MONITORING SYSTEM users work with information resources of a corporate computer network based on modeling user behavior in order to find anomalies and changes in work

摘要

The invention relates to the field of computer technology, in particular to the work users of computer networks settings to collect and analyze system information and computing resources of the local network. The technical result is the collection and consolidation of descriptions of user activity, as well as detection of abnormal actions of individual users, aimed at the use of resources, as well as the detection of changes in the composition of their resources and their usage statistics. The technical result is achieved in that the system comprises a scalable suite of modules 1 acquisition parameters the user experience with network resources, allowing submit work people are a set of descriptions of completed actions of users to work with the resources, each of which represented a set of typed attributes, among which must include the user name , the computer name and time of action. Module 2 storage built user experience descriptions module 3 constructing models of user behavior, describing statistical relationships and correlations between attributes, e.g., in the form of association rules for attributes of users working descriptions of values, module 4 ratings abnormality user experience descriptions attributes based on the constructed models of behavior and module 5 calculations on the basis of statistics of users descriptions of attribute values ​​of work and presentation of statistics in the form of an OLAP cube and comparisons histograms describing the parameters of the user derived from an OLAP cube.