Abnormal external connection behavior detection method and device, storage medium and electronic device

Abstract

The present invention provides a detection method and device for abnormal external connection behavior, a storage medium and an electronic device, the method comprising: in the case where it is necessary to detect external connection behavior of a target domain name, determining the external connection time series corresponding to the target domain name; the external connection time series includes multiple external connection time points corresponding to the target domain name; determining the time interval series corresponding to the external connection time series; the time interval series includes multiple time intervals; according to the time interval series, determining the access volatility corresponding to the target domain name; according to the access volatility, judging whether the target domain name meets the preset abnormal condition; if the target domain name meets the preset abnormal condition, determining the external connection behavior corresponding to the target domain name as abnormal external connection behavior. The method of the present invention is applied, and abnormal detection is performed based on the time characteristics presented by the external connection behavior, which can be used to identify abnormal external connection behaviors of various domain names, which is conducive to improving the detection accuracy and ensuring the safe operation of the server.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and in particular to a method and device for detecting abnormal external connection behavior, a storage medium and an electronic device. Background Art

[0002] The server is one of the important basic resources in the information system and is also a common target of attack in the network. When the server is attacked by malicious samples such as Trojans and worms, it will initiate an external access request to the malicious domain name. Therefore, during the operation of the server, it is necessary to perform an abnormal detection on the server's external connection behavior to determine whether there is abnormal external connection behavior, so as to facilitate security protection.

[0003] At present, for the detection of abnormal external connection behavior of the server, an abnormal domain name address is usually set. When an external connection behavior occurs, the accessed domain name address is matched with the preset abnormal domain name address. If an abnormal domain name address is matched, the current external connection behavior is identified as abnormal external connection behavior.

[0004] In the existing abnormal external connection behavior detection process, the abnormal detection is realized by relying on the matching of preset abnormal domain names. However, the configuration of abnormal domain names is usually lagging, and it is difficult to configure all malicious domain names in real time. When a malicious domain name that is not set as an abnormal domain name is accessed externally, the abnormal external connection behavior cannot be accurately identified, resulting in a low detection accuracy of abnormal external connection behavior and poor server security. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a method for detecting abnormal external connection behavior to solve the problem that the existing detection of abnormal external connection behavior depends on pre-set abnormal domain names and it is difficult to accurately identify the abnormal external connection behavior of all malicious domain names.

[0006] The embodiment of the present invention also provides a detection device for abnormal external connection behavior to ensure the actual implementation and application of the above method.

[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0008] A method for detecting abnormal outbound communication behavior, comprising:

[0009] In the case where it is necessary to detect the external connection behavior of the target domain name, determining the external connection time sequence corresponding to the target domain name; the external connection time sequence includes multiple external connection time points corresponding to the target domain name;

[0010] Determine a time interval sequence corresponding to the external connection time series; the time interval sequence includes a plurality of time intervals;

[0011] Determining the access fluctuation corresponding to the target domain name according to the time interval sequence;

[0012] According to the access fluctuation, determining whether the target domain name meets a preset abnormal condition;

[0013] If the target domain name meets the preset abnormal condition, the external connection behavior corresponding to the target domain name is determined as an abnormal external connection behavior.

[0014] In the above method, optionally, determining the external connection time series corresponding to the target domain name includes:

[0015] Acquire multiple target time points from the domain name system; each of the target time points is a time point for performing an external access to the target domain name;

[0016] Each of the target time points is used as an external connection time point corresponding to the target domain name, and the external connection time points corresponding to the target domain name are combined into the external connection time sequence according to the time sequence of each of the target time points.

[0017] In the above method, optionally, determining the time interval sequence corresponding to the external connection time series includes:

[0018] Taking each outreach time point except the last outreach time point in the outreach time series as a target outreach time point;

[0019] Determine an adjacent time point corresponding to each of the target external connection time points; the adjacent time point corresponding to each of the target external connection time points is the next external connection time point of the target external connection time point in the external connection time sequence;

[0020] For each of the target outreach time points, calculate the time interval between the target outreach time point and its corresponding adjacent time point, and use the calculation result as the time interval corresponding to the target outreach time point;

[0021] According to the time sequence of each of the target external connection time points, the time intervals corresponding to each of the target external connection time points are combined into the time interval sequence.

[0022] In the above method, optionally, determining the access fluctuation corresponding to the target domain name according to the time interval sequence includes:

[0023] Determine a sequence length corresponding to the time interval sequence;

[0024] Determining an average interval time corresponding to the time interval sequence according to the sequence length;

[0025] Determine the standard deviation corresponding to the time interval sequence according to the sequence length and the average interval time;

[0026] The quotient of the standard deviation and the average interval time is calculated, and the calculation result is used as the access fluctuation.

[0027] In the above method, optionally, determining the average interval time corresponding to the time interval sequence according to the sequence length includes:

[0028] Performing a sum operation on all time intervals in the time interval sequence to obtain a time interval sum;

[0029] The quotient of the sum of the time intervals and the sequence length is calculated, and the calculation result is used as the average interval time.

[0030] In the above method, optionally, determining the standard deviation corresponding to the time interval sequence according to the sequence length and the average interval time includes:

[0031] According to each time interval in the time interval sequence, the sequence length, the average interval time and a preset sample standard deviation calculation strategy, the sample standard deviation corresponding to each time interval is calculated, and the calculation result is used as the standard deviation corresponding to the time interval sequence.

[0032] In the above method, optionally, judging whether the target domain name meets a preset abnormal condition based on the access fluctuation includes:

[0033] Determining whether the access fluctuation is within a preset threshold range;

[0034] If the access fluctuation is within the preset threshold range, it is determined that the target domain name meets the preset abnormal condition.

[0035] A detection device for abnormal external connection behavior, comprising:

[0036] A first determination unit is used to determine an external connection time sequence corresponding to the target domain name when an external connection behavior detection is required for the target domain name; the external connection time sequence includes multiple external connection time points corresponding to the target domain name;

[0037] A second determining unit is used to determine a time interval sequence corresponding to the external connection time series; the time interval sequence includes a plurality of time intervals;

[0038] A third determining unit, configured to determine the access fluctuation corresponding to the target domain name according to the time interval sequence;

[0039] A judging unit, configured to judge whether the target domain name meets a preset abnormal condition according to the access fluctuation;

[0040] The fourth determining unit is configured to determine the external connection behavior corresponding to the target domain name as an abnormal external connection behavior if the target domain name meets the preset abnormal condition.

[0041] A storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned abnormal external connection behavior detection method.

[0042] An electronic device includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors to perform the above-mentioned abnormal external connection behavior detection method.

[0043] A detection method for abnormal external connection behavior based on the above-mentioned embodiment of the present invention includes: when it is necessary to detect external connection behavior of the target domain name, determine the external connection time series corresponding to the target domain name; the external connection time series includes multiple external connection time points corresponding to the target domain name; determine the time interval series corresponding to the external connection time series; the time interval series includes multiple time intervals; according to the time interval series, determine the access volatility corresponding to the target domain name; according to the access volatility, judge whether the target domain name meets the preset abnormal condition; if the target domain name meets the preset abnormal condition, determine the external connection behavior corresponding to the target domain name as abnormal external connection behavior. Applying the method provided by the embodiment of the present invention, the external connection behavior can be detected based on the volatility presented by the time interval of the external connection access. The inventor found through research that after being attacked by malicious samples such as Trojans and worms, the server will continuously initiate external connection access requests to the malicious domain name, and the adjacent time intervals of these external connection accesses usually show small volatility, so the abnormal external connection behavior of the server can be discovered in time, thereby capturing threats. In the method provided by the embodiment of the present invention, the detection of abnormal external connection behavior relies on the time characteristics of the external connection behavior itself, and has a low correlation with the accessed domain name. It can be used to identify abnormal external connection behavior of various domain names, which is beneficial to improving the detection accuracy of abnormal external connection behavior and then improving the security of the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A method flow chart of a method for detecting abnormal external connection behavior provided by an embodiment of the present invention;

[0046] Figure 2 A flowchart of another method for detecting abnormal external connection behavior provided by an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of the structure of a detection device for abnormal external connection behavior provided by an embodiment of the present invention;

[0048] Figure 4 Another structural schematic diagram of a device for detecting abnormal external connection behavior provided by an embodiment of the present invention;

[0049] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0052] The embodiment of the present invention provides a method for detecting abnormal external connection behavior. The method can be applied to a security protection platform, and the execution subject can be a server of the platform. The method flow chart of the method is as follows: Figure 1 As shown, including:

[0053] S101: When it is necessary to detect an external connection behavior of a target domain name, determine an external connection time sequence corresponding to the target domain name; the external connection time sequence includes multiple external connection time points corresponding to the target domain name;

[0054] In the method provided by the embodiment of the present invention, during the operation of the server, the external connection behavior of the server can be monitored. When it is monitored that the server initiates an external connection access request to a certain domain name through the Domain Name System (DNS), the domain name can be used as the target domain name. If it is monitored that the server continues to perform external connection access to the target domain name, it is deemed that the target domain name needs to be detected for external connection behavior. At this time, the external connection time sequence corresponding to the target domain name can be determined based on the external connection record of the domain name system. The external connection time sequence contains multiple external connection time points corresponding to the target domain name sorted in chronological order.

[0055] S102: Determine a time interval sequence corresponding to the external connection time series; the time interval sequence includes a plurality of time intervals;

[0056] In the method provided by the embodiment of the present invention, multiple time intervals can be calculated according to each external connection time point in the external connection time series, and each time interval can be combined into a time interval sequence corresponding to the external connection time series according to the time sequence of the time points corresponding to the time intervals.

[0057] S103: Determine the access fluctuation corresponding to the target domain name according to the time interval sequence;

[0058] In the method provided by the embodiment of the present invention, the fluctuation presented by each time interval in the time interval sequence is calculated according to the preset fluctuation calculation strategy, and the fluctuation is used as the access fluctuation corresponding to the target domain name. The access fluctuation characterizes the behavior of the server performing external access to the target domain name, and the volatility presented in the access time.

[0059] S104: judging whether the target domain name meets a preset abnormal condition according to the access fluctuation;

[0060] In the method provided by the embodiment of the present invention, an abnormal condition can be pre-set according to the fluctuation degree of the time interval of the external access, and when the domain name accessed meets the condition, it indicates that the domain name may be an abnormal domain name. It can be determined whether the target domain name meets the preset abnormal condition according to the access fluctuation degree corresponding to the current target domain name.

[0061] S105: If the target domain name meets the preset abnormal condition, the external connection behavior corresponding to the target domain name is determined as an abnormal external connection behavior.

[0062] In the method provided by the embodiment of the present invention, if the target domain name meets the preset abnormal condition, the external connection behavior corresponding to the target domain name is regarded as abnormal external connection behavior, and an abnormal external connection alarm corresponding to the target domain name can be issued. If the target domain name does not meet the preset abnormal condition, the external connection behavior corresponding to the target domain name is regarded as normal external connection behavior, and no abnormal processing is required.

[0063] Based on the method provided by the embodiment of the present invention, when it is necessary to detect the external connection behavior of the target domain name, determine the external connection time series corresponding to the target domain name, including multiple external connection time points corresponding to the target domain name; determine the time interval sequence corresponding to the external connection time series, including multiple time intervals; determine the access volatility corresponding to the target domain name based on the time interval sequence; determine whether the target domain name meets the preset abnormal conditions based on the access volatility; if the target domain name meets the preset abnormal conditions, the external connection behavior corresponding to the target domain name is determined as abnormal external connection behavior. Applying the method provided by the embodiment of the present invention, the external connection behavior can be detected based on the volatility presented by the time interval of the external connection access. The detection of abnormal external connection behavior relies on the time characteristics of the external connection behavior itself, and has a low correlation with the domain name visited. It can be used to identify abnormal external connection behaviors of various domain names (such as malicious domain names with known abnormalities and malicious domain names with unknown abnormalities), which is conducive to improving the detection accuracy of abnormal external connection behaviors and further improving the security of the server.

[0064] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of determining the external connection time series corresponding to the target domain name mentioned in step S101 includes:

[0065] Acquire multiple target time points from the domain name system; each of the target time points is a time point for performing an external access to the target domain name;

[0066] In the method provided by the embodiment of the present invention, the time data of the external domain name in the domain name system DNS can be collected to obtain the time point of the external access to the target domain name, and each time point of the external access to the target domain name is the target time point.

[0067] Each of the target time points is used as an external connection time point corresponding to the target domain name, and the external connection time points corresponding to the target domain name are combined into the external connection time sequence according to the time sequence of each of the target time points.

[0068] In the method provided by the embodiment of the present invention, each target time point obtained is used as the external connection time point corresponding to the target domain name, and each external connection time point is sorted in chronological order, and each sorted external connection time point is formed into an external connection time sequence. The data format of the formed external connection time sequence can be shown as a sequence T: T = {t1, t2, t3, t4, ..., tn}, where n is equal to the total number of external connection time points.

[0069] It should be noted that the specific data format and data content of the external time series provided in the embodiment of the present invention are only for better illustrating the specific embodiment provided by the method provided by the present invention. In the specific implementation process, the specific data format can be set according to actual needs, and the value of n is also determined by the actual data collection situation, and is not limited to the example presentation of the embodiment of the present invention.

[0070] The embodiment of the present invention provides another method for detecting abnormal external connection behavior. Figure 1 Based on the method shown in reference Figure 2 As shown in the flowchart, in the method provided by the embodiment of the present invention, the process of determining the time interval sequence corresponding to the external connection time series mentioned in step S102 includes:

[0071] S201: taking each external connection time point except the last external connection time point in the external connection time sequence as a target external connection time point;

[0072] In the method provided by the embodiment of the present invention, a time interval sequence is formed by calculating the difference of the external connection time series. Specifically, each external connection time point other than the last external connection time point in the external connection time series can be used as a target external connection time point. For example, an external connection time series T containing n external connection time points: T = {t1, t2, t3, t4, ..., tn}, the first (n-1) external connection time points are used as target external connection time points, that is, t1, t2, t3, t4, ..., t(n-1), each of which is a target external connection time point.

[0073] S202: Determine an adjacent time point corresponding to each of the target external connection time points; the adjacent time point corresponding to each of the target external connection time points is the next external connection time point of the target external connection time point in the external connection time sequence;

[0074] In the method provided by the embodiment of the present invention, for each target external connection time point, the next external connection time point of the target external connection time point in the external connection time sequence is used as the adjacent time point corresponding to the target external connection time point. For example, based on the external connection time sequence T in the previous example, the adjacent time point corresponding to t1 is t2, and the adjacent time point corresponding to t2 is t3, that is, the adjacent time point corresponding to t(i-1) is ti, 1<i≤n.

[0075] S203: For each of the target external connection time points, calculate the time interval between the target external connection time point and its corresponding adjacent time point, and use the calculation result as the time interval corresponding to the target external connection time point;

[0076] In the method provided by the embodiment of the present invention, for each target external connection time point, based on the target external connection time point and its corresponding adjacent time point, the time interval between the two time points is calculated, and the time interval between the two is used as the time interval corresponding to the target external connection time point.

[0077] S204: According to the time sequence of each of the target external connection time points, the time intervals corresponding to each of the target external connection time points are combined into the time interval sequence.

[0078] In the method provided by the embodiment of the present invention, based on the order of each target external connection time point in the external connection time sequence, that is, the time sequence of each target external connection time point, the arrangement order corresponding to the time interval corresponding to each target external connection time point is determined, and the arrangement order corresponding to each time interval corresponds to its corresponding target external connection time point. For example, in the external connection time sequence T = {t1, t2, t3, t4, ..., tn}, the arrangement order corresponding to the time interval corresponding to t1 is the first, the arrangement order corresponding to the time interval corresponding to t2 is the second, and so on, the arrangement order of the time interval corresponding to t(n-1) is the (n-1)th. Arrange each time interval according to the arrangement order, and form a time interval sequence with each arranged time interval. Taking the above-mentioned external time series T as an example, the time interval between t1 and t2 (i.e. the time interval corresponding to t1) is Δt1, the time interval between t2 and t3 is Δt2, the time interval between t3 and t4 is Δt3, and so on. The time interval between t(n-1) and tn is Δt(n-1). The data format of the formed time interval sequence can be shown as the time interval sequence Δt: Δt={Δt1, Δt2, Δt3, ..., Δt(n-1)}.

[0079] It should be noted that the specific data format and data content of the time interval sequence mentioned in the embodiment of the present invention are only for better illustrating the specific embodiment provided by the method provided by the present invention. In the specific implementation process, the data format of the time interval sequence can be set according to actual needs, and the number of time intervals is also determined by the actual processing situation, which does not affect the function of the method provided by the embodiment of the present invention.

[0080] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of determining the access fluctuation corresponding to the target domain name according to the time interval sequence mentioned in step S103 includes:

[0081] Determine a sequence length corresponding to the time interval sequence;

[0082] In the method provided by the embodiment of the present invention, the number of items (time intervals) included in the time interval sequence, that is, the length of the sequence, is calculated, and the length of the sequence is used as the sequence length corresponding to the time interval sequence.

[0083] Determining an average interval time corresponding to the time interval sequence according to the sequence length;

[0084] In the method provided by the embodiment of the present invention, based on each time interval in the time interval sequence and the sequence length, the average value of each time interval can be calculated as the average interval time corresponding to the time interval sequence.

[0085] Determine the standard deviation corresponding to the time interval sequence according to the sequence length and the average interval time;

[0086] In the method provided by the embodiment of the present invention, the standard deviation of each time interval in the time interval sequence can be calculated based on the sequence length and the average interval time, and the standard deviation is used as the standard deviation corresponding to the time interval sequence.

[0087] The quotient of the standard deviation and the average interval time is calculated, and the calculation result is used as the access fluctuation.

[0088] In the method provided by the embodiment of the present invention, the standard deviation corresponding to the time interval sequence is divided by the average time interval corresponding to the time interval sequence to obtain the quotient of the two, and the quotient of the two is used as the access volatility. Specifically, the following formula can be pre-set, and the data can be substituted into the formula to calculate the access volatility:

[0089]

[0090] Among them, fp represents the access volatility, var represents the standard deviation of the time interval series, and op ave Indicates the average interval time corresponding to the time interval series.

[0091] On the basis of the method provided in the above embodiment, in the method provided in the embodiment of the present invention, determining the average interval time corresponding to the time interval sequence according to the sequence length includes:

[0092] Performing a sum operation on all time intervals in the time interval sequence to obtain a time interval sum;

[0093] The quotient of the sum of the time intervals and the sequence length is calculated, and the calculation result is used as the average interval time.

[0094] In the method provided by the embodiment of the present invention, all time intervals in the time interval sequence can be added together to obtain the total time interval, and the total time interval can be divided by the sequence length, and the quotient of the two can be used as the average time interval.ave The calculation formula can be shown as follows:

[0095]

[0096] Among them, n represents the sequence length corresponding to the time interval sequence, s i Represents the i-th value (time interval) in the time interval sequence.

[0097] On the basis of the method provided in the above embodiment, in the method provided in the embodiment of the present invention, determining the standard deviation corresponding to the time interval sequence according to the sequence length and the average interval time includes:

[0098] According to each time interval in the time interval sequence, the sequence length, the average interval time and a preset sample standard deviation calculation strategy, the sample standard deviation corresponding to each time interval is calculated, and the calculation result is used as the standard deviation corresponding to the time interval sequence.

[0099] In the method provided by the embodiment of the present invention, the sample standard deviation corresponding to each time interval in the time interval sequence can be calculated based on the sequence length and the average interval time of the time interval sequence, and the sample standard deviation corresponding to each time interval is used as the standard deviation corresponding to the time interval sequence. Specifically, the calculation formula of the standard deviation var corresponding to the time interval sequence can be as follows:

[0100]

[0101] The meaning of each parameter representation is the same as that in Formula 1 and Formula 2 above, and can be found in the above description, which will not be repeated here.

[0102] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, judging whether the target domain name meets the preset abnormal condition according to the access fluctuation includes:

[0103] Determining whether the access fluctuation is within a preset threshold range;

[0104] In the method provided by the embodiment of the present invention, a threshold range of fluctuation can be pre-set according to actual needs. When the access fluctuation is within the threshold range, it is considered that the external access presents a small volatility, and it is more likely to be a malicious external behavior. Specifically, based on the historical data of abnormal external behavior, the distribution of the fluctuation of the access time of historical abnormal external behavior can be determined, and the range of 95% of the confidence interval can be selected as the threshold range. When performing the detection, the access fluctuation corresponding to the target domain name is compared with the upper and lower limits of the threshold range to determine whether the access fluctuation is within the preset threshold range.

[0105] It should be noted that the method for determining the specific threshold range provided in the method provided in the embodiment of the present invention is only for better illustrating the specific embodiment provided by the method provided in the present invention. In the specific implementation process, different standards can be used to determine the threshold range, which does not affect the function of the method provided in the embodiment of the present invention.

[0106] If the access fluctuation is within the preset threshold range, it is determined that the target domain name meets the preset abnormal condition.

[0107] In the method provided by the embodiment of the present invention, if the access fluctuation is within the preset threshold range, the target domain name is considered to meet the preset abnormal condition; if the access fluctuation is not within the preset threshold range, the target domain name is considered to not meet the preset abnormal condition.

[0108] and Figure 1 Corresponding to the method for detecting abnormal external connection behavior shown in FIG. 1 , an embodiment of the present invention further provides a device for detecting abnormal external connection behavior, which is used to Figure 1 The specific implementation of the method shown in is shown in the structural diagram Figure 3 As shown, including:

[0109] The first determination unit 301 is used to determine the external connection time sequence corresponding to the target domain name when it is necessary to detect the external connection behavior of the target domain name; the external connection time sequence includes multiple external connection time points corresponding to the target domain name;

[0110] The second determining unit 302 is used to determine a time interval sequence corresponding to the external connection time series; the time interval sequence includes multiple time intervals;

[0111] A third determining unit 303 is used to determine the access fluctuation corresponding to the target domain name according to the time interval sequence;

[0112] A judging unit 304, configured to judge whether the target domain name meets a preset abnormal condition according to the access fluctuation;

[0113] The fourth determining unit 305 is configured to determine the external connection behavior corresponding to the target domain name as an abnormal external connection behavior if the target domain name meets the preset abnormal condition.

[0114] Based on the device provided by the embodiment of the present invention, when it is necessary to detect the external connection behavior of the target domain name, determine the external connection time series corresponding to the target domain name, including multiple external connection time points corresponding to the target domain name; determine the time interval series corresponding to the external connection time series, including multiple time intervals; determine the access volatility corresponding to the target domain name based on the time interval series; determine whether the target domain name meets the preset abnormal condition based on the access volatility; if the target domain name meets the preset abnormal condition, the external connection behavior corresponding to the target domain name is determined as abnormal external connection behavior. Using the device provided by the embodiment of the present invention, the external connection behavior can be detected based on the volatility presented by the time interval of the external connection access. The detection of abnormal external connection behavior relies on the time characteristics of the external connection behavior itself, and has a low correlation with the domain name visited. It can be used to identify abnormal external connection behaviors of various domain names (such as malicious domain names with known abnormalities and malicious domain names with unknown abnormalities), which is conducive to improving the detection accuracy of abnormal external connection behaviors and further improving the security of the server.

[0115] On the basis of the device provided in the above embodiment, in the device provided in the embodiment of the present invention, the first determining unit 301 includes:

[0116] An acquisition subunit, used for acquiring a plurality of target time points from a domain name system; each of the target time points is a time point for performing an external access to the target domain name;

[0117] The first establishing subunit is used to use each of the target time points as an external connection time point corresponding to the target domain name, and to form the external connection time points corresponding to the target domain name into the external connection time sequence according to the time sequence of each of the target time points.

[0118] The embodiment of the present invention provides another abnormal external connection behavior detection device, the structural diagram of which is as follows: Figure 4 As shown, in Figure 3 On the basis of the device shown in the figure, in the device provided by the embodiment of the present invention, the second determining unit 302 includes:

[0119] A first determining subunit 306, configured to take each external connection time point except the last external connection time point in the external connection time sequence as a target external connection time point;

[0120] The second determining subunit 307 is used to determine the adjacent time point corresponding to each of the target external connection time points; the adjacent time point corresponding to each of the target external connection time points is the next external connection time point of the target external connection time point in the external connection time sequence;

[0121] The first calculation subunit 308 is used to calculate the time interval between each target external connection time point and its corresponding adjacent time point, and use the calculation result as the time interval corresponding to the target external connection time point;

[0122] The second establishing subunit 309 is used to organize the time intervals corresponding to the target external connection time points into the time interval sequence according to the time sequence of the target external connection time points.

[0123] On the basis of the device provided in the above embodiment, in the device provided in the embodiment of the present invention, the third determining unit 303 includes:

[0124] A third determining subunit is used to determine a sequence length corresponding to the time interval sequence;

[0125] A fourth determining subunit, configured to determine an average interval time corresponding to the time interval sequence according to the sequence length;

[0126] a fifth determining subunit, configured to determine a standard deviation corresponding to the time interval sequence according to the sequence length and the average interval time;

[0127] The second calculation subunit is used to calculate the quotient of the standard deviation and the average interval time, and use the calculation result as the access fluctuation.

[0128] On the basis of the device provided in the above embodiment, in the device provided in the embodiment of the present invention, the fourth determining subunit includes:

[0129] A summing subunit, configured to perform a summing operation on all time intervals in the time interval sequence to obtain a time interval sum;

[0130] The third calculation subunit is used to calculate the quotient of the sum of the time intervals and the sequence length, and use the calculation result as the average interval time.

[0131] On the basis of the device provided in the above embodiment, in the device provided in the embodiment of the present invention, the fifth determining subunit includes:

[0132] The fourth calculation subunit is used to calculate the sample standard deviation corresponding to each time interval according to each time interval in the time interval sequence, the sequence length, the average interval time and a preset sample standard deviation calculation strategy, and use the calculation result as the standard deviation corresponding to the time interval sequence.

[0133] On the basis of the device provided in the above embodiment, in the device provided in the embodiment of the present invention, the judging unit 304 includes:

[0134] A judging subunit, used to judge whether the access fluctuation is within a preset threshold range;

[0135] The sixth determining subunit is configured to determine that the target domain name meets the preset abnormal condition if the access fluctuation is within the preset threshold range.

[0136] An embodiment of the present invention further provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned abnormal external connection behavior detection method.

[0137] The embodiment of the present invention further provides an electronic device, the structural diagram of which is shown in FIG. Figure 5 As shown, it specifically includes a memory 401 and one or more instructions 402, wherein the one or more instructions 402 are stored in the memory 401 and are configured to be executed by one or more processors 403 to perform the following operations:

[0138] In the case where it is necessary to detect the external connection behavior of the target domain name, determining the external connection time sequence corresponding to the target domain name; the external connection time sequence includes multiple external connection time points corresponding to the target domain name;

[0139] Determine a time interval sequence corresponding to the external connection time series; the time interval sequence includes a plurality of time intervals;

[0140] Determining the access fluctuation corresponding to the target domain name according to the time interval sequence;

[0141] According to the access fluctuation, determining whether the target domain name meets a preset abnormal condition;

[0142] If the target domain name meets the preset abnormal condition, the external connection behavior corresponding to the target domain name is determined as an abnormal external connection behavior.

[0143] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0144] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0145] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting abnormal external contact behavior, characterized in that: include: In the case where it is necessary to detect the external connection behavior of the target domain name, based on the external connection record of the domain name system, determine the external connection time series corresponding to the target domain name; the external connection time series includes multiple external connection time points corresponding to the target domain name; Taking each outreach time point except the last outreach time point in the outreach time series as a target outreach time point; Determine an adjacent time point corresponding to each of the target external connection time points; the adjacent time point corresponding to each of the target external connection time points is the next external connection time point of the target external connection time point in the external connection time sequence; For each of the target outreach time points, calculate the time interval between the target outreach time point and its corresponding adjacent time point, and use the calculation result as the time interval corresponding to the target outreach time point; According to the time sequence of each of the target external connection time points, the time intervals corresponding to each of the target external connection time points are combined into a time interval sequence; the time interval sequence includes a plurality of time intervals; Determining the access fluctuation corresponding to the target domain name according to the time interval sequence; According to the access fluctuation, determining whether the target domain name meets a preset abnormal condition; If the target domain name meets the preset abnormal condition, the external connection behavior corresponding to the target domain name is determined as an abnormal external connection behavior; The calculation formula of the access fluctuation is: fp represents the access volatility, var represents the standard deviation of the time interval series, and opave represents the average interval time of the time interval series. The calculation formula of the standard deviation corresponding to the time interval sequence is: n represents the sequence length corresponding to the time interval sequence, s i Represents the i-th value in the time interval sequence.

2. The method according to claim 1, characterized in that The determining the external connection time series corresponding to the target domain name includes: Acquire multiple target time points from the domain name system; each of the target time points is a time point for performing an external access to the target domain name; Each of the target time points is used as an external connection time point corresponding to the target domain name, and the external connection time points corresponding to the target domain name are combined into the external connection time sequence according to the time sequence of each of the target time points.

3. The method according to claim 1, characterized in that: Determining the access fluctuation corresponding to the target domain name according to the time interval sequence includes: Determine a sequence length corresponding to the time interval sequence; Determining an average interval time corresponding to the time interval sequence according to the sequence length; Determine the standard deviation corresponding to the time interval sequence according to the sequence length and the average interval time; The quotient of the standard deviation and the average interval time is calculated, and the calculation result is used as the access fluctuation.

4. The method according to claim 3, characterized in that The step of determining the average interval time corresponding to the time interval sequence according to the sequence length includes: Performing a sum operation on all time intervals in the time interval sequence to obtain a time interval sum; The quotient of the sum of the time intervals and the sequence length is calculated, and the calculation result is used as the average interval time.

5. The method according to claim 3, characterized in that: The determining, based on the sequence length and the average interval time, a standard deviation corresponding to the time interval sequence includes: According to each time interval in the time interval sequence, the sequence length, the average interval time and a preset sample standard deviation calculation strategy, the sample standard deviation corresponding to each time interval is calculated, and the calculation result is used as the standard deviation corresponding to the time interval sequence.

6. The method according to claim 1, characterized in that The step of judging whether the target domain name meets a preset abnormal condition based on the access fluctuation includes: Determining whether the access fluctuation is within a preset threshold range; If the access fluctuation is within the preset threshold range, it is determined that the target domain name meets the preset abnormal condition.

7. A detection device for abnormal external contact behavior, characterized in that: include: A first determination unit is used to determine, when it is necessary to detect an external connection behavior of a target domain name, an external connection time sequence corresponding to the target domain name based on an external connection record of a domain name system; the external connection time sequence includes a plurality of external connection time points corresponding to the target domain name; A second determining unit is used to determine a time interval sequence corresponding to the external connection time series; the time interval sequence includes a plurality of time intervals; The third determining unit is used to determine the access fluctuation corresponding to the target domain name according to the time interval sequence, wherein the calculation formula of the access fluctuation is: fp represents the access volatility, var represents the standard deviation of the time interval series, and opave represents the average interval time of the time interval series. The calculation formula of the standard deviation corresponding to the time interval sequence is: n represents the sequence length corresponding to the time interval sequence, s i represents the i-th value in the time interval sequence; A judging unit, configured to judge whether the target domain name meets a preset abnormal condition according to the access fluctuation; a fourth determining unit, configured to determine the external connection behavior corresponding to the target domain name as an abnormal external connection behavior if the target domain name meets the preset abnormal condition; The second determining unit includes: A first determining subunit, configured to take each external connection time point except the last external connection time point in the external connection time sequence as a target external connection time point; The second determining subunit is used to determine the adjacent time point corresponding to each of the target external connection time points; the adjacent time point corresponding to each of the target external connection time points is the next external connection time point of the target external connection time point in the external connection time sequence; A first calculation subunit is used to calculate, for each of the target external connection time points, the time interval between the target external connection time point and its corresponding adjacent time point, and use the calculation result as the time interval corresponding to the target external connection time point; The second establishing subunit is used to organize the time intervals corresponding to the target external connection time points into the time interval sequence according to the time sequence of the target external connection time points.

8. A storage medium, characterized in that: The storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the method for detecting abnormal external connection behavior according to any one of claims 1 to 6.

9. An electronic device, characterized in that: The device comprises a memory and one or more instructions, wherein the one or more instructions are stored in the memory and configured to be executed by one or more processors to perform the abnormal external connection behavior detection method as claimed in any one of claims 1 to 6.

Images