, HIS)中的实践证明,该体系成功识别了多起外部渗透与内部违规事件,显著增强了系统对数据泄露风险的主动防御能力。证明基于UEBA的防护体系可系统化地应对医疗场景下的数据爬取威胁,为智慧医院信息安全建设提供可复制、可推广的实践路径。展开更多
近年来,随着信息技术的快速发展和信息资源重要性的日益凸显,网络安全事件的数量与频率大幅提升,攻击者组织化、目标定向化、技术多样化的攻击行为成为新的趋势。偏重于外部攻击全局预警的态势感知和侧重于内部威胁检测的用户实体行为分...近年来,随着信息技术的快速发展和信息资源重要性的日益凸显,网络安全事件的数量与频率大幅提升,攻击者组织化、目标定向化、技术多样化的攻击行为成为新的趋势。偏重于外部攻击全局预警的态势感知和侧重于内部威胁检测的用户实体行为分析(User and Entity Behavior Analytics,UEBA)衔接,可以高效解决以人、资产、应用为维度的账号安全和数据安全问题。本文总结了基于UEBA的网络安全态势感知技术现状,并从大规模异构平台安全管理角度,对未来的发展方向进行了分析。展开更多
This paper studies cyber risk management by integrating contextual log analysis with User and Entity Behavior Analytics (UEBA). Leveraging Python scripting and PostgreSQL database management, the solution enriches log...This paper studies cyber risk management by integrating contextual log analysis with User and Entity Behavior Analytics (UEBA). Leveraging Python scripting and PostgreSQL database management, the solution enriches log data with contextual and behavioral information from Linux system logs and semantic datasets. By incorporating Common Vulnerability Scoring System (CVSS) metrics and customized risk scoring algorithms, the system calculates Insider Threat scores to identify potential security breaches. The integration of contextual log analysis and UEBA [1] offers a proactive defense against insider threats, reducing false positives and prioritizing high-risk alerts.展开更多
伴随企业业务的不断扩增和电子化发展,企业自身数据和负载数据都开始暴增。然而,作为企业核心资产之一的内部数据,却面临着日益严峻的安全威胁。越来越多以周期长、频率低、隐蔽强为典型特征的非明显攻击绕过传统安全检测方法,对大量数...伴随企业业务的不断扩增和电子化发展,企业自身数据和负载数据都开始暴增。然而,作为企业核心资产之一的内部数据,却面临着日益严峻的安全威胁。越来越多以周期长、频率低、隐蔽强为典型特征的非明显攻击绕过传统安全检测方法,对大量数据造成损毁。当前,用户实体行为分析(User and Entity Behavior Analytics,UEBA)系统正作为一种新兴的异常用户检测体系在逐步颠覆传统防御手段,开启网络安全保卫从“被动防御”到“主动出击”的新篇章。因此,将主要介绍UEBA在企业异常用户检测中的应用情况。首先,通过用户、实体、行为三要素的关联,整合可以反映用户行为基线的各类数据;其次,定义4类特征提取维度,有效提取几十种最能反映用户异常的基础特征;再次,将3种异常检测算法通过集成学习方法用于异常用户建模;最后,通过异常打分,定位异常风险最大的一批用户。在实践中,对排名前10的异常用户进行排查,证明安恒信息的UEBA落地方式在异常用户检测中极其高效。展开更多
大多数操作系统的安全防护主要依赖基于签名或基于规则的方法,因此现有大多数的异常检测方法精度较低。因此,利用贝叶斯模型为同类群体建模,并结合时间效应与分层原则,为用户实体行为分析(User and Entity Behavior Analytics,UEBA)研...大多数操作系统的安全防护主要依赖基于签名或基于规则的方法,因此现有大多数的异常检测方法精度较低。因此,利用贝叶斯模型为同类群体建模,并结合时间效应与分层原则,为用户实体行为分析(User and Entity Behavior Analytics,UEBA)研究提供精度更高的数据集。然后,将基于实际记录的用户行为数据与贝叶斯层级图模型推测出的数据进行比较,降低模型中的误报率。该方法主要分为两个阶段:在第1阶段,基于数据驱动的方法形成用户行为聚类,定义用户的个人身份验证模式;在第2阶段,同时考虑到周期性因素和分层原则,并通过泊松分布建模。研究表明,数据驱动的聚类方法在减少误报方面能够取得更好的结果,并减轻网络安全管理的负担,进一步减少误报数量。展开更多
The research aim is to develop an intelligent agent for cybersecurity systems capable of detecting abnormal user behavior using deep learning methods and ensuring interpretability of decisions.A four-module architectu...The research aim is to develop an intelligent agent for cybersecurity systems capable of detecting abnormal user behavior using deep learning methods and ensuring interpretability of decisions.A four-module architecture is proposed:log collection and aggregation,behavioral feature generation,analysis using the Long Short-Term Memory(LSTM)+Attention model,and an interpretation module.A hybrid approach is used that combines log processing,temporal neural networks and an attention mechanism to identify significant actions in the behavioral chain.Testing was conducted on the Computer Emergency Response Team(CERT)and the Australian Defence Force Academy Linux Dataset(ADFA-LD)datasets.The developed system demonstrated high accuracy rates(ROC-AUC>0.95),as well as superiority over classical and modern models(Logistic Regression,Random Forest,and Autoencoder).The attention mechanism ensured interpretability:it became possible to visually determine which user actions caused the alarm.A method for preparing logs and forming training samples is proposed.The intelligent agent can be integrated into corporate Security Information and Event Management(SIEM)/User and Entity Behavior Analytics(UEBA)systems,used in monitoring centers and applied in educational practice.Scientific novelty is manifested in the architecture,the use of attention in logs and interpretable behavior analysis in real time.展开更多
文摘为应对医疗数据面临的内外部爬取威胁,构建了一套基于用户和实体行为分析(User and Entity Behavior Analytics,UEBA)的协同防护体系。该体系通过建立用户与实体的动态行为基线,并融合流量异常、异地登录、高频访问等多维度特征,实现了对外部恶意数据爬取与内部数据窃取行为的有效识别。在医院OA、互联网挂号及医院信息系统(Hospital Information System, HIS)中的实践证明,该体系成功识别了多起外部渗透与内部违规事件,显著增强了系统对数据泄露风险的主动防御能力。证明基于UEBA的防护体系可系统化地应对医疗场景下的数据爬取威胁,为智慧医院信息安全建设提供可复制、可推广的实践路径。
文摘近年来,随着信息技术的快速发展和信息资源重要性的日益凸显,网络安全事件的数量与频率大幅提升,攻击者组织化、目标定向化、技术多样化的攻击行为成为新的趋势。偏重于外部攻击全局预警的态势感知和侧重于内部威胁检测的用户实体行为分析(User and Entity Behavior Analytics,UEBA)衔接,可以高效解决以人、资产、应用为维度的账号安全和数据安全问题。本文总结了基于UEBA的网络安全态势感知技术现状,并从大规模异构平台安全管理角度,对未来的发展方向进行了分析。
文摘This paper studies cyber risk management by integrating contextual log analysis with User and Entity Behavior Analytics (UEBA). Leveraging Python scripting and PostgreSQL database management, the solution enriches log data with contextual and behavioral information from Linux system logs and semantic datasets. By incorporating Common Vulnerability Scoring System (CVSS) metrics and customized risk scoring algorithms, the system calculates Insider Threat scores to identify potential security breaches. The integration of contextual log analysis and UEBA [1] offers a proactive defense against insider threats, reducing false positives and prioritizing high-risk alerts.
文摘伴随企业业务的不断扩增和电子化发展,企业自身数据和负载数据都开始暴增。然而,作为企业核心资产之一的内部数据,却面临着日益严峻的安全威胁。越来越多以周期长、频率低、隐蔽强为典型特征的非明显攻击绕过传统安全检测方法,对大量数据造成损毁。当前,用户实体行为分析(User and Entity Behavior Analytics,UEBA)系统正作为一种新兴的异常用户检测体系在逐步颠覆传统防御手段,开启网络安全保卫从“被动防御”到“主动出击”的新篇章。因此,将主要介绍UEBA在企业异常用户检测中的应用情况。首先,通过用户、实体、行为三要素的关联,整合可以反映用户行为基线的各类数据;其次,定义4类特征提取维度,有效提取几十种最能反映用户异常的基础特征;再次,将3种异常检测算法通过集成学习方法用于异常用户建模;最后,通过异常打分,定位异常风险最大的一批用户。在实践中,对排名前10的异常用户进行排查,证明安恒信息的UEBA落地方式在异常用户检测中极其高效。
文摘大多数操作系统的安全防护主要依赖基于签名或基于规则的方法,因此现有大多数的异常检测方法精度较低。因此,利用贝叶斯模型为同类群体建模,并结合时间效应与分层原则,为用户实体行为分析(User and Entity Behavior Analytics,UEBA)研究提供精度更高的数据集。然后,将基于实际记录的用户行为数据与贝叶斯层级图模型推测出的数据进行比较,降低模型中的误报率。该方法主要分为两个阶段:在第1阶段,基于数据驱动的方法形成用户行为聚类,定义用户的个人身份验证模式;在第2阶段,同时考虑到周期性因素和分层原则,并通过泊松分布建模。研究表明,数据驱动的聚类方法在减少误报方面能够取得更好的结果,并减轻网络安全管理的负担,进一步减少误报数量。
文摘The research aim is to develop an intelligent agent for cybersecurity systems capable of detecting abnormal user behavior using deep learning methods and ensuring interpretability of decisions.A four-module architecture is proposed:log collection and aggregation,behavioral feature generation,analysis using the Long Short-Term Memory(LSTM)+Attention model,and an interpretation module.A hybrid approach is used that combines log processing,temporal neural networks and an attention mechanism to identify significant actions in the behavioral chain.Testing was conducted on the Computer Emergency Response Team(CERT)and the Australian Defence Force Academy Linux Dataset(ADFA-LD)datasets.The developed system demonstrated high accuracy rates(ROC-AUC>0.95),as well as superiority over classical and modern models(Logistic Regression,Random Forest,and Autoencoder).The attention mechanism ensured interpretability:it became possible to visually determine which user actions caused the alarm.A method for preparing logs and forming training samples is proposed.The intelligent agent can be integrated into corporate Security Information and Event Management(SIEM)/User and Entity Behavior Analytics(UEBA)systems,used in monitoring centers and applied in educational practice.Scientific novelty is manifested in the architecture,the use of attention in logs and interpretable behavior analysis in real time.
