Method, device, electronic device and readable storage medium for statistical access information

Abstract

The present application discloses a statistical method, device, electronic device and readable storage medium for access information, the method comprising: obtaining the training data traffic of the target application; extracting features from the training data traffic to obtain traffic data features; based on the combination of supervised learning and unsupervised learning, performing feature conversion on the traffic data features to learn the underlying logic, access logic and business logic of the target application to obtain the business statistical model of the target application; based on the business statistical model, statistically analyzing the access information of the target application. The present application is based on artificial intelligence methods, and can efficiently and accurately analyze the access information of the target application from multiple dimensions, and can provide standardized or customized information files, providing a solid foundation for application management.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a statistical method, device, electronic device and readable storage medium for access information. Background Art

[0002] With the rapid development of Internet technology, more and more users access servers or other terminals on the Internet through Web applications. However, there are many attacks during access, such as SQL injection, Advanced Persistent Threat (APT), etc., which pose great security risks to servers or other terminals connected to the Internet. This also brings great challenges to application management and user statistics. In actual applications, access information is undoubtedly very important reference data for website operation, maintenance, update and other aspects, but in the existing technology, there is no ideal method for statistics of access information. Summary of the invention

[0003] The embodiments of the present application provide a statistical method, device, electronic device and readable storage medium for access information to overcome or at least partially overcome the deficiencies of the prior art.

[0004] In a first aspect, a method for counting access information is provided, which is executed by a management server, and the method includes:

[0005] Obtain training data traffic for the target application;

[0006] Extracting features from the training data flow to obtain flow data features;

[0007] Based on the combination of supervised learning and unsupervised learning, the traffic data features are transformed to learn the underlying logic, access logic and business logic of the target application, and obtain a business statistical model of the target application;

[0008] Based on the business statistical model, statistics are collected on the access information of the target application.

[0009] Optionally, in the above method, the step of collecting statistics on access information of the target application based on the business statistical model includes:

[0010] Access to target applications is classified and summarized according to source, purpose, attack type, and proof of concept content to form access information statistics files. Management Server

[0011] Optionally, the above method further includes:

[0012] An application whitelist is generated based on the learning results of the underlying logic, access logic and business logic of the target application.

[0013] Optionally, in the above method, obtaining the training data flow of the target application includes:

[0014] Provide management applications on user terminals;

[0015] Introducing access traffic to a target application based on a target protocol into the management application;

[0016] Obtaining access traffic to the target application through the management application;

[0017] Parameterizing and analyzing the access traffic to obtain normal access traffic and risky access traffic to the target application;

[0018] The normal access traffic and risky access traffic are used as the training data traffic.

[0019] Optionally, in the above method, the training data traffic is application requests and application responses based on http or https protocol;

[0020] The feature extraction of the training data flow to obtain the flow data features includes:

[0021] The packet header parameters and parameter values, time, event classification, context information, source and destination of the application request and the application response are respectively obtained as the traffic data features.

[0022] Optionally, in the above method, the feature conversion of the traffic data features based on the combination of supervised learning and unsupervised learning to learn the underlying logic, access logic and business logic of the target application to obtain the security protection model of the target application includes:

[0023] Based on an unsupervised learning method, the traffic data features are dimensionally upgraded, and the dimensionally upgraded data are associated to obtain first high-dimensional data representing the underlying logic, access logic, and business logic of the target application, and the first high-dimensional data is projected into first low-dimensional data to establish a primary security protection model;

[0024] Based on a supervised learning method, the training data traffic is classified and learned, and the second high dimensional data representing the traffic data characteristics of the training data traffic is projected into second low dimensional data. The parameters of the primary security protection model are optimized according to the second low dimensional data to obtain a security protection model.

[0025] Optionally, in the above method, associating the dimensionally upgraded data to obtain the first high-dimensional data representing the underlying logic, access logic, and business logic of the target application includes:

[0026] Using a matrix to represent the correlation of the upgraded data in different dimensions, the underlying logic of the target application is obtained, wherein the underlying logic includes a basic architecture, a directory structure, and resources of the target application;

[0027] Determine the correlation between the training data flow and the directory structure to obtain the business logic of the target application;

[0028] Determine the correlation of the training data traffic from different sources based on the business logic to obtain the access logic of the target application;

[0029] The data representing the underlying logic, access logic, and business logic of the target application is used as the first high-dimensional data.

[0030] In a second aspect, a statistical device for access information is provided, which is deployed in a management server, and the device includes:

[0031] An acquisition unit, used for acquiring training data flow of a target application;

[0032] A feature extraction unit, used to extract features from the training data flow to obtain flow data features;

[0033] A model training unit, used to perform feature conversion on the traffic data features based on a combination of supervised learning and unsupervised learning, so as to learn the underlying logic, access logic and business logic of the target application and obtain a business statistical model of the target application;

[0034] A statistical unit is used to collect statistics on the access information of the target application based on the business statistical model. In a third aspect of the management server, an embodiment of the present application also provides an electronic device, including: a processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to perform any of the above methods.

[0035] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores one or more programs, and when the one or more programs are executed by an electronic device including multiple applications, the electronic device executes any of the above methods.

[0036] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0037] This application learns the characteristics of the target application's access traffic data by combining supervised learning with unsupervised learning, thereby learning the triple logic of the target application's underlying logic, access logic, and business logic, and obtaining a business statistical model "tailored" for the target application. This business statistical model can quickly and efficiently count the traffic data of the target application. Based on artificial intelligence methods, this application can efficiently and accurately count the target application's access information from multiple dimensions, and can provide standardized or customized information files, providing a solid foundation for application management. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0039] Figure 1 A schematic diagram showing a flow chart of a method for collecting statistics of access information according to an embodiment of the present application;

[0040] Figure 2 A schematic diagram showing the structure of a device for collecting statistics of access information according to an embodiment of the present application;

[0041] Figure 3 This is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0043] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0044] This application is made to identify business application access distribution, security risks, etc., and to help operation and maintenance personnel optimize business applications. Figure 1 A schematic diagram showing a flow chart of a method for collecting statistics of access information according to an embodiment of the present application, which method can be executed by a management server. Figure 1 It can be seen that the present application at least includes steps S110 to S140:

[0045] Step S110: Obtain training data traffic of the target application.

[0046] The applications in this application include but are not limited to Web applications, such as message boards, chat rooms, forums, etc., which are all Web applications. The main forms of Web applications are hypertext, hypermedia, and hypertext transfer protocol.

[0047] During the training process, the training data traffic for the target application is first obtained. The training data traffic here can be all access data traffic to the target application within a period of time, including normal access and abnormal access. It should be noted that this data traffic refers to broad traffic, including requests to the target application, responses of the target application to the requests, and function calls, etc.

[0048] It should be noted that, in the prior art, the access data traffic to the target application directly reaches the target application. In the present application, what is different from the prior art is that this part of the traffic needs to be "intercepted" to the management server that executes the present application. Specifically, the access traffic of the target application can be switched to the management server by bypassing the reverse proxy, thereby ensuring that the management server can establish normal access to the application.

[0049] Step S120: extracting features from the training data flow to obtain flow data features.

[0050] Then, feature extraction is performed on the training data traffic, and the objects of feature extraction include but are not limited to the header information of the request and response, and the payload information of the request and response; specifically, it includes multiple fields of header information and multiple fields of payload information, wherein the fields of header information include but are not limited to field type, value composition, distribution of value content, etc., and the fields of payload information include but are not limited to character type, data, character distribution, etc.

[0051] In some embodiments of the present application, the training data traffic is application requests and application responses based on the http or https protocol; feature extraction is performed on the training data traffic to obtain traffic data features including: obtaining packet header parameters and parameter values, time, event classification, context information, source and destination of application requests and application responses respectively as traffic data features.

[0052] Step S130: Based on the combination of supervised learning and unsupervised learning, feature conversion is performed on the traffic data features to learn the underlying logic, access logic and business logic of the target application to obtain a business statistical model of the target application.

[0053] During the training process, by analyzing the characteristics of the data traffic of the target application, based on a combination of supervised learning and unsupervised learning algorithms, the security crawler inside the algorithm is used to learn the application's underlying logic, access logic, and business logic, thereby fully mastering the target application and forming a tailor-made business statistical model for the target application.

[0054] The data traffic features generated by the request to access the target application, the target application's response to the request, and the function call instructions all contain information about the target application. By performing feature conversion on these features, we can learn the target application's triple logic, which is the underlying logic, access logic, and business logic, thereby establishing a personalized business statistical model for the target application.

[0055] The process of feature conversion can be achieved by combining supervised learning and unsupervised learning. Supervised learning means that the samples in the data set have corresponding "correct answers", that is, labels. According to whether the results are continuous, they are divided into regression and classification. Regression problem: that is, to derive a continuous output through regression; classification problem: its goal is to derive a set of discrete values. Unsupervised learning means that the data samples do not have any labels or have the same labels or no labels. By finding a certain structure from the data, unsupervised learning can determine that the data has two different clusters, one is this and the other is another, and the two are different. Unsupervised learning algorithms may divide these data into two different clusters. That's why it's called a clustering algorithm. The algorithm is not given the correct answer to respond to the data in the data set, so this is unsupervised learning, and the result is uncertain.

[0056] In some embodiments of the present application, the characteristics of all access traffic can be learned based on an unsupervised learning method to generate an initial business statistics model; then, based on a supervised method, the characteristics of the access traffic containing labels can be learned to optimize the parameters of the initial business statistics model to obtain a business statistics model with higher recognition accuracy.

[0057] Step S140: Based on the business statistical model, collect statistics on the access information of the target application.

[0058] The business statistics model has many functions. On the one hand, during the test process, the user requests of the target application are identified through the established security protection model to distinguish between normal access and abnormal access. On the other hand, it can also conduct comprehensive statistics on the traffic data of the target application, such as user distribution, each request and the corresponding source, purpose, risk and other dimensions. In some embodiments of the present application, the access to the target application is classified and summarized according to the source, purpose, attack type, and proof of concept content to form an access information statistical file; further, standardized, customized, and visualized text reports or graphic reports can be generated for reference by operation and maintenance personnel.

[0059] In some embodiments of the present application, an application whitelist may also be generated based on the learning results, thereby intercepting unauthenticated programs and protecting user terminals from harm.

[0060] Depend on Figure 1 It can be seen from the method shown that the present application learns the characteristics of the target application's access traffic data by combining supervised learning with unsupervised learning, thereby realizing the triple logic learning of the target application's underlying logic, access logic, and business logic, and obtaining a business statistical model "tailored" for the target application. The business statistical model can quickly and efficiently count the traffic data of the target application. Based on artificial intelligence methods, the present application can efficiently and accurately count the target application's access information from multiple dimensions, and can provide standardized or customized information files, providing a solid foundation for application management.

[0061] In some embodiments of the present application, the training data traffic can be first classified and labeled for subsequent training use, such as obtaining the training data traffic of the target application in the following manner, which may specifically include but is not limited to: providing a management application on the user terminal; introducing access traffic to the target application based on the target protocol into the management application; obtaining access traffic to the target application through the management application; parameterizing and analyzing the access traffic to obtain normal access traffic and risky access traffic to the target application; and using the normal access traffic and risky access traffic as the training data traffic.

[0062] In order to obtain traffic, a management application may be provided on the user terminal, and the management application is connected to the management server on the server side. The management application is responsible for "intercepting" the traffic and introducing it into the management server on the server side.

[0063] Web applications are usually based on http or https communication protocols. These two protocols are set as target protocols. The management application will "intercept" the access traffic of the target application based on the target protocol and introduce it into the management server.

[0064] The initial access traffic to the target application is considered untrustworthy. The management server can make a primary classification of this traffic. Specifically, it can parameterize and analyze this traffic to obtain normal access traffic and risky access traffic to the target application; and use normal access traffic and risky access traffic as training data traffic.

[0065] In some embodiments of the present application, all traffic is stored in the cache of the management server, and a series of states such as requests, responses, and function calls are parameterized through algorithms. These parameters are then convolved in a neural network, and the results of the convolution are analyzed again to identify a portion of normal accesses. Another portion that is considered risky after analysis will be given an alarm, and then based on the results of the learning again, a portion of normal accesses is obtained from the risky access traffic, and the remaining access traffic is treated as risky access traffic.

[0066] Furthermore, this primary classification can be used to label access traffic and use it as training data traffic.

[0067] In some embodiments of the present application, both normal access traffic and risky access traffic are required during the training process. First, based on an unsupervised learning method, all traffic data without labels can be clustered and learned. Specifically, the traffic data features of the training data traffic are upgraded in dimension, and the upgraded data are associated. This association is the first high-dimensional data that characterizes the underlying logic, access logic, and business logic of the target application. Then, after linear transformation, noise elimination, and redundant data elimination, the first high-dimensional data is projected into the first low-dimensional data, and the model parameters are automatically adjusted through machine learning to generate a primary business statistics model.

[0068] Among them, the learning of the three logics of underlying logic, access logic and business logic, first of all, is the learning of underlying logic. Specifically, use matrix to represent the correlation of data in different dimensions after dimensionality increase. This correlation is the underlying logic of the target application. The underlying logic mainly includes the basic architecture, directory structure and resources of the target application, etc.; further, determine the correlation between training data traffic and directory structure, this correlation is the business logic of the target application; finally, the correlation of access traffic from different sources in training data traffic based on business logic is the access logic of the target application; thus, step by step, the data representing the underlying logic, access logic and business logic of the target application are obtained as the first high-dimensional data.

[0069] That is to say, when performing unsupervised learning, it is only necessary to pull in the traffic of the target application to be protected, and use algorithm rules to classify the data that has been upgraded through the request and response header parameters and parameter values, time, event classification, request and response context, source and destination information. After eliminating noise and redundant data through linear transformation, the high-dimensional data is projected into a low-dimensional space, and the parameters are automatically adjusted by the machine to generate a primary business statistics model.

[0070] In some embodiments of the present application, the unsupervised learning method principal components analysis (PCA) method may be, but is not limited to, commonly used for dimensionality reduction of high-dimensional data, and may be used to extract main characteristic components of data.

[0071] Then, based on the supervised learning method, the parameters of the primary business statistics model are further adjusted to improve the accuracy of the primary business statistics model. Specifically, based on the supervised learning method, the labeled training data traffic is classified and learned, the second highest dimensional data representing the traffic data characteristics of the training data traffic is projected into the second lowest dimensional data, and the parameters of the primary business statistics model are optimized according to the second lowest dimensional data to obtain the business statistics model.

[0072] That is to say, in supervised learning, learning is carried out in the form of positive and negative samples. The two types of data samples are processed in multiple layers and then reduced in dimension to obtain the characteristic distribution after dimensionality reduction. The machine automatically adjusts and optimizes the parameters, and optimizes the primary business statistical model obtained by the unsupervised learning method to obtain a personalized business statistical model for the target application. Through the identification of the business statistical model, normal business access and attack access can be distinguished, and the business access situation can also be statistically analyzed.

[0073] In some embodiments of the present application, the supervised learning method can be but is not limited to linear discriminant analysis (LDA algorithm). In this method, the same category is as close as possible, and the distance between the category centers of different categories is as far as possible; it can be used not only for classification but also for classification. In some embodiments of the present application, the parameters of the request and response are classified by LDA and PCA algorithms, and then projected from two-dimensional data to one dimension for dimensionality reduction, so as to distinguish normal access from attack access. The specific processing process of LDA and PCA algorithms on data can refer to the prior art.

[0074] It should be noted that, for a target application, there may be one or multiple target applications with common characteristics in one training to improve training efficiency.

[0075] In the test process of abnormal access, the triple logic of application request is identified in the same way as the training process. Specifically, the access to the target application is input into the business access model so that the business access model can identify the underlying logic, access logic and business logic of the target application access, thereby realizing the identification of abnormal access. In the test process, the method of determining the triple logic is the same as the training process, which will not be repeated here.

[0076] Figure 2 A schematic diagram showing a structure of a statistical device for access information according to an embodiment of the present application, wherein the device can be deployed in a management server. Figure 2 It can be seen that the access information statistics device 200 includes:

[0077] An acquisition unit 210, which acquires the training data flow of the target application;

[0078] A feature extraction unit 220 is used to extract features from the training data flow to obtain flow data features;

[0079] A model training unit 230 is used to perform feature conversion on the traffic data features based on a combination of supervised learning and unsupervised learning, so as to learn the underlying logic, access logic and business logic of the target application and obtain a business statistical model of the target application;

[0080] The statistical unit 240 is used to collect statistics on the access information of the target application based on the business statistical model.

[0081] In some embodiments of the present application, in the above-mentioned device, the statistical unit 240 is used to classify and summarize the access to the target application according to the source, purpose, attack type, and concept verification content to form an access information statistical file.

[0082] In some embodiments of the present application, in the above-mentioned device, the model training unit 230 is also used to generate an application whitelist based on the learning results of the underlying logic, access logic and business logic of the target application.

[0083] In some embodiments of the present application, in the above-mentioned device, the acquisition unit 210 is used to provide a management application on the user terminal; introduce access traffic to the target application based on the target protocol into the management application; obtain access traffic to the target application through the management application; parameterize and analyze the access traffic to obtain normal access traffic and risky access traffic to the target application; and use the normal access traffic and risky access traffic as the training data traffic.

[0084] In some embodiments of the present application, in the above-mentioned device, the training data traffic is an application request and an application response based on the http or https protocol; the feature extraction unit 220 is used to obtain the packet header parameters and parameter values, time, event classification, context information, source and destination of the application request and the application response respectively as the traffic data features.

[0085] In some embodiments of the present application, in the above-mentioned device, the model training unit 230 is used to upgrade the traffic data characteristics based on an unsupervised learning method, establish associations with the upgraded data, obtain first high-dimensional data representing the underlying logic, access logic and business logic of the target application, and project the first high-dimensional data into first low-dimensional data to establish a primary security protection model; and is used to classify and learn the training data traffic based on a supervised learning method, project the second high-dimensional data representing the traffic data characteristics of the training data traffic into second low-dimensional data, optimize the parameters of the primary security protection model according to the second low-dimensional data, and obtain a security protection model.

[0086] In some embodiments of the present application, in the above-mentioned device, the model training unit 230 is used to use a matrix to represent the correlation of the upgraded data in different dimensions to obtain the underlying logic of the target application, wherein the underlying logic includes the basic architecture, directory structure and resources of the target application; determine the correlation between the normal access traffic and the directory structure to obtain the business logic of the target application; determine the normal access traffic from different sources, and obtain the access logic of the target application based on the correlation of the business logic; and use the data representing the underlying logic, access logic and business logic of the target application as the first high-dimensional data.

[0087] It should be noted that the above-mentioned statistical device for access information can implement the above-mentioned statistical method for access information one by one, which will not be described in detail.

[0088] Figure 3 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 3 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0089] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0090] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0091] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a statistical device for access information at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

[0092] Obtain training data traffic for the target application;

[0093] Extracting features from the training data flow to obtain flow data features;

[0094] Based on the combination of supervised learning and unsupervised learning, the traffic data features are transformed to learn the underlying logic, access logic and business logic of the target application, and obtain a business statistical model of the target application;

[0095] Based on the business statistical model, statistics are collected on the access information of the target application.

[0096] The above application Figure 2The method performed by the statistical device for access information disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in software form. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0097] The electronic device may also perform Figure 2 A method for executing a statistical device for accessing information in a Figure 2 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0098] The present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by an electronic device including multiple application programs, enable the electronic device to execute Figure 2 The method performed by the statistical device for accessing information in the embodiment shown is specifically used to perform:

[0099] Obtain training data traffic for the target application;

[0100] Extracting features from the training data flow to obtain flow data features;

[0101] Based on the combination of supervised learning and unsupervised learning, the traffic data features are transformed to learn the underlying logic, access logic and business logic of the target application, and obtain a business statistical model of the target application;

[0102] Based on the business statistical model, statistics are collected on the access information of the target application.

[0103] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0104] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0105] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0106] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0107] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0108] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0109] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0110] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0111] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0112] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A statistical method for access information, characterized in that: Executed by a management server, the method includes: Obtain training data traffic for the target application; Extracting features from the training data flow to obtain flow data features; Based on the combination of supervised learning and unsupervised learning, the traffic data features are transformed to learn the underlying logic, access logic and business logic of the target application, and obtain a business statistical model of the target application; Based on the business statistical model, statistics are collected on the access information of the target application; The combination of supervised learning and unsupervised learning is used to transform the traffic data features to learn the underlying logic, access logic and business logic of the target application, and obtain the security protection model of the target application, including: Based on an unsupervised learning method, the traffic data features are dimensionally upgraded, and the dimensionally upgraded data are associated to obtain first high-dimensional data representing the underlying logic, access logic, and business logic of the target application, and the first high-dimensional data is projected into first low-dimensional data to establish a primary security protection model; Based on a supervised learning method, the training data traffic is classified and learned, and the second high dimensional data representing the traffic data characteristics of the training data traffic is projected into second low dimensional data. The parameters of the primary security protection model are optimized according to the second low dimensional data to obtain a security protection model.

2. The method according to claim 1, characterized in that The collecting statistics of the access information of the target application based on the business statistical model includes: Access to target applications is classified and summarized according to source, purpose, attack type, and proof-of-concept content to form an access information statistics file.

3. The method according to claim 1, characterized in that The method further comprises: An application whitelist is generated based on the learning results of the underlying logic, access logic and business logic of the target application.

4. The method according to claim 1, characterized in that: The step of obtaining the training data flow of the target application includes: Provide management applications on user terminals; Introducing access traffic to a target application based on a target protocol into the management application; Obtaining access traffic to the target application through the management application; Parameterizing and analyzing the access traffic to obtain normal access traffic and risky access traffic to the target application; The normal access traffic and risky access traffic are used as the training data traffic.

5. The method according to claim 1, characterized in that The training data traffic is application requests and application responses based on http or https protocol; The feature extraction of the training data flow to obtain the flow data features includes: The packet header parameters and parameter values, time, event classification, context information, source and destination of the application request and the application response are respectively obtained as the traffic data features.

6. The method according to claim 5, characterized in that The step of establishing an association with the dimensionally upgraded data to obtain the first high-dimensional data representing the underlying logic, access logic, and business logic of the target application includes: Using a matrix to represent the correlation of the upgraded data in different dimensions, the underlying logic of the target application is obtained, wherein the underlying logic includes a basic architecture, a directory structure, and resources of the target application; Determine the correlation between the training data flow and the directory structure to obtain the business logic of the target application; Determine the correlation of the training data traffic from different sources based on the business logic to obtain the access logic of the target application; The data representing the underlying logic, access logic, and business logic of the target application is used as the first high-dimensional data.

7. A statistical device for access information, characterized in that: Deployed in a management server, the device includes: An acquisition unit, used for acquiring training data flow of a target application; A feature extraction unit, used to extract features from the training data flow to obtain flow data features; A model training unit is used to perform feature conversion on the traffic data features based on a combination of supervised learning and unsupervised learning, so as to learn the underlying logic, access logic and business logic of the target application and obtain the business statistical model of the target application; specifically, it is used to perform dimension upgrade on the traffic data features based on an unsupervised learning method, establish associations for the dimension upgraded data, obtain first high-dimensional data representing the underlying logic, access logic and business logic of the target application, and project the first high-dimensional data into first low-dimensional data to establish a primary security protection model; Based on a supervised learning method, the training data traffic is classified and learned, the second high-dimensional data representing the traffic data characteristics of the training data traffic is projected into second low-dimensional data, and the parameters of the primary security protection model are optimized according to the second low-dimensional data to obtain a security protection model; The statistical unit is used to collect statistics on the access information of the target application based on the business statistical model.

8. An electronic device comprising: processor; as well as A memory arranged to store computer executable instructions, wherein when the executable instructions are executed, the processor executes the statistical method for access information as claimed in any one of claims 1 to 6.

9. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of application programs, enable the electronic device to execute the access information statistics method according to claims 1 to 6.

Images