An anomaly detection method and device

Abstract

An embodiment of the present invention provides an anomaly detection method and apparatus. The method includes: when the platform receives a target e-commerce service request for a target business system, determining the target security level information of the target business system and determining a plurality of target servers corresponding to the target business system; obtaining the historical anomaly log data of the target user account that submits the target e-commerce service request, and determining at least one server to be polled from the plurality of target servers according to the historical anomaly log data; generating a polling instruction for at least one server to be polled according to the target security level information; and sequentially polling at least one server to be polled according to the polling instruction. Through the embodiment of the present invention, it is realized to detect the server according to the anomaly data of the account using the current service, so as to detect the business system in a targeted manner; and by polling some of the servers, the resource consumption in the detection process is avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of data detection, and particularly to an anomaly detection method and device. Background Art

[0002] When the business system of a platform provides services to users, it may also be invaded and maliciously accessed by illegal users, resulting in the crash of the business system and the inability to provide services to other users. Existing anomaly detections generally occur after an anomaly has occurred and has affected the use of services by other users, and the detection is not timely. If the business system is detected in real time, it will consume a large amount of resources. Summary of the Invention

[0003] In view of the above problems, an anomaly detection method and device are proposed to overcome or at least partially solve the above problems, including:

[0004] An anomaly detection method, where a platform provides unified external services for multiple docked business systems, and each business system deploys multiple servers. The method includes:

[0005] When the platform receives a target e-commerce business request for a target business system, determine the target security level information of the target business system, and determine multiple target servers corresponding to the target business system;

[0006] Obtain the historical anomaly log data of the target user account that submitted the target e-commerce business request, and determine at least one server to be polled from the multiple target servers according to the historical anomaly log data;

[0007] Generate a polling instruction for at least one server to be polled according to the target security level information;

[0008] Poll at least one server to be polled in sequence according to the polling instruction.

[0009] Optionally, the polling instruction includes the number of polling times, the polling interval, and a data acquisition request;

[0010] Polling at least one server to be polled in sequence according to the polling instruction includes:

[0011] Send a data acquisition request to at least one server to be polled according to the number of polling times and the polling interval.

[0012] Optionally, obtaining the historical anomaly log data of the target user account that submitted the target e-commerce business request includes:

[0013] Obtain the anomaly log data generated when the target user account logged in to the platform previously, and use it as the historical anomaly log data of the target user account.

[0014] Optionally, the method further includes:

[0015] Determining attribute information of a target user account;

[0016] Obtaining other user accounts associated with the target user account according to the attribute information, obtaining abnormal log data generated when the other user accounts logged in to the platform previously, and using it as historical abnormal log data of the target user account.

[0017] Optionally, determining target security level information of a target business system includes:

[0018] Determining a target e-commerce service provided by the target business system;

[0019] Determining the target security level information of the target business system according to the target e-commerce service.

[0020] Optionally, generating a polling instruction for at least one server to be polled according to the target security level information includes:

[0021] Determining the polling times and polling intervals for at least one server to be polled according to the target security level information.

[0022] Optionally, the method further includes:

[0023] Receiving polling data returned by at least one server to be polled, and performing abnormal detection on the polling data.

[0024] An abnormal detection device, where the platform provides unified external services for multiple docked business systems, and multiple servers are deployed in each business system; the device includes:

[0025] A first determination module, configured to determine the target security level information of the target business system and determine multiple target servers corresponding to the target business system when the platform receives a target e-commerce service request for the target business system;

[0026] A second determination module, configured to obtain historical abnormal log data of a target user account that submits the target e-commerce service request, and determine at least one server to be polled from the multiple target servers according to the historical abnormal log data;

[0027] An instruction generation module, configured to generate a polling instruction for at least one server to be polled according to the target security level information;

[0028] A polling module, configured to poll at least one server to be polled in sequence according to the polling instruction.

[0029] A server, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, where the computer program, when executed by the processor, implements the above-mentioned anomaly detection method.

[0030] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned anomaly detection method is implemented.

[0031] The embodiments of the present invention have the following advantages:

[0032] In the embodiments of the present invention, when a target e-commerce service request for a target service system is received, the target security level information of the target service system is determined, and a plurality of target servers corresponding to the target service system are determined; the historical anomaly log data of the target user account that submits the target e-commerce service request is obtained, and at least one server to be polled is determined from the plurality of target servers according to the historical anomaly log data; a polling instruction for at least one server to be polled is generated according to the target security level information; and at least one server to be polled is polled in sequence according to the polling instruction. Through the embodiments of the present invention, it is realized to detect the server according to the anomaly data of the account using the current service, so as to detect the service system in a targeted manner; and by polling some of the servers, the resource consumption in the detection process is avoided. Description of the Drawings

[0033] In order to more clearly illustrate the technical solutions of the present invention, the drawings required for the description of the present invention will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can also obtain other drawings without creative efforts based on these drawings.

[0034] Figure 1 is a flowchart of the steps of an anomaly detection method according to an embodiment of the present invention;

[0035] Figure 2 is a flowchart of the steps of another anomaly detection method according to an embodiment of the present invention;

[0036] Figure 3 is a structural block diagram of an anomaly detection device according to an embodiment of the present invention. Detailed Embodiments

[0037] To make the above objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of protection of the present invention.

[0038] Referring to Figure 1 , a step flowchart of an anomaly detection method according to an embodiment of the present invention is shown. The platform provides unified external services for multiple docked business systems. Each business system deploys multiple servers, and the multiple servers can provide different functions for the business system, such as: permission verification, data storage, data processing, etc.

[0039] Specifically, the following steps may be included:

[0040] Step 101: When receiving a target e-commerce business request for a target business system, determine the target security level information of the target business system and determine multiple target servers corresponding to the target business system;

[0041] When a user needs to use an e-commerce business in a platform (such as an e-commerce platform), the user can first open the platform on the terminal device so that the user interface provided by the platform is displayed on the terminal device.

[0042] Then, the user can select the target e-commerce business to be used in the user interface provided by the platform and perform corresponding operations to generate a target e-commerce business request for the target business system that can provide the target e-commerce business.

[0043] When the platform receives the target e-commerce business request, it can first determine the target security level information of the target business system that provides the target e-commerce business, so as to determine how to poll the servers of the target business system subsequently. The target security level information can be set in advance for the target business system, and the embodiments of the present invention do not limit this.

[0044] At the same time, multiple target servers pre-deployed for the target business system can also be determined.

[0045] Step 102: Obtain the historical anomaly log data of the target user account that submitted the target e-commerce business request, and determine at least one server to be polled from the multiple target servers according to the historical anomaly log data;

[0046] If a user often logs in to the platform to perform some illegal operations, the platform can record them and generate corresponding abnormal log data; when the user logs in again, it can be considered that the user may still perform illegal operations when logging in to the platform; and such operations may cause the server of the business system to malfunction.

[0047] In order to detect server anomalies in a timely manner, when a user logs in to the platform using a target user account and uses a target e-commerce service, the historical abnormal log data of the target user account can be obtained.

[0048] After obtaining the historical abnormal log data, the historical abnormal log data can be analyzed to identify the server that malfunctioned after the target user account logged in to the platform.

[0049] Specifically, at least one server that may malfunction currently can be determined from multiple target servers deployed for the target business system according to the historical abnormal log data, and used as the server to be polled.

[0050] Step 103: Generate a polling instruction for at least one server to be polled according to the target security level information;

[0051] After determining the server to be polled and the target security level information of the target business system, a polling instruction for the server to be polled can be generated based on the target security level information.

[0052] Specifically, for a target business system with a higher target security level information, a polling instruction with a larger number of polling times can be generated, and for a target business system with a lower target security level information, a polling instruction with a smaller number of polling times can be generated. The embodiments of the present invention do not limit this.

[0053] Step 104: Poll at least one server to be polled in sequence according to the polling instruction.

[0054] After generating the polling instruction, the at least one server to be polled determined can be polled in sequence according to the polling instruction; for example: if the determined servers to be polled include A, B, C, and D, then A can be polled first, then B, then C, and finally D. The embodiments of the present invention do not limit this.

[0055] In an embodiment of the present invention, the following steps may further be included:

[0056] Receive the polling data returned by at least one server to be polled, and perform anomaly detection on the polling data.

[0057] After receiving the polling instruction, the server to be polled can generate polling data on the working condition of the server to be polled, and the polling data can be used to identify whether the server to be polled malfunctions.

[0058] After receiving the polling data, anomaly detection can be performed on the polling data for analysis and identification, so as to determine whether an anomaly has occurred in the server to be polled.

[0059] In an embodiment of the present invention, when a target e-commerce service request for a target service system is received, the target security level information of the target service system is determined, and a plurality of target servers corresponding to the target service system are determined; historical anomaly log data of the target user account that submits the target e-commerce service request is obtained, and at least one server to be polled is determined from the plurality of target servers according to the historical anomaly log data; a polling instruction for at least one server to be polled is generated according to the target security level information; and at least one server to be polled is polled in sequence according to the polling instruction. Through the embodiment of the present invention, it is realized to detect the server according to the anomaly data of the account using the current service, so as to detect the service system in a targeted manner; and by polling some of the servers, resource consumption in the detection process is avoided.

[0060] Refer to Figure 2 , which shows a flowchart of steps of another anomaly detection method according to an embodiment of the present invention, including the following steps:

[0061] Step 201, when a target e-commerce service request for a target service system is received, determine the target security level information of the target service system, and determine a plurality of target servers corresponding to the target service system;

[0062] When a user needs to use the e-commerce service in the platform, the platform can be opened on the terminal device first, so as to display the user interface provided by the platform on the terminal device.

[0063] Then, the user can select the target e-commerce service to be used in the user interface provided by the platform and perform corresponding operations to generate a target e-commerce service request for the target service system that can provide the target e-commerce service.

[0064] When the platform receives the target e-commerce service request, it can first determine the target security level information of the target service system that provides the target e-commerce service, so as to determine how to poll the servers of the target service system subsequently. The target security level information can be set in advance for the target service system, and the embodiment of the present invention does not limit this.

[0065] At the same time, a plurality of target servers deployed in advance for the target service system can also be determined.

[0066] In an embodiment of the present invention, the target security level information of the target service system can be determined through the following steps:

[0067] Determine the target e-commerce service provided by the target business system; based on the target e-commerce service, determine the target security level information of the target business system.

[0068] The importance levels of different e-commerce services are also different. For example, providing e-commerce services related to finance is more important than providing e-commerce services related to computing. Therefore, different target security level information can be set in advance for different e-commerce services.

[0069] Thus, when determining the target business system, the target security level information of the target business system can be determined based on the target security level information of the target e-commerce service.

[0070] Step 202: Obtain the abnormal log data generated when the target user account logged in to the platform previously, and use it as the historical abnormal log data of the target user account;

[0071] To detect server anomalies in a timely manner, when a user logs in to the platform using the target user account and uses the target e-commerce service, the historical abnormal log data of the target user account can be obtained.

[0072] As an example, the data generated when the target user account logged in to the platform previously and caused anomalies in the business system after using the service in the business system can be used as the historical abnormal log data of the target user account.

[0073] In an embodiment of the present invention, the historical abnormal log data can also be determined through the following steps:

[0074] Determine the attribute information of the target user account; based on the attribute information, obtain other user accounts associated with the target user account, and obtain the abnormal log data generated when these other user accounts logged in to the platform previously, and use it as the historical abnormal log data of the target user account.

[0075] In practical applications, accounts that initiate intrusion and malicious access to the server may be related; therefore, the abnormal log data of other accounts associated with the target user account can also be used as the historical abnormal log data of the target user account.

[0076] Specifically, the attribute information of the target user account can be determined first, such as: login address, registration time, registered personal information, etc.; then, based on this attribute information, other user accounts in the platform can be determined and used as other user accounts associated with the target user account.

[0077] After determining other user accounts associated with the target user account, it is possible to obtain the abnormal log data generated when the business system was used and an abnormality occurred in the business system when the other user account logged in to the platform previously; then, this abnormal log data is also used as the historical abnormal log data of the target user account, thereby improving the accuracy when polling the server subsequently and avoiding omitting the servers that need to be polled.

[0078] Step 203: Determine at least one server to be polled from multiple target servers according to the historical abnormal log data;

[0079] After obtaining the historical abnormal log data, it is possible to analyze the historical abnormal log data to identify the servers where abnormalities occurred after the target user account logged in to the platform.

[0080] Specifically, it is possible to determine at least one server that may currently have an abnormality from the multiple target servers deployed for the target business system according to the historical abnormal log data, and use it as the server to be polled.

[0081] Step 204: Generate a polling instruction for at least one server to be polled according to the target security level information; the polling instruction includes the number of polling times, the polling interval, and the data acquisition request;

[0082] As an example, the number of polling times can refer to the number of times that need to be polled within a unit time; the polling interval can refer to the time interval between each polling; the data acquisition request can refer to the request for obtaining polling data from the server.

[0083] After determining the server to be polled and the target security level information of the target business system, it is possible to generate a polling instruction for the server to be polled based on the target security level information.

[0084] Specifically, for a target business system with a higher target security level information, a polling instruction with a larger number of polling times can be generated, while for a target business system with a lower target security level information, a polling instruction with a smaller number of polling times can be generated; or, for a target business system with a higher target security level information, a polling instruction with a shorter polling interval can be generated, while for a target business system with a lower target security level information, a polling instruction with a longer polling interval can be generated. The embodiments of the present invention do not limit this.

[0085] In an embodiment of the present invention, step 204 may include the following steps:

[0086] Determine the number of polling times and the polling interval for at least one server to be polled according to the target security level information.

[0087] In practical applications, the polling times and polling intervals for each server to be polled can be determined according to the target security level information. For example, when the target security level information is relatively high, a larger number of polling times and shorter polling intervals can be set; when the target security level information is relatively low, a smaller number of polling times and longer polling intervals can be set. The embodiments of the present invention do not limit this.

[0088] Step 205: Send a data acquisition request to at least one server to be polled according to the polling times and polling intervals.

[0089] Then, data acquisition requests can be sent to each server to be polled in sequence according to the polling times and polling intervals. For example, if the servers to be polled include A, B, and C, the polling times are 10 times, and the polling interval is 1 s, then data acquisition requests can be sent to A, B, C, and D every second, and each server is sent 10 times in total.

[0090] In the embodiments of the present invention, when a target e-commerce service request for a target service system is received, the target security level information of the target service system is determined, and a plurality of target servers corresponding to the target service system are determined; the abnormal log data generated when the target user account logged in to the platform previously is obtained and used as the historical abnormal log data of the target user account; at least one server to be polled is determined from the plurality of target servers according to the historical abnormal log data; a polling instruction for at least one server to be polled is generated according to the target security level information; the polling instruction includes polling times, polling intervals, and data acquisition requests; and a data acquisition request is sent to at least one server to be polled according to the polling times and polling intervals. Through the embodiments of the present invention, the detection of servers is realized according to the abnormal data of the account using the current service, so as to detect the service system in a targeted manner; and by polling some of the servers, the resource consumption in the detection process is avoided.

[0091] It should be noted that for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that the embodiments of the present invention are not limited by the described action sequences, because according to the embodiments of the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0092] Refer to Figure 3 , which shows a schematic diagram of an anomaly detection structure according to an embodiment of the present invention. The platform provides unified external services for multiple docked service systems, and multiple servers are deployed for each service system;

[0093] Specifically, the following modules can be included:

[0094] The first determination module 301 is configured to determine the target security level information of the target business system and determine multiple target servers corresponding to the target business system when receiving a target e-commerce business request for the target business system.

[0095] The second determination module 302 is configured to obtain the historical abnormal log data of the target user account that submits the target e-commerce business request, and determine at least one server to be polled from the multiple target servers according to the historical abnormal log data.

[0096] The instruction generation module 303 is configured to generate a polling instruction for at least one server to be polled according to the target security level information.

[0097] The polling module 304 is configured to poll at least one server to be polled in sequence according to the polling instruction.

[0098] In an embodiment of the present invention, the polling instruction includes the number of polling times, the polling interval, and a data acquisition request.

[0099] The polling module 304 is configured to send a data acquisition request to at least one server to be polled according to the number of polling times and the polling interval.

[0100] In an embodiment of the present invention, the second determination module 302 is configured to obtain the abnormal log data generated when the target user account logged in to the platform previously, and use it as the historical abnormal log data of the target user account.

[0101] In an embodiment of the present invention, the device further includes:

[0102] The third determination module is configured to determine the attribute information of the target user account; obtain other user accounts associated with the target user account according to the attribute information, and obtain the abnormal log data generated when the other user accounts logged in to the platform previously, and use it as the historical abnormal log data of the target user account.

[0103] In an embodiment of the present invention, the first determination module 301 is configured to determine the target e-commerce business provided by the target business system; determine the target security level information of the target business system according to the target e-commerce business.

[0104] In an embodiment of the present invention, the instruction generation module 303 is configured to determine the number of polling times and the polling interval for at least one server to be polled according to the target security level information.

[0105] In an embodiment of the present invention, the device further includes:

[0106] A detection module, configured to receive polling data returned by at least one server to be polled and perform anomaly detection on the polling data.

[0107] In an embodiment of the present invention, when a target e-commerce service request for a target service system is received, the target security level information of the target service system is determined, and a plurality of target servers corresponding to the target service system are determined; historical anomaly log data of a target user account that submits the target e-commerce service request is obtained, and at least one server to be polled is determined from the plurality of target servers according to the historical anomaly log data; a polling instruction for at least one server to be polled is generated according to the target security level information; and at least one server to be polled is polled in sequence according to the polling instruction. Through the embodiment of the present invention, it is realized to detect the server according to the anomaly data of the account using the current service, so as to detect the service system in a targeted manner; and by polling some of the servers, the resource consumption in the detection process is avoided.

[0108] An embodiment of the present invention further provides a server, including a processor, a memory, and a computer program stored on the memory and capable of running on the processor. When the computer program is executed by the processor, the above anomaly detection method is implemented.

[0109] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above anomaly detection method is implemented.

[0110] For the apparatus embodiment, since it is basically similar to the method embodiment, the description is relatively simple. For the relevant parts, refer to the partial description of the method embodiment.

[0111] Each embodiment in this specification is described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the embodiments, reference can be made to each other.

[0112] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, an apparatus, or a computer program product. Therefore, the embodiments of the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0113] Embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, and the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing terminal devices generate a device for implementing the functions specified in the process Figure 1 one process or multiple processes and / or blocks Figure 1 a block or multiple blocks.

[0114] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device implements the functions specified in the process Figure 1 one process or multiple processes and / or blocks Figure 1 a block or multiple blocks.

[0115] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device, such that a series of operation steps are executed on the computer or other programmable terminal device to generate a computer-implemented process. Thus, the instructions executed on the computer or other programmable terminal device provide steps for implementing the functions specified in the process Figure 1 one process or multiple processes and / or blocks Figure 1 a block or multiple blocks.

[0116] Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications once they learn the basic creative concepts. Therefore, the appended claims are intended to be construed to include the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present invention.

[0117] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or terminal device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or terminal device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the existence of additional identical elements in the process, method, article or terminal device comprising the said element.

[0118] The above provides a detailed introduction to an anomaly detection method and device. Specific examples are used in this text to elaborate on the principles and implementation manners of the present invention. The descriptions of the above embodiments are only used to help understand the method and its core idea of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to the present invention.

Claims

1. An anomaly detection method, characterized in that, The platform provides unified external services for multiple business systems connected thereto, and multiple servers are deployed in each business system; the method includes: A user selects a target e-commerce service in the user interface provided by the platform displayed on the terminal device and performs corresponding operations to generate a target e-commerce service request for a target business system providing the target e-commerce service; When the platform receives the target e-commerce service request for the target business system, determine the target security level information of the target business system, and determine a plurality of target servers corresponding to the target business system; Determine the attribute information of the target user account; Obtain other user accounts associated with the target user account according to the attribute information, obtain the abnormal log data generated when the target user account and the other user accounts logged in to the platform previously, and use it as the historical abnormal log data of the target user account, and determine at least one server to be polled from the plurality of target servers according to the historical abnormal log data; wherein, determining at least one server to be polled from the plurality of target servers according to the historical abnormal log data includes: determining at least one server where the target user has an abnormality after logging in to the platform previously from the plurality of target servers according to the historical abnormal log data, and using the server where the target user has an abnormality after logging in to the platform previously as the polling server; Generate a polling instruction for the at least one server to be polled according to the target security level information; Poll the at least one server to be polled in sequence according to the polling instruction; Receive the polling data returned by the at least one server to be polled, and perform abnormal detection on the polling data.

2. The method according to claim 1, wherein The polling instruction includes the number of polling times, the polling interval, and a data acquisition request; The polling the at least one server to be polled in sequence according to the polling instruction includes: Send the data acquisition request to the at least one server to be polled according to the number of polling times and the polling interval.

3. The method according to claim 1, wherein The determining the target security level information of the target business system includes: Determine the target e-commerce service provided by the target business system; Determine the target security level information of the target business system according to the target e-commerce service.

4. The method according to claim 2, characterized in that, The generating a polling instruction for the at least one server to be polled according to the target security level information includes: Determine the number of polling times and the polling interval for the at least one server to be polled according to the target security level information.

5. An anomaly detection device, characterized in that, The platform provides unified external services for multiple business systems connected thereto, and multiple servers are deployed in each business system; the apparatus includes: A first determination module, configured to enable a user to select a target e-commerce service in a user interface provided by the platform displayed on a terminal device and perform corresponding operations, so as to generate a target e-commerce service request for a target service system providing the target e-commerce service; when receiving the target e-commerce service request for the target service system, determine target security level information of the target service system, and determine a plurality of target servers corresponding to the target service system; A second determination module, configured to obtain abnormal log data generated when a target user account logged in to the platform previously, and use it as historical abnormal log data of the target user account, and determine at least one server to be polled from the plurality of target servers according to the historical abnormal log data; wherein, the second determination module is further configured to determine at least one server where the target user has an abnormality after logging in to the platform from the plurality of target servers according to the historical abnormal log data, and use the server where the target user has an abnormality after logging in to the platform as a polling server; An instruction generation module, configured to generate a polling instruction for the at least one server to be polled according to the target security level information; A polling module, configured to sequentially poll the at least one server to be polled according to the polling instruction; A detection module, configured to receive polling data returned by at least one server to be polled, and perform abnormal detection on the polling data; Wherein, the apparatus further includes: A third determination module, configured to determine attribute information of the target user account; obtain other user accounts associated with the target user account according to the attribute information, obtain abnormal log data generated when the other user accounts logged in to the platform previously, and use it as the historical abnormal log data of the target user account.

6. A server, characterized in that, Comprising a processor, a memory, and a computer program stored on the memory and capable of running on the processor, where the computer program, when executed by the processor, implements the abnormal detection method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the abnormal detection method according to any one of claims 1 to 4 is implemented.

Images