中国科学院软件研究所机构知识库

How to prevent internal risks to the information system, especially for undefined risks, is a great challenge. A reasonable approach is to mine the behavior rules of internal staff on historical data through various data mining algorithms and then use the behavior rules to detect abnormal behaviors. However, in practice, risk control officers are often not familiar with data mining technologies, so it is hard to make them effectively choose and adapt these algorithms to find internal risks. In this paper, we propose an interactive approach for behavior rule mining and anomaly detection. Firstly, we express behavior rules and abnormal behaviors as complex events uniformly to accommodate different mining algorithms. Then, the internal staff’s history behavior logs generated during production are used for mining behavior rules. Next, mined behavior rules are applied to new logs for anomaly detection. Finally, the detected abnormal behavior will be reported to the risk control officer for evaluation, and the feedback will be used for improving mining and detection settings to form a gradual and interactive process. The experiments on the real production data show that the approach is effective and efficient to detect abnormal behavior and can be used to prevent internal risks of the information system of big corporations such as banks.