Abstract:

Many companies have faced internal information security issues at present, the theft of core information causes incalculable losses. The internal monitoring log records the employee’s operational behavior and access records. Therefore, it is of great significance to timely discover the abnormal behavior of employees by effectively analyzing the internal monitoring logs. However, the existing methods of log analysis cannot be combined with a variety of user behavior logs for the effective analysis and timely detection of abnormal behaviors for early warning. In order to solve these problems, a novel visualization system MLVis based on log multidimensionality and temporality is proposed. By designing multiple visual views, implementing an interactive visual analysis system, the system can help decision makers discover anomalous behavior, locate abnormal employees, and analyze the connections between abnormal events. Finally, the data set of ChinaVis2018 Challenge I is used for experiment and case analysis, the results show that the system is feasible and effective.

Key words: monitoring log, abnormal behavior, multiple visual views, visual analysis

摘要：

当前许多企业面临着来自内部的信息安全问题，由于核心信息的窃取而造成无法估量的损失。企业内部的监控日志数据记录了员工的操作行为与访问记录，通过对内部监控日志进行有效的分析以及时发现员工的异常行为具有重要的意义。然而现有的关于日志分析的方法不能很好地结合多种用户行为日志进行有效分析，并及时发现异常行为提前进行预警。针对这一问题，基于日志的多维性和时序性，提出了一种新颖的可视化系统MLVis。通过设计多个可视化视图，实现一个交互式的可视分析系统，可以帮助决策者发现异常行为，定位异常员工，并分析异常行为之间的联系。采用ChinaVis2018挑战赛I的数据集进行实验和案例分析，验证了该系统的可行性和有效性。

关键词: 监控日志, 异常行为, 多视图, 可视分析