CN103399939A - Correlation analysis method and system for audit of accounts and files - Google Patents
Correlation analysis method and system for audit of accounts and files Download PDFInfo
- Publication number
- CN103399939A CN103399939A CN2013103481437A CN201310348143A CN103399939A CN 103399939 A CN103399939 A CN 103399939A CN 2013103481437 A CN2013103481437 A CN 2013103481437A CN 201310348143 A CN201310348143 A CN 201310348143A CN 103399939 A CN103399939 A CN 103399939A
- Authority
- CN
- China
- Prior art keywords
- account number
- file
- behavior
- eigenwert
- unique corresponding
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Information Transfer Between Computers (AREA)
Abstract
The invention provides a correlation analysis method and system for audit of accounts and files. The correlation analysis method for audit of the accounts and the files comprises the following steps of (1) carrying out monitoring on online behaviors of a user, and (2) analyzing login behaviors of the user. The correlation analysis method and system for audit of the accounts and the files have the advantages that according to the method of extracting characteristic values through a plurality of steps and summarizing attachment correlation, a plurality of single data messages are correlated through specific keywords, the correlation relation is set up among the amount login motion, the file uploading motion and the content of uploaded files, and integrity is improved.
Description
Technical field
The present invention relates to processing data information, relate in particular to account number and document audit association analysis method and system.
Background technology
The audit of tradition account or file, search the current data packet key word as " account=" and " filename=", if in mating and can mating, just extract account and fileinfo.
Depend on the individual data package informatin, if this packet the inside does not have account or fileinfo, can't audit account or file.And generally, account only is present in to log in wraps the inside, and the behavior except logging in may be without account information; File is present in usually uploads this action bag the inside of annex, and fileinfo may not be carried in the transmission behavior of the real mail with annex etc.So just caused account and document audit to be lost.
Summary of the invention
, in order to solve the problems of the prior art, the invention provides a kind of account number and document audit association analysis method.
The invention provides a kind of account number and document audit association analysis method, comprise the steps:
A. supervisory user internet behavior;
B. the login behavior of analysis user;
C. judge whether the account number login is successful, as account number, logins successfully, and performs step so D, as unsuccessful in the account number login, finish so;
D. preserve the incidence relation of account number and eigenwert;
E. judge whether upload file,, as upload file, perform step so F, as there is no upload file, finish so;
F. preserve the incidence relation of file and eigenwert;
G. the file uploaded of reduction.
As a further improvement on the present invention, account and document audit association analysis method also comprise the steps:
H. judged whether that the user submits behavior to,, if there is the user to submit behavior to, obtained so reduction file and the account number incidence relation uploaded and then perform step I,, if there is the user to submit behavior to, performed step so I;
I. overtime release is data cached.
As a further improvement on the present invention, in described steps A, carry out the message collection, from network interface card, read message and gather.
As a further improvement on the present invention, in described step B, carry out message analysis, analyze the data that message produces.
As a further improvement on the present invention, in described step D, according to the message that logs in data, obtain account, and searching and the unique corresponding sign associating key word of account number and with the unique corresponding key value of account number, be saved in data storage area with the sign associating key word of the unique correspondence of account number and with the unique corresponding key value of account number.
As a further improvement on the present invention, in described step F, obtain the fileinfo of uploading, find with the unique corresponding sign associating key word of file and with the unique corresponding key value of file, be saved in data storage area with the sign associating key word of the unique correspondence of file and with the unique corresponding key value of file.
As a further improvement on the present invention, in described step G, file is reduced, raw address gone back in record, and download is provided.
The present invention also provides a kind of account number and document audit correlation analysis system, comprising:
Monitoring unit, be used for the supervisory user internet behavior;
Analytic unit, be used for the login behavior of analysis user;
Account number login judging unit, be used for judging whether the account number login is successful, as account number, logins successfully, and carries out so account number and eigenwert associative cell, and is as unsuccessful in the account number login, finishes so;
Account number and eigenwert associative cell, be used for preserving the incidence relation of account number and eigenwert;
The File Upload judging unit, be used for judging whether upload file, as upload file, and execute file and eigenwert associative cell so, as there is no upload file, finish so;
File and eigenwert associative cell, be used for preserving the incidence relation of file and eigenwert;
Reduction unit, be used for the file that reduction is uploaded.
As a further improvement on the present invention, account and document audit correlation analysis system also comprise:
The user submits the behavior judging unit to, be used for having judged whether that the user submits behavior to,, if there is the user to submit behavior to, obtains so file and the account number incidence relation that reduction uploads and then carry out the release buffer unit,, if there is the user to submit behavior to, carries out so and discharge buffer unit;
Discharge buffer unit, be used for overtime release data cached.
As a further improvement on the present invention,
In described monitoring unit, carry out the message collection, read message and gather from network interface card;
In described analytic unit, carry out message analysis, analyze the data that message produces;
In described account number and eigenwert associative cell, according to the message that logs in data, obtain account, and searching and the unique corresponding sign associating key word of account number and with the unique corresponding key value of account number, be saved in data storage area with the sign associating key word of the unique correspondence of account number and with the unique corresponding key value of account number;
In described file and eigenwert associative cell, obtain the fileinfo of uploading, find with the unique corresponding sign associating key word of file and with the unique corresponding key value of file, be saved in data storage area with the sign associating key word of the unique correspondence of file and with the unique corresponding key value of file;
In described reduction unit, file is reduced, raw address gone back in record, and download is provided.
The invention has the beneficial effects as follows: the present invention extracts by the multi-step characteristic value, sum up out the method for accessory association, a plurality of forms data messages are associated by specific key word, make account number login action, File Upload action and upload file content set up incidence relation, integrality gets a promotion.
Description of drawings
Fig. 1 is account number of the present invention and document audit association analysis method process flow diagram.
Fig. 2 is account number of the present invention and document audit association analysis method one embodiment process flow diagram.
Embodiment
As shown in Figure 1, the invention discloses a kind of account number and document audit association analysis method, comprise the steps:
In step S1, the supervisory user internet behavior;
In step S2, the login behavior of analysis user;
In step S3, judge whether the account number login is successful, as account number, logins successfully, and performs step so S4, as unsuccessful in the account number login, finish so;
In step S4, preserve the incidence relation of account number and eigenwert;
In step S5, judge whether upload file,, as upload file, perform step so S6, as there is no upload file, finish so;
In step S6, preserve the incidence relation of file and eigenwert;
In step S7, the file that reduction is uploaded.
As shown in Figure 2, as one embodiment of the invention, account and document audit association analysis method also comprise the steps:
In step S8, judged whether that the user submits behavior to,, if there is the user to submit behavior to, obtains so reduction file and the account number incidence relation uploaded and then perform step S9,, if there is the user to submit behavior to, perform step so S9;
In step S9, overtime release is data cached.
In described step S1, carry out the message collection, read message and gather from network interface card.
In described step S2, carry out message analysis, analyze the data that message produces.
In described step S4, according to the message that logs in data, obtain account, and searching and the unique corresponding sign associating key word of account number and with the unique corresponding key value of account number, be saved in data storage area with the sign associating key word of the unique correspondence of account number and with the unique corresponding key value of account number.
In step S4, for example account number is apple, and the sign associating key word of the unique correspondence of account number is KID, with the unique corresponding key value of account number, is 123; For example another account number is orange, and the sign associating key word of the unique correspondence of account number is KID, with the unique corresponding key value of account number, is 456.Although the sign associating key word that account number apple and orange are corresponding is KID, corresponding key value is different, can distinguish.
In described step S6, obtain the fileinfo of uploading, find with the unique corresponding sign associating key word of file and with the unique corresponding key value of file, be saved in data storage area with the sign associating key word of the unique correspondence of file and with the unique corresponding key value of file.
In step S6, for example, with the unique corresponding sign associating key word of file, be KID, be 123 with the unique corresponding key value of file, can confirm that so just this document is that the apple account number is uploaded.
In described step S7, file is reduced, raw address gone back in record, and download is provided.
In step S8, the user submits to behavior to refer to determine whether that according to message analysis the user submits behavior to, specifically refers to determine whether that according to data message the user sends the contents such as file the behavior of data, such as sending out mail and posting etc.
The invention also discloses a kind of account number and document audit correlation analysis system, comprising:
Monitoring unit, be used for the supervisory user internet behavior;
Analytic unit, be used for the login behavior of analysis user;
Account number login judging unit, be used for judging whether the account number login is successful, as account number, logins successfully, and carries out so account number and eigenwert associative cell, and is as unsuccessful in the account number login, finishes so;
Account number and eigenwert associative cell, be used for preserving the incidence relation of account number and eigenwert;
The File Upload judging unit, be used for judging whether upload file, as upload file, and execute file and eigenwert associative cell so, as there is no upload file, finish so;
File and eigenwert associative cell, be used for preserving the incidence relation of file and eigenwert;
Reduction unit, be used for the file that reduction is uploaded.
Account and document audit correlation analysis system also comprise:
The user submits the behavior judging unit to, be used for having judged whether that the user submits behavior to,, if there is the user to submit behavior to, obtains so file and the account number incidence relation that reduction uploads and then carry out the release buffer unit,, if there is the user to submit behavior to, carries out so and discharge buffer unit;
Discharge buffer unit, be used for overtime release data cached.
In described monitoring unit, carry out the message collection, read message and gather from network interface card;
In described analytic unit, carry out message analysis, analyze the data that message produces;
In described account number and eigenwert associative cell, according to the message that logs in data, obtain account, and searching and the unique corresponding sign associating key word of account number and with the unique corresponding key value of account number, be saved in data storage area with the sign associating key word of the unique correspondence of account number and with the unique corresponding key value of account number;
In described file and eigenwert associative cell, obtain the fileinfo of uploading, find with the unique corresponding sign associating key word of file and with the unique corresponding key value of file, be saved in data storage area with the sign associating key word of the unique correspondence of file and with the unique corresponding key value of file;
In described reduction unit, file is reduced, raw address gone back in record, and download is provided.Method and system of the present invention can be used for mailbox system and forum and post etc. and to need the account to login system with upload file.
Before the present invention produces, account number with upload annex can't be related, the disappearance of audit information, cause bad impact to the user.By the long-time investigation analysis, the present invention extracts by the multi-step characteristic value, sum up out the method for accessory association, a plurality of forms data messages are associated by specific key word, make account number login action, File Upload action and upload file content set up incidence relation.
The model contrast:
| Audit form | Account number | File | Other information |
| Traditional audit | May lose | May lose | Complete |
| The present invention | Complete | Complete | Complete |
Above content is in conjunction with concrete preferred implementation further description made for the present invention, can not assert that specific embodiment of the invention is confined to these explanations.For the general technical staff of the technical field of the invention, without departing from the inventive concept of the premise, can also make some simple deduction or replace, all should be considered as belonging to protection scope of the present invention.
Claims (10)
1. an account number and document audit association analysis method, is characterized in that, comprises the steps:
A. supervisory user internet behavior;
B. the login behavior of analysis user;
C. judge whether the account number login is successful, as account number, logins successfully, and performs step so D, as unsuccessful in the account number login, finish so;
D. preserve the incidence relation of account number and eigenwert;
E. judge whether upload file,, as upload file, perform step so F, as there is no upload file, finish so;
F. preserve the incidence relation of file and eigenwert;
G. the file uploaded of reduction.
2. account number according to claim 1 and document audit association analysis method, is characterized in that, account and document audit association analysis method also comprise the steps:
H. judged whether that the user submits behavior to,, if there is the user to submit behavior to, obtained so reduction file and the account number incidence relation uploaded and then perform step I,, if there is the user to submit behavior to, performed step so I;
I. overtime release is data cached.
3. account number according to claim 1 and document audit association analysis method, is characterized in that, in described steps A, carries out the message collection, from network interface card, reads message and gather.
4. account number according to claim 3 and document audit association analysis method, is characterized in that, in described step B, carries out message analysis, analyzes the data that message produces.
5. account number according to claim 3 and document audit association analysis method, it is characterized in that, in described step D, according to the message that logs in data, obtain account, and searching and the unique corresponding sign associating key word of account number and with the unique corresponding key value of account number, be saved in data storage area with the sign associating key word of the unique correspondence of account number and with the unique corresponding key value of account number.
6. account number according to claim 5 and document audit association analysis method, it is characterized in that, in described step F, obtain the fileinfo of uploading, find with the unique corresponding sign associating key word of file and with the unique corresponding key value of file, be saved in data storage area with the sign associating key word of the unique correspondence of file and with the unique corresponding key value of file.
7. account number according to claim 6 and document audit association analysis method, is characterized in that, in described step G, file reduced, and raw address gone back in record, and download is provided.
8. an account number and document audit correlation analysis system, is characterized in that, comprising:
Monitoring unit, be used for the supervisory user internet behavior;
Analytic unit, be used for the login behavior of analysis user;
Account number login judging unit, be used for judging whether the account number login is successful, as account number, logins successfully, and carries out so account number and eigenwert associative cell, and is as unsuccessful in the account number login, finishes so;
Account number and eigenwert associative cell, be used for preserving the incidence relation of account number and eigenwert;
The File Upload judging unit, be used for judging whether upload file, as upload file, and execute file and eigenwert associative cell so, as there is no upload file, finish so;
File and eigenwert associative cell, be used for preserving the incidence relation of file and eigenwert;
Reduction unit, be used for the file that reduction is uploaded.
9. account number according to claim 8 and document audit correlation analysis system, is characterized in that, account and document audit correlation analysis system also comprise:
The user submits the behavior judging unit to, be used for having judged whether that the user submits behavior to,, if there is the user to submit behavior to, obtains so file and the account number incidence relation that reduction uploads and then carry out the release buffer unit,, if there is the user to submit behavior to, carries out so and discharge buffer unit;
Discharge buffer unit, be used for overtime release data cached.
10. account number according to claim 8 and document audit correlation analysis system, is characterized in that,
In described monitoring unit, carry out the message collection, read message and gather from network interface card;
In described analytic unit, carry out message analysis, analyze the data that message produces;
In described account number and eigenwert associative cell, according to the message that logs in data, obtain account, and searching and the unique corresponding sign associating key word of account number and with the unique corresponding key value of account number, be saved in data storage area with the sign associating key word of the unique correspondence of account number and with the unique corresponding key value of account number;
In described file and eigenwert associative cell, obtain the fileinfo of uploading, find with the unique corresponding sign associating key word of file and with the unique corresponding key value of file, be saved in data storage area with the sign associating key word of the unique correspondence of file and with the unique corresponding key value of file;
In described reduction unit, file is reduced, raw address gone back in record, and download is provided.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2013103481437A CN103399939A (en) | 2013-08-09 | 2013-08-09 | Correlation analysis method and system for audit of accounts and files |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2013103481437A CN103399939A (en) | 2013-08-09 | 2013-08-09 | Correlation analysis method and system for audit of accounts and files |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN103399939A true CN103399939A (en) | 2013-11-20 |
Family
ID=49563567
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2013103481437A Pending CN103399939A (en) | 2013-08-09 | 2013-08-09 | Correlation analysis method and system for audit of accounts and files |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103399939A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104219330A (en) * | 2014-09-29 | 2014-12-17 | 北京神州绿盟信息安全科技股份有限公司 | Method and system for auditing screen record based on WEB proxy |
| CN107066538A (en) * | 2017-03-06 | 2017-08-18 | 北京安博通科技股份有限公司 | A kind of method and device of data statistics |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1804882A (en) * | 2006-01-25 | 2006-07-19 | 深圳市中科新业信息科技发展有限公司 | Virtual population system and its building method |
| CN102130847A (en) * | 2011-02-18 | 2011-07-20 | 杭州迪普科技有限公司 | Audit method and device of web mails |
| CN102594880A (en) * | 2012-02-07 | 2012-07-18 | 北京锐安科技有限公司 | Method for combining data of two sessions in Hyper Text Transport Protocol (HTTP) protocol recovery |
| CN102819546A (en) * | 2011-12-29 | 2012-12-12 | 金蝶软件（中国）有限公司 | Method and device for associating attachments |
| CN102868738A (en) * | 2012-08-30 | 2013-01-09 | 福建富士通信息软件有限公司 | Hyper text transfer protocol (HTTP)/hypertext transfer protocol secure (HTTPS) behavior management and control auditing method based on Web proxy |
| CN103095680A (en) * | 2012-11-12 | 2013-05-08 | 瑞斯康达科技发展股份有限公司 | Method identifying login user and device |
-
2013
- 2013-08-09 CN CN2013103481437A patent/CN103399939A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1804882A (en) * | 2006-01-25 | 2006-07-19 | 深圳市中科新业信息科技发展有限公司 | Virtual population system and its building method |
| CN102130847A (en) * | 2011-02-18 | 2011-07-20 | 杭州迪普科技有限公司 | Audit method and device of web mails |
| CN102819546A (en) * | 2011-12-29 | 2012-12-12 | 金蝶软件（中国）有限公司 | Method and device for associating attachments |
| CN102594880A (en) * | 2012-02-07 | 2012-07-18 | 北京锐安科技有限公司 | Method for combining data of two sessions in Hyper Text Transport Protocol (HTTP) protocol recovery |
| CN102868738A (en) * | 2012-08-30 | 2013-01-09 | 福建富士通信息软件有限公司 | Hyper text transfer protocol (HTTP)/hypertext transfer protocol secure (HTTPS) behavior management and control auditing method based on Web proxy |
| CN103095680A (en) * | 2012-11-12 | 2013-05-08 | 瑞斯康达科技发展股份有限公司 | Method identifying login user and device |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104219330A (en) * | 2014-09-29 | 2014-12-17 | 北京神州绿盟信息安全科技股份有限公司 | Method and system for auditing screen record based on WEB proxy |
| CN104219330B (en) * | 2014-09-29 | 2017-09-29 | 北京神州绿盟信息安全科技股份有限公司 | It is a kind of that the method and system for carrying out record screen audit are acted on behalf of based on WEB |
| CN107066538A (en) * | 2017-03-06 | 2017-08-18 | 北京安博通科技股份有限公司 | A kind of method and device of data statistics |
| CN107066538B (en) * | 2017-03-06 | 2020-09-01 | 北京安博通科技股份有限公司 | Data statistics method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Nguyen et al. | Automatic image filtering on social networks using deep learning and perceptual hashing during crises | |
| CN104601556A (en) | Attack detection method and system for WEB | |
| CN110046929B (en) | Fraudulent party identification method and device, readable storage medium and terminal equipment | |
| CN103795612A (en) | Method for detecting junk and illegal messages in instant messaging | |
| CN105704685B (en) | Short message safety processing method and device | |
| CN103064987A (en) | Bogus transaction information identification method | |
| CN104331487B (en) | The processing method and processing device of log | |
| CN104869009A (en) | Website data statistics system and method | |
| CN107784205B (en) | User product auditing method, device, server and storage medium | |
| CN103593371A (en) | Method and device for recommending search keywords | |
| CN102045268B (en) | A kind of e-mail data restoration methods and device | |
| CN109698798B (en) | Application identification method and device, server and storage medium | |
| CN106802904A (en) | Log processing method, apparatus and system | |
| CN105224604A (en) | A kind of microblogging incident detection method based on heap optimization and pick-up unit thereof | |
| CN109474510B (en) | Mailbox safety cross audit method, system and storage medium | |
| CN110457601B (en) | Social account identification method and device, storage medium and electronic device | |
| CN109213858A (en) | A kind of automatic identifying method and system of network navy | |
| CN103812679A (en) | Mass log statistical analysis system and method | |
| CN103399939A (en) | Correlation analysis method and system for audit of accounts and files | |
| CN105591747B (en) | Assisted identity authentication method based on user network behaviors feature | |
| CN108494635A (en) | A kind of network flow detection system based on cloud computing | |
| CN109600428A (en) | A kind of automation uploads attachment and matches associated method and apparatus | |
| CN103200180B (en) | By the method and system of user's identification protecting network behavior | |
| CN104484330A (en) | Pre-selecting method and device of spam comments based on grading keyword threshold combination evaluation | |
| US10986230B1 (en) | Method and apparatus to capture, analyze, organize, and present support chat information |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20131120 |
|
| RJ01 | Rejection of invention patent application after publication |