Analysis of User's Abnormal Behavior Based on Behavior Sequence in Enterprise Network

摘要

There are many abnormal user behavior in the enterprise network environment, how to monitor it effectively is a hot research hotspot. At present, the analysis of abnormal behavior is mainly through the means of traffic monitoring, but there is no precise definition and related research on the behavior of enterprise network users. Therefore, the paper propose a model to analyze the abnormal behavior of enterprise network users. First, the data from the monitoring log of enterprise network should be pre-processing and the user behavior are serializing; then, for each user behavior sequence in sequence databases, calculating the user behavior similarity and correlation coefficient in a week by the improved algorithm; finally, comparing the similarity and the correlation coefficient between users and finding the user abnormal behavior. In this paper, we use the model to verify the feasibility of the internal network of the company, and find out the user's abnormal behavior.