SYSTEM FOR DETECTING ABNOMAL BEHAVIORS USING PERSONALIZED EARLY USE BEHAVIOR PATTERN ANALSIS

摘要

The present invention relates to a system for detecting an abnormal behavior, which detects an abnormal use behavior of a user in a bring your own device (BYOD) environment and a smart work environment. The system includes: a contextual information receiving unit which receives various kinds of contextual information from a contextual information collecting system; a contextual information processing unit which generates, when the contextual information about web service use is received, a detection requesting message according to the contextual information and transmits the detection requesting message to an abnormality detecting unit; the abnormality detecting unit which detects, when the detection requesting message is received, the abnormal use behavior by comparing the order of pages used immediately after user access and use speed with a pattern at the time of past access by using an early use behavior pattern analysis; a profile managing unit which profiles, stores and manages pieces of the contextual information according to the various use behaviors of the user; and an information analyzing unit which analyzes information on use of a website or a DB based on the received pieces of the contextual information. Unlike an existing network based security device by using a network traffic analysis, the present invention has realized a measure to detect the abnormal behavior by patterning behaviors based on various behavioral elements such as time, positions, access networks, used devices, etc. of a target object. The system for detecting the abnormal behavior according to the present invention is for promoting system security in the BYOD environment and the smart work environment and detects the behaviors including abnormal access and use, etc. of a terminal device by using the personalized early use behavior pattern analysis after processing the contextual information into access, use and agent contextual information and profile information.