Research On User Activity Intelligence Audit Method In A Non-invasive Way

Today,cloud computing has been widely used in various fields.As one of the delivery of cloud computing,DaaS have been adopted by the vast number of enterprises,also because of the trend of mobile workforce.However,due to the bitmap information transmitted by the Remote Desktop Protocol(RDP)currently used mainly by DaaS,auditing user behavior requires a lot of manual assistance,which is very inefficient,causing DaaS to face the challenge of insider threats.The damage cause by insider attacks are often catastrophic.Therefore,applying efficient audit method on user activity in remote desktop is particularly important.Focusing on the current security problems of desktop services,a non-invasive desktop services gateway is proposed to collect user activity information in remote desktop.Then on the basis of these user activity information,a multi-level user activity audit model based on image features is proposed.This model includes three audit levels:L1,L2 and L3 audits.L1 audit can records and replays all user actions in the remote desktop process;L2 audit can recognize applications at the application startup time.L3 audit can recognize applications at any time.The multi-level user activity audit model can effectively assist administrators in auditing user activity in the process of remote desktop efficiently.Experiments proves that multi-level user activity audit model based on image features is feasible and the system time loss is acceptable.