Abnormal behavior detection method and device, electronic equipment and storage medium

Abstract

The invention provides an abnormal behavior detection method and device, electronic equipment and a storage medium, and relates to the technical field of product safety protection and the like. The specific implementation scheme is as follows: obtaining an access request forwarded by a gateway, wherein the access request is forwarded by the gateway after detection based on a pre-configured detection strategy of a specified behavior attribute category; acquiring corresponding behavior attribute information based on the access request; and based on the behavior attribute information, deciding whether the access request is abnormal access. According to the technology disclosed by the invention, the accuracy and the detection efficiency of abnormal behavior detection can be effectively improved, so that the vulnerabilities of the personal cloud network disk application can be effectively reduced, the risk is reduced, and the safety performance of the personal cloud network disk application is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, specifically to technical fields such as the security protection of products, and particularly relates to a method, device, electronic device, and storage medium for detecting abnormal behaviors. Background Art

[0002] In recent years, large-scale promotion activities have been carried out for application products of personal cloud network disks facing the world. However, along with the large-scale acquisition of new users, it also faces increasingly serious cheating and security challenges.

[0003] In some areas with a relatively complex Internet security environment, many malicious abnormal users will use personal cloud network disks through abnormal operation behaviors. For example, in the scenarios of file upload and download, when a normal user uploads or downloads a file, not only the core interface will be called, but also other normal browsing operations such as page loading and rendering will be accompanied. However, in order to accelerate the file upload or download speed, malicious abnormal users usually adopt the method of using automated scripts or directly calling the key application program interface (API) interfaces, ignoring other related normal operations. In other category scenarios such as playing or sharing, malicious abnormal users will also adopt operation behaviors different from those of ordinary users for abnormal operations. Summary of the Invention

[0004] The present disclosure provides a method, device, electronic device, and storage medium for detecting abnormal behaviors.

[0005] According to one aspect of the present disclosure, a method for detecting abnormal behaviors is provided, including:

[0006] Obtaining an access request forwarded by a gateway, where the access request is forwarded by the gateway after being detected based on a detection policy of a specified behavior attribute category configured in advance;

[0007] Based on the access request, obtaining corresponding behavior attribute information;

[0008] Based on the behavior attribute information, determining whether the access request is an abnormal access.

[0009] According to another aspect of the present disclosure, a device for detecting abnormal behaviors is provided, including:

[0010] A request acquisition module, configured to obtain an access request forwarded by a gateway, where the access request is forwarded by the gateway after being detected based on a detection policy of a specified behavior attribute category configured in advance;

[0011] An attribute acquisition module, configured to obtain corresponding behavior attribute information based on the access request;

[0012] A decision-making module, configured to decide whether the access request is an abnormal access based on the behavior attribute information.

[0013] According to another aspect of the present disclosure, there is provided an electronic device, including:

[0014] At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions executable by the at least one processor, and when the instructions are executed by the at least one processor, the at least one processor is enabled to execute the methods of the above-mentioned aspects and any possible implementation manners.

[0017] According to yet another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions, and the computer instructions are used to cause a computer to execute the methods of the above-mentioned aspects and any possible implementation manners.

[0018] According to still another aspect of the present disclosure, there is provided a computer program product, including a computer program, and when the computer program is executed by a processor, the methods of the above-mentioned aspects and any possible implementation manners are implemented.

[0019] According to the technology of the present disclosure, the accuracy and detection efficiency of abnormal behavior detection can be effectively improved, and thus the vulnerabilities of the personal cloud storage application can be effectively reduced, the risks can be lowered, and the security performance of the personal cloud storage application can be improved.

[0020] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it used to limit the scope of the present disclosure. Other features of the present disclosure will become easily understandable through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings are used to better understand the solution and do not constitute a limitation to the present disclosure. Among them:

[0022] Figure 1 is a schematic diagram according to the first embodiment of the present disclosure;

[0023] Figure 2 is an application architecture diagram of a detection method for abnormal behavior provided by the present disclosure;

[0024] Figure 3 is a schematic diagram according to the second embodiment of the present disclosure;

[0025] Figure 4 is a schematic diagram according to the third embodiment of the present disclosure;

[0026] Figure 5 is a schematic diagram according to the fourth embodiment of the present disclosure;

[0027] Figure 6 is a block diagram of an electronic device for implementing the method of the embodiment of the present disclosure. Detailed implementation manners

[0028] The exemplary embodiments of the present disclosure will be described below with reference to the accompanying drawings. Various details of the embodiments of the present disclosure are included to facilitate understanding, and they should be considered merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, descriptions of well-known functions and structures are omitted below for clarity and conciseness.

[0029] Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present disclosure without creative efforts belong to the scope of protection of the present disclosure.

[0030] It should be noted that the terminal devices involved in the embodiments of the present disclosure may include, but are not limited to, intelligent devices such as mobile phones, personal digital assistants (PDAs), wireless handheld devices, and tablet computers; the display devices may include, but are not limited to, devices with display functions such as personal computers and televisions.

[0031] In addition, the term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this article generally represents an "or" relationship between the associated objects before and after.

[0032] Malicious abnormal users bring great security risks to personal cloud network disks through abnormal behaviors. Since malicious abnormal users have obvious differences in behavior patterns from ordinary users, in order to effectively detect abnormal behaviors, detection strategies can usually be deployed on the client side to achieve detection. However, since the client is in an open environment and is relatively easy to be bypassed or tampered with by attackers, the abnormal behavior detection scheme relying on the client has relatively large loopholes and risks.

[0033] Figure 1 is a schematic diagram according to the first embodiment of the present disclosure; as Figure 1 shown, this embodiment can provide a method for detecting abnormal behaviors, which may specifically include the following steps:

[0034] S101. Obtain an access request forwarded by a gateway, where the access request is forwarded by the gateway after detection based on a pre-configured detection policy for a specified behavior attribute category;

[0035] S102. Based on the access request, obtain corresponding behavior attribute information;

[0036] S103. Based on the behavior attribute information, determine whether the access request is an abnormal access.

[0037] The execution subject of the detection method for abnormal access requests in this embodiment may be a detection device for abnormal behaviors, which is used to detect access requests for a specified behavior attribute category forwarded by the gateway. Or it can be understood that the detection device for abnormal behaviors can be a detection device for abnormal behaviors of any specified behavior attribute category.

[0038] Figure 2 It is an application architecture diagram of a detection method for abnormal behaviors provided by the present disclosure. As Figure 2 shown, in this architecture, it may include a client 10, a gateway 20, a server 30, and a detection device 40 for abnormal behaviors. The client 10 in this embodiment may be a client of a personal cloud storage. In the architecture of this embodiment, one, two, or more detection devices 40 for abnormal behaviors may be set, and each detection device for abnormal behaviors corresponds to detecting an access request of a behavior attribute category.

[0039] When a user is using a personal cloud storage, various access requests of behavior attribute categories can be initiated through the client 10. For example, a file upload request, a file download request, or a click-play request for a video resource can be initiated, etc. Among them, the file upload request, the file download request, and the click-play request for a video resource are usually a collective term for multiple access requests. That is, one or a round of file upload requests, file download requests, or click-play requests for a video resource may include multiple access requests. Or it can be considered that multiple access requests are multiple steps or multiple sub-requests in one or a round of file upload requests, file download requests, or click-play requests for a video resource. Based on this, it can be known that the access request forwarded by the gateway in this embodiment can be an access request in one or a round of file upload requests, file download requests, or click-play requests for a video resource.

[0040] Then, after the access request initiated by the client 10 reaches the gateway 20, the gateway 20 can detect which behavior attribute category the access request belongs to based on the pre-configured detection policy of the behavior attribute category, and then forward the access request to the detection device 40 for abnormal behavior corresponding to it. The detection device 40 for abnormal behavior then performs abnormal detection on the access request. In this embodiment, developers can pre-configure the detection policies of various behavior attribute categories in the database configuration file. Specifically, the gateway 20 can obtain the detection policies of various behavior attribute categories from the database configuration file to detect access requests of various behavior attribute categories.

[0041] Specifically, for the detection device 40 for abnormal behavior of a specified behavior attribute category, after receiving the access request of the specified behavior attribute category forwarded by the gateway 20, based on the access request, the corresponding behavior attribute information is obtained; the behavior attribute information corresponding to the access request can carry the behavior characteristics corresponding to the access request, so further based on the behavior attribute information, it can be determined whether the access request is an abnormal access.

[0042] The access request obtained by the detection device 40 for abnormal behavior in this embodiment is forwarded by the gateway 20 after being detected based on the pre-configured detection policy of the specified behavior attribute category. It can be understood that the detection device 40 for abnormal behavior is set on the gateway side.

[0043] Compared with the existing abnormal behavior detection solution set on the client side in the prior art, the abnormal behavior detection method in this embodiment cannot be bypassed or tampered with by attackers, can effectively improve the accuracy and detection efficiency of abnormal behavior detection, and further can effectively reduce the vulnerabilities of the personal cloud disk application, reduce risks, and improve the security performance of the personal cloud disk application.

[0044] Figure 3 is a schematic diagram according to the second embodiment of the present disclosure; as Figure 3 shown, the abnormal behavior detection method in this embodiment further describes the technical solution of the present disclosure in more detail on the basis of the technical solution of the embodiment shown above. As Figure 1 shown, the abnormal behavior detection method in this embodiment may specifically include the following steps: Figure 3 shown, the abnormal behavior detection method in this embodiment may specifically include the following steps:

[0045] S301. Obtain the access request forwarded by the gateway, where the access request is forwarded by the gateway after being detected based on the pre-configured detection policy of the specified behavior attribute category;

[0046] Specifically, the access request is sent by the client to the gateway. After being detected by the gateway based on a pre-configured detection policy for a specified behavior attribute category, it is determined to be an access request of the specified behavior attribute category, and then forwarded to an abnormal behavior detection device corresponding to the specified behavior attribute category. The specified behavior attribute category can be any category, such as file upload, file download, or click-play of video resources, etc., which is not limited herein.

[0047] S302. Based on the access request, obtain at least one of the identifiers of multiple access requests of the same behavior attribute category initiated by the user corresponding to the access request within a preset time period before the access time of the access request, the number of IPs from which the user corresponding to the access request initiated access requests within the preset time period, the common parameters of each access request, the associated access requests having an association relationship with the access request, and the sequence relationship between the access request and the associated access requests.

[0048] The preset time period in this embodiment can be set according to the requirements or experience in the actual scenario. For example, it can be one hour, two hours, or multiple hours, or it can also be one day, two days, or multiple days, which is not limited herein.

[0049] The identifier of the access request in this embodiment can be represented by the identifier of the interface to be accessed by the access request. The common parameters in multiple access requests included in the same or the same round of file upload requests, file download requests, or click-play requests of video resources are the same. The common parameters can identify that the current access request is requesting file upload, or requesting file download, or requesting click-play of video resources, etc. Therefore, based on the common parameters in multiple consecutive access requests, multiple access requests included in one or one round of file upload requests, file download requests, or click-play requests of video resources can be divided.

[0050] For example, when the behavior attribute category is a file upload request, the identifiers of multiple access requests of file upload requests initiated within a preset time period before the access time of the obtained access request may include access requests for request interface 1, access requests for request interface 2, access requests for request interface 3, access requests for request interface 4, ……, access requests for request interface 1, access requests for request interface 2, access requests for request interface 3, access requests for request interface 4. According to the common parameters of each access request, the multiple access requests included in each file upload request can be split, and then it can be obtained that each file upload request includes access requests for request interface 1, access requests for request interface 2, access requests for request interface 3, and access requests for request interface 4. In this way, for any one of the access requests for request interface 1, access requests for request interface 2, access requests for request interface 3, and access requests for request interface 4 that is the current access request, the other three can be determined as the associated access requests of the current access request. And the sequential relationship between the current access request and the corresponding associated access requests can be further determined. For example, the sequential relationship in this example is access requests for request interface 1, access requests for request interface 2, access requests for request interface 3, and access requests for request interface 4.

[0051] The above step S302 is a specific implementation manner of step S102 of the above Figure 1 illustrated embodiment. Through this method, very rich and accurate behavioral attribute information of access requests can be obtained.

[0052] In addition, if the specified behavior attribute category includes a click-play request for a video resource, step S102 of the above Figure 1 illustrated embodiment may further include: based on the access request, obtaining the click-play request for the corresponding video resource; the access request is a sub-request of a click-play request for a video resource. Obtaining the request time of the click-play request in the click-play request for the video resource and the play time of the video resource.

[0053] Specifically, referring to the description of the above embodiment, it can be determined whether the current access request is a click-play request for a video resource according to the common parameter. If so, based on the access requests that have been received in the click-play request for the video resource, the request time of the click-play request in the click-play request for the video resource and the play time of the video resource can be obtained. Of course, based on the current access request and the access requests that have been received in the click-play request for the video resource, it may not be possible to obtain the play time of the video resource yet, but it can be obtained in the same way when receiving the access requests after the current access request of the click-play request for the video resource.

[0054] By adopting the above method, it is also possible to accurately and efficiently obtain the corresponding behavioral attribute information when the access request belongs to a click-play request for a video resource.

[0055] S303. Based on at least one of the identifiers of multiple access requests of the same behavioral attribute category initiated by the user corresponding to the access request within a preset time period before the access time of the access request, the number of IPs from which the user corresponding to the access request initiates access requests within the preset time period, the common parameters of each access request, the associated access requests having an association relationship with the access request, and the sequential relationship between the access request and the associated access requests, use a pre-configured abnormal behavior detection policy to determine whether the access request is an abnormal access.

[0056] Optionally, before this step S303, it may further include: configuring an abnormal behavior detection policy corresponding to a specified behavioral attribute category.

[0057] For example, it may include the following situations:

[0058] When the specified behavioral attribute category includes a file upload request, a file download request, or a click-play request for a video resource, configuring an abnormal behavior detection policy corresponding to the specified behavioral attribute category includes: when the identifiers of multiple access requests included in the current file upload request, file download request, or click-play request for a video resource corresponding to the access request, or the sequential relationship of multiple access requests, is incorrect, determining that the current access request is an abnormal access.

[0059] Referring to the description of the above embodiments, based on the analysis of historical data, it can be known that each correct file upload request, file download request, or click-play request for a video resource corresponds to the identifiers of multiple access requests included therein and the sequential relationship of multiple access requests.

[0060] In specific use, based on the currently obtained behavioral attribute information obtained in step S302, it is possible to obtain the identifiers of the access requests included in the current file upload request, file download request, or click-play request for a video resource corresponding to the access request, and the sequential relationship of the access requests included therein, and then verify whether it is correct. If it is incorrect, determine that the access request is an abnormal access; otherwise, determine that the access request is a normal access request.

[0061] Taking a file upload request as an example, if a normal file upload request includes four access requests in a sequential relationship: an access request to request interface 1, an access request to request interface 2, an access request to request interface 3, and an access request to request interface 4. For malicious and abnormal users, they may use abnormal means, such as directly requesting an access request to request interface 3 to complete the file upload. Therefore, in actual applications, if the first access request received during the process of determining a file upload request based on common parameters is an access request to request interface 3 instead of an access request to request interface 1, it can be directly determined that the first access request is an abnormal access request.

[0062] In addition, in an embodiment of the present disclosure, when the specified behavior attribute category includes a click-play request for a video resource, the configured abnormal behavior detection policy corresponding to the specified behavior attribute category includes: if the average value of the time difference between the request time of the click-play request of the corresponding user and the play time of the video resource within a preset duration before the current access request is less than the preset duration threshold, it is determined that the current access request is an abnormal access.

[0063] For the click-play request of a video resource, when playing correctly, after the user clicks the play request, usually an advertisement of a specified duration will be played first. The specified duration can be set according to the actual scenario, for example, it can be 1 minute, 30 seconds, or other time lengths. Then the video resource is played for the user. Therefore, there is a time difference between the request time of the click-play request and the play time of the video resource. For malicious and abnormal users, they can bypass the advertisement through abnormal means and directly watch the video resource. At this time, this time difference becomes less than the specified duration.

[0064] In actual applications, when it is determined that the current access request is a click-play request for a video resource based on the common parameter information of the current access request, it can further be based on the obtained behavior attribute information corresponding to the current access request. The average value of the time difference between the request time of the click-play request of the corresponding user and the play time of the video resource within a preset duration before the current access request can be statistically calculated, and then it is detected whether the average value of this time difference is less than the preset duration threshold. If so, it is determined that the current access request is an abnormal access.

[0065] That is to say, within the preset duration before the current access request, if it includes multiple click-play requests of the user for video resources, correspondingly, the average value of the time difference between the request time of the click-play requests of the multiple video resources and the play time of the video resources is statistically calculated.

[0066] By adopting the above method, the configured abnormal behavior detection policy corresponding to the specified behavior attribute category is very reasonable and accurate, and can effectively support the detection of abnormal behaviors.

[0067] Optionally, in an embodiment of the present disclosure, for step S303, the following steps may specifically be adopted to implement it: Based on the behavior attribute information corresponding to the obtained access request, an anomaly behavior detection model trained in advance is used to predict whether the access request is an abnormal access.

[0068] When specifically implemented, the behavior attribute information corresponding to the obtained access request is input into the anomaly behavior detection model. The anomaly behavior detection model can predict and output the probability value that the access request is an abnormal access. If the probability value is greater than or equal to a preset probability threshold, it can be considered that the access request is an abnormal access; otherwise, it can be considered that the access request is a normal access. The preset probability threshold can be set according to experience or requirements and is not limited herein.

[0069] In this embodiment, when predicting, specifically, the types of information included in the behavior attribute information corresponding to the access request input into the anomaly behavior detection model may be determined according to the training situation of the model. The types of information of the access request used during training are the types of information input during prediction.

[0070] S304. Dispose of the access request based on the decision result;

[0071] For example, when specifically implemented, this step may include the following situations:

[0072] The first situation: If the decision result indicates that the access request is a normal access request, configure the disposal result of the access request as release.

[0073] The second situation: If the decision result indicates that the access request is an abnormal access request, configure the disposal result of the access request as interception or re-verification using a verification code.

[0074] The third situation: If the decision result indicates that the access request is an abnormal access request, but the access request cannot be intercepted or re-verified using a verification code, configure an anomaly flag in the header of the access request.

[0075] For example, for some marketing activities, it is necessary to count the number of times a user forwards or shares information. At this time, the method of this embodiment may be adopted to detect that the access request is an abnormal access request. However, in this scenario, the access request cannot be intercepted or re-verified using a verification code. At this time, an anomaly flag can be directly configured in the header of the access request so that when returning to the gateway and forwarding to the server, the server can, based on the anomaly flag configured in the header of the access request, not include the access request in the statistical scope.

[0076] S305. Return the disposal result of the access request to the gateway.

[0077] For the first case above, after the gateway receives the disposal result, it forwards the access request to the server for normal access.

[0078] For the second case above, after the gateway receives the disposal result, if it intercepts, at this time, the gateway intercepts the access request and does not forward it to the server. If the verification code is verified again, the verification information is returned to the client for the user to return the verification code. The process of the user returning the verification code can be considered as a process of resending an access request carrying the verification code, which is the same as the detection process of the above access request. If the verification passes, the decision result is to allow access, otherwise the decision result is to intercept.

[0079] For example, still taking the file upload request as an example, a correct file upload request includes four access requests with the order relationship of the access request of request interface 1, the access request of request interface 2, the access request of request interface 3, and the access request of request interface 4. In the actual application scenario, if the method of the above embodiment is used to perform anomaly detection on the first received access request, if the first access request is a normal access request, the disposal result is to allow access, and the anomaly behavior detection device returns the disposal result of allowing access to the gateway. At this time, the gateway forwards the first access request to the server. However, if the second access request included in the file upload request is detected as an abnormal access request according to the same detection method, and the corresponding disposal result is to intercept, at this time, the anomaly behavior detection device returns the disposal result to the gateway, intercepts the second access request, and does not forward the second access request to the server. At the same time, the user corresponding to the file upload request can be further set as a malicious user, and the corresponding IP can be set as a malicious IP, etc., to prohibit receiving access requests from the malicious user or malicious IP. For access requests of other behavior attribute categories, the implementation principle is the same, and no further examples will be given here.

[0080] For the third case above, for example, an access request with an exception identifier carried in the header is returned to the gateway for the gateway to forward the access request with the exception identifier carried in the header to the server, and the server performs service processing on the access request based on the exception identifier.

[0081] The anomaly behavior detection method of this embodiment performs anomaly detection on access requests through the anomaly behavior detection policy set in the anomaly behavior detection device on the gateway side. Compared with the anomaly behavior detection deployed on the client side in the prior art, it cannot be bypassed or tampered with by attackers, can avoid detection vulnerabilities, and improve the security of detection. In short, the detection scheme of this embodiment can effectively improve the accuracy and detection efficiency of anomaly behavior detection, and thus can effectively improve the security performance of the personal cloud network disk application.

[0082] The detection method of abnormal behavior in this embodiment can not only enhance the detection efficiency of abnormal behavior by implementing precise abnormal behavior detection function at the gateway layer, but also significantly reduce the processing pressure on the server, ensuring a smoother service response.

[0083] The detection method of abnormal behavior in this embodiment is designed with excellent scalability, enabling the update and modification of policies to take effect in real time without delay, meeting the ever-changing business requirements.

[0084] The detection method of abnormal behavior in this embodiment has a release process that is completely independent of any specific end such as the client or the server end. Decoupled from the business logic, it can effectively ensure more flexible and stable version iteration.

[0085] Figure 4 is a schematic diagram according to the third embodiment of the present disclosure; as Figure 4 shown, this embodiment provides a detection device 400 for abnormal behavior, including:

[0086] A request acquisition module 401, configured to acquire an access request forwarded by the gateway, where the access request is forwarded by the gateway after being detected based on a detection policy of a pre-configured specified behavior attribute category;

[0087] An attribute acquisition module 402, configured to acquire corresponding behavior attribute information based on the access request;

[0088] A decision module 403, configured to decide whether the access request is an abnormal access based on the behavior attribute information.

[0089] The detection device 400 for abnormal behavior in this embodiment realizes the principle and technical effect of detecting abnormal behavior by adopting the above modules, which is the same as that of the above related method embodiments. For details, reference can be made to the records of the above related method embodiments, and details will not be repeated here.

[0090] Figure 5 is a schematic diagram according to the fourth embodiment of the present disclosure; as Figure 5 shown, the detection device 500 for abnormal behavior in this embodiment includes the above Figure 4 shown same-name and same-function modules: a request acquisition module 501, an attribute acquisition module 502, and a decision module 503.

[0091] Specifically, in the detection device 500 for abnormal behavior in this embodiment, the attribute acquisition module 502 is configured to:

[0092] Based on the access request, obtain at least one of the identifiers of multiple access requests of the same behavior attribute category initiated by the user corresponding to the access request within a preset time period before the access time of the access request, the number of IPs from which the user corresponding to the access request initiated access requests within the preset time period, the common parameters of each access request, the associated access requests having an association relationship with the access request, and the sequential relationship between the access request and the associated access requests.

[0093] Further optionally, in an embodiment of the present disclosure, when the specified behavior attribute category includes a click-play request for a video resource, the attribute acquisition module 502 is configured to:

[0094] Based on the access request, obtain the click-play request for the corresponding video resource; the access request is a sub-request of one of the click-play requests for the video resource;

[0095] Obtain the request time of the click-play request in the click-play requests for the video resource and the play time of the video resource.

[0096] Further optionally, in an embodiment of the present disclosure, the decision module 503 is configured to:

[0097] Based on the behavior attribute information, adopt a pre-configured abnormal behavior detection strategy to decide whether the access request is an abnormal access.

[0098] Further optionally, as Figure 5 shown, in an embodiment of the present disclosure, the abnormal behavior detection device 500 further includes:

[0099] A configuration module 504, configured to configure the abnormal behavior detection strategy corresponding to the specified behavior attribute category.

[0100] Further optionally, in an embodiment of the present disclosure, the configuration module 504 is configured to:

[0101] When the specified behavior attribute category includes a file upload request, a file download request, or a click-play request for a video resource, the abnormal behavior detection strategy configured for the specified behavior attribute category includes: when the identifiers or the sequential relationship of multiple access requests included in the current access request corresponding file upload request, file download request, or click-play request for a video resource is incorrect, determine that the current access request is an abnormal access; or

[0102] When the specified behavior attribute category includes a click-play request for a video resource, configuring the abnormal behavior detection policy corresponding to the specified behavior attribute category includes: if the average value of the time difference between the request time of the click-play request of the corresponding user and the play time of the video resource within a preset duration before the current access request is less than a preset duration threshold, determining that the current access request is an abnormal access. Further optionally, in an embodiment of the present disclosure, the decision module 503 is configured to:

[0103] Based on the behavior attribute information, use a pre-trained abnormal behavior detection model to predict whether the access request is an abnormal access.

[0104] Further optionally, as Figure 5 shown, in an embodiment of the present disclosure, the abnormal behavior detection device 500 further includes:

[0105] A disposal module 505, configured to dispose of the access request based on the decision result;

[0106] A return module 506, configured to return the disposal result of the access request to the gateway.

[0107] Further optionally, in an embodiment of the present disclosure, the disposal module 505 is configured to:

[0108] If the decision result indicates that the access request is a normal access request, configure the disposal result of the access request to be released;

[0109] If the decision result indicates that the access request is an abnormal access request, configure the disposal result of the access request to be intercepted or re-verified using a verification code.

[0110] Further optionally, in an embodiment of the present disclosure, the disposal module 505 is configured to:

[0111] If the decision result indicates that the access request is an abnormal access request, but the access request cannot be intercepted or re-verified using a verification code, configure an abnormal identifier in the header of the access request.

[0112] Further optionally, in an embodiment of the present disclosure, the return module 506 is configured to:

[0113] Return the access request with the abnormal identifier carried in the header to the gateway, so that the gateway forwards the access request with the abnormal identifier carried in the header to the server, and the server performs service processing on the access request based on the abnormal identifier.

[0114] The detection device 500 for abnormal behaviors in this embodiment realizes the detection principle and technical effects of abnormal behaviors by using the above modules, which are the same as those in the above related method embodiments. For details, please refer to the descriptions in the above related method embodiments and will not be elaborated here.

[0115] In the technical solution of the present disclosure, the acquisition, storage, and application of the user's personal information involved all comply with the provisions of relevant laws and regulations and do not violate public order and good customs.

[0116] According to the embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0117] Figure 6 FIG. shows a schematic block diagram of an exemplary electronic device 600 that can be used to implement the embodiments of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as, a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, a personal digital processor, a cellular phone, a smart phone, a wearable device, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely exemplary and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0118] As Figure 6 shown, the device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 602 or the computer program loaded from the storage unit 608 into the random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. The input / output (I / O) interface 605 is also connected to the bus 604.

[0119] Multiple components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disc, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0120] The computing unit 601 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 executes the various methods and processes described above, such as the above methods of the present disclosure. For example, in some embodiments, the above methods of the present disclosure can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the above methods of the present disclosure described above can be executed. Alternatively, in other embodiments, the computing unit 601 can be configured to execute the above methods of the present disclosure in any other suitable manner (e.g., by means of firmware).

[0121] Various embodiments of the systems and techniques described above in this document can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGA), application-specific integrated circuits (ASIC), application-specific standard products (ASSP), system-on-a-chip systems (SOC), complex programmable logic devices (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: implemented in one or more computer programs, the one or more computer programs can be executed and / or interpreted on a programmable system including at least one programmable processor, the programmable processor can be a special or general programmable processor, can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit the data and instructions to the storage system, the at least one input device, and the at least one output device.

[0122] The program code for implementing the methods of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to the processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing devices, such that when the program codes are executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program codes can be executed entirely on the machine, partially on the machine, executed partially on the machine as an independent software package and partially on a remote machine, or executed entirely on a remote machine or server.

[0123] In the context of this disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0124] In order to provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, speech input, or tactile input).

[0125] The systems and techniques described herein can be implemented in a computing system including backend components (e.g., as a data server), or a computing system including middleware components (e.g., an application server), or a computing system including frontend components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system including any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0126] A computer system can include a client and a server. The client and the server are generally remote from each other and typically interact through a communication network. The client-server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, can also be a server of a distributed system, or a server incorporating a blockchain.

[0127] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and no limitations are imposed herein.

[0128] The above specific embodiments do not constitute a limitation on the protection scope of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub - combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the protection scope of this disclosure.

Claims

1. A method for detecting abnormal behavior, comprising: Obtain an access request forwarded by a gateway, where the access request is forwarded by the gateway after detection based on a pre-configured detection policy for a specified behavior attribute category; Based on the access request, obtain corresponding behavior attribute information; Based on the behavior attribute information, determine whether the access request is an abnormal access.

2. The method according to claim 1, wherein, Based on the access request, obtain corresponding behavior attribute information, including: Based on the access request, obtain at least one of the identifiers of multiple access requests of the same behavior attribute category initiated by the user corresponding to the access request within a preset time period before the access time of the access request, the number of IPs from which the user corresponding to the access request initiated access requests within the preset time period, the common parameters of each access request, the associated access requests having an association relationship with the access request, and the sequence relationship between the access request and the associated access requests.

3. The method according to claim 1, wherein, If the specified behavior attribute category includes a click-play request for a video resource, based on the access request, obtain corresponding behavior attribute information, including: Based on the access request, obtain a corresponding click-play request for the video resource; the access request is a sub-request in the click-play requests for the video resource; Obtain the request time of the click-play request in the click-play requests for the video resource and the play time of the video resource.

4. The method according to claim 1, wherein, Based on the behavior attribute information, determine whether the access request is an abnormal access, including: Based on the behavior attribute information, use a pre-configured abnormal behavior detection policy to determine whether the access request is an abnormal access.

5. The method according to claim 1, wherein, Before using a pre-configured abnormal behavior detection policy to determine whether the access request is an abnormal access based on the behavior attribute information, the method further includes: Configure an abnormal behavior detection policy corresponding to the specified behavior attribute category.

6. The method according to claim 5, wherein, Configuring an abnormal behavior detection policy corresponding to the specified behavior attribute category includes: If the specified behavior attribute category includes a file upload request, a file download request, or a click-play request for a video resource, configuring the abnormal behavior detection policy corresponding to the specified behavior attribute category includes: if the identifiers or the sequence relationship of multiple access requests included in the file upload request, file download request, or click-play request for the video resource corresponding to the current access request are incorrect, determine that the current access request is an abnormal access; or If the specified behavior attribute category includes a click-play request for a video resource, configuring the abnormal behavior detection policy corresponding to the specified behavior attribute category includes: if the average value of the time difference between the request time of the click-play request of the corresponding user and the play time of the video resource within a preset duration before the current access request is less than a preset duration threshold, determine that the current access request is an abnormal access.

7. The method according to claim 1, wherein, Based on the behavior attribute information, determine whether the access request is an abnormal access, including: Based on the behavior attribute information, use a pre-trained abnormal behavior detection model to predict whether the access request is an abnormal access.

8. The method according to any one of claims 1-7, wherein, After determining whether the access request is an abnormal access based on the behavior attribute information, the method further includes: Dispose of the access request based on the decision result; Return the disposal result of the access request to the gateway.

9. The method according to claim 8, wherein, Dispose of the abnormal access request based on the decision result, including: If the decision result indicates that the access request is a normal access request, configure the disposal result of the access request as passing through; If the decision result indicates that the access request is an abnormal access request, configure the disposal result of the access request as intercepting or verifying again using a verification code.

10. The method according to claim 8, wherein, Dispose of the abnormal access request based on the decision result, including: If the decision result indicates that the access request is an abnormal access request, but the access request cannot be intercepted or verified again using a verification code, configure an abnormal identifier in the header of the access request.

11. The method according to claim 10, wherein, Return the disposal result of the access request to the gateway, including: Return the access request with the abnormal identifier carried in the header to the gateway, so that the gateway forwards the access request with the abnormal identifier carried in the header to the server, and the server processes the access request based on the abnormal identifier.

12. A device for detecting abnormal behavior, comprising: A request acquisition module, configured to acquire an access request forwarded by the gateway, where the access request is forwarded by the gateway after detection based on a pre-configured detection policy for a specified behavior attribute category; An attribute acquisition module, configured to acquire corresponding behavior attribute information based on the access request; A decision module, configured to decide whether the access request is an abnormal access based on the behavior attribute information.

13. The device according to claim 12, wherein, The attribute acquisition module is configured to: Based on the access request, acquire at least one of the identifiers of multiple access requests of the same behavior attribute category initiated by the user corresponding to the access request within a preset time period before the access time of the access request, the number of IPs of the user who initiated the access request within the preset time period, the common parameters of each access request, the associated access requests having an association relationship with the access request, and the sequence relationship between the access request and the associated access requests.

14. The device according to claim 11, wherein, When the specified behavior attribute category includes a click-play request for a video resource, the attribute acquisition module is configured to: Based on the access request, acquire the corresponding click-play request for the video resource; the access request is a sub-request in the click-play requests for the video resource; Acquire the request time of the click-play request in the click-play requests for the video resource and the play time of the video resource.

15. The device according to claim 12, wherein, The decision module is configured to: Based on the behavior attribute information, adopt a pre-configured abnormal behavior detection policy to decide whether the access request is an abnormal access.

16. The device according to claim 12, wherein, The device further includes: A configuration module, configured to configure the abnormal behavior detection policy corresponding to the specified behavior attribute category.

17. The device according to claim 16, wherein, The configuration module is configured to: If the specified behavior attribute category includes a file upload request, a file download request, or a click-to-play request for a video resource, configuring the abnormal behavior detection strategy corresponding to the specified behavior attribute category includes: if the identifiers of multiple access requests or the sequential relationship of multiple access requests included in the file upload request, the file download request, or the click-to-play request for a video resource corresponding to the current access request are incorrect, determining that the current access request is an abnormal access; or If the specified behavior attribute category includes a click-to-play request for a video resource, configuring the abnormal behavior detection strategy corresponding to the specified behavior attribute category includes: if the average value of the time difference between the request moment of the corresponding user's click-to-play request and the playback moment of the video resource within a preset time length before the current access request is less than a preset time length threshold, determining that the current access request is an abnormal access.

18. The device according to claim 12, wherein, The decision module is used to: Based on the behavior attribute information, a pre-trained abnormal behavior detection model is used to predict whether the access request is an abnormal access.

19. The device according to any one of claims 12 - 18, wherein, The device also includes: A handling module, used for handling the access request based on the decision result; The returning module is used to return the processing result of the access request to the gateway.

20. The device according to claim 19, wherein, The processing module is used to: If the decision result identifies the access request as a normal access request, configure the handling result of the access request to be release; If the decision result identifies the access request as an abnormal access request, the handling result of the access request is configured to be intercepted, or to be verified again using a verification code.

21. The device according to claim 20, wherein, The processing module is used to: If the decision result identifies the access request as an abnormal access request, but the access request cannot be intercepted or the verification code is verified again, an abnormal flag is configured in the header of the access request.

22. The device according to claim 21, wherein, The return module is used to: The access request with the exception identifier in the header is returned to the gateway, so that the gateway forwards the access request with the exception identifier in the header to the server, and the server performs business processing on the access request based on the exception identifier.

23. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 11.

24. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to execute the method according to any one of claims 1-11.

25. A computer program product comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1-11.

Images