User behavior-based semi-supervised network service host threat detection

In recent years, internal threats have occurred frequently and become the main factor of network security threats.However, due to the hidden characteristics of internal threats, it is difficult to detect them by methods based on specific conditions.At present,most of the detection technologies based on user behavior rely on expert knowledge and require human to determine the threshold model parameters,which cannot realize automatic learning of the system,and it is difficult to find abnormal behaviors that deliberately hide behavior characteristics.For the problem of internal threat detection,the semi supervised network service host abnormal behavior monitoring method uses specific triggered security events as positive samples to establisha multi-dimensional feature statistical threshold model,and uses intelligent algorithms to model the threat behavior patterns that have occurred in the network service host,then finds out all risk users with similar behavior patterns, and realizes the prediction of network abnormal behavior,so as to detect the internal threats of the network.