## 3 Structure of SA-UBA  
SA-UBA consists of two subsystems. The User Behavior Audit subsystem is used to determine the behaviors of privileged users in accessing resources, monitoring these behaviors during the event, and auditing them afterward. We propose a new deep-learning-based text information extraction module for the user behavior audit applied in this subsystem, tackling the challenge of the automatically graphical system audit. The Privileged Account Management subsystem is used to manage privileged accounts by providing secure privileged account storage and management, providing the security guarantee of a user behavior audit. To ensure the security of the system itself, the subsystem adopts cryptography-based account storage and sharing methods to prevent password leakage even if the system is compromised. Hard-coded elimination and code-obfuscation technology have also been adopted to protect the codes. As shown in Figure 1, SA-UBA implements three functions: the red line represents the user-access process, the blue line represents the application-access process, and the yellow line represents the user behavior audit process. * **Secure access to the cloud resources by privileged users:** As shown by the red line in Figure 1: (1) The SA-UBA system allows users to access cloud platform resources with a browser. (2) Before establishing the connection with a resource on the cloud, the users' identity needs to be authenticated by the Accounts Password Management \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Related Work**} & \multirow{2}{*}{\
\begin{tabular}{c} **Objects** \\ **Managed** \\ \end{tabular} } & \multirow{2}{*}{**Client Agent**} & \multirow{2}{*}{**Modify Code**} & \multirow{2}{*}{
\begin{tabular}{c} **Code** \\ **Obfuscation** \\ \end{tabular} } \\ \hline
[9] & User & \(\surd\) & — & — \\
[10] & User & \(\times\) & — & — \\
[20] & User & \(\times\) & — & — \\
[12] & Application & \(\surd\) & \(\surd\) & \(\times\) \\
[13] & Application & \(\times\) & \(\times\) & \(\times\) \\ \hline Our System & Both & \(\times\) & \(\times\) & \(\surd\) \\ \hline \multirow{2}{*}{Related Work} & Video & \multirow{2}{*}{Fine-Grained} & \multirow{2}{*}{
\begin{tabular}{c} Automatically \\ Audit \\ \end{tabular} } \\  & & & Audit \\ \hline
[5; 6; 7; 8; 17] & \(\times\) & \(\times\) & \(\surd\) \\ \hline
[18; 19] & \(\surd\) & \(\times\) & \(\times\) \\ \hline Our System & \(\surd\) & \(\surd\) & \(\surd\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of privileged account management and user behavior audit. Figure 1: Overall structure of SA-UBA. The red line represents the user-access process, the blue line represents the application-access process, and the yellow line represents the user behavior audit process. Before users and applications access the system, all privileged accounts will be statistically stored and managed by the Accounts Password Management module. module. If the authentication succeeds, the token will be returned to the user for accessing the resource. (3) The user applies to the Secure Access Proxy with the token to access resources. Once the connection is established, the proxy is responsible for communicating between the users and resources. (4) The Secure Access Proxy maintains the connection between users and resources. This proxy can help to extract audit information and monitor user behavior based on the analysis results of the User Behavior Audit Subsystem. * **Secure access to the cloud database by privileged applications:** As shown by the blue line in Figure 1: (1) Custom Middleware is designed to assist in the authentication of applications. Therefore, the application needs to ask the Custom Middleware for access to the cloud resources. (2) The Accounts Password Management module authenticates the fingerprint of the application and returns a token if successful. (3) Custom Middleware establishes a connection, using the token, between the certified applications and the database.