Method for Identifying Abnormal Access to Sensitive Data Based on Network Flow
Yong Ma, Jing Feng, Jingyi Li · Journal of Physics Conference Series · 2020
Abstract With the increasing scale and quantity of civil aviation information system, the data carried in the information system is becoming more and more important and sensitive. In the face of a large number of information systems, sorting out and monitoring whether passenger information in the information system has been accessed in violation of regulations is an urgent problem in the civil aviation industry. In this paper, the civil aviation business system is deeply studied, and a method of identifying abnormal access to sensitive data based on network traffic is proposed. Through the collection and analysis of network traffic, and then identify the sensitive information in the network traffic, and use k-means clustering method to classify the access behavior of sensitive information. Finally, combined with expert experience, the malicious access behavior for sensitive data is accurately identified.