基于相似度分析的电力信息内网用户行为异常预警方法

用户作为网络的重要主体，对其进行行为分析是掌握网络安全状态的重要手段，且在异常检测中对于潜在威胁挖掘和预警具有重要的意义. 本文从电力信息内网同类型用户间行为存在相似性的角度考虑，基于时间行为序列建模对单个用户的行为进行描述，并通过用户行为相似情况的自学习建立用户间的关联，以行为相似偏差实现异常分析，同时考虑用户基础属性的变化实现异常预警判定. 通过模拟实验，该方法能够有效地利用行为序列间的相似度发现潜在的异常行为并进行预警.

Early Warning Method of Anomaly User Behavior Based on Similarity Analysis in Power Intranet

As an important subject of the network, the behavior analysis of users is an important means to grasp the network security state and has a significant meaning on potential threat mining and early warning. Considering that users of similar roles in the power intranet have similar behaviors, this paper describes the behavior of individual users based on time sequence and builds behavior relevance among the users by self-learning of the similarity of users'' behaviors to achieve abnormality analysis by means of behavior similarity deviation. Meanwhile, changes of users'' basic attributes are considered to achieve abnormality early warning judgment. Simulation experiments show that the method can discover abnormal behavior and perform early warning by effectively using the similarity analysis of the behavioral sequences.