Semantic Integration based User Behavior Monitoring Framework in Zero Trust Network
Yansheng Qu, Hua Huang, Lin Chen, Lina Zhao, Yuxiang Zhao, Jie Zhang, Bo Mao · 2022
User behavior monitoring is an essential task in Zero Trust Network. In this paper, a semantic analysis framework is proposed to generate an integrated network user behavior which can be applied for abnormal detection. The framework first defines an unified network behavior structure which covers different network layers; then a knowledge graph of the network is created based on the entity detection and classification of the logs and dataflow in different devices; based on the graph, network data in different layers is integrated and their keywords are collected to classify the behavior semantically and generate the finally network behavior description for further analysis. A demo system is implemented to test the accuracy of the proposed method, the results indicate that the suggested framework can effectively identify the semantic behavior in the network with overall accuracy 87% which over performs the existing behavior monitoring methods.