Information processing method, device, equipment and storage medium

Abstract

The present application discloses an information processing method, device, equipment and storage medium. The method includes obtaining a user access request, determining whether there is an identification model corresponding to the user access request; if it is determined that there is an identification model corresponding to the user access request, identifying and marking whether the user access request is an access request of a forged user through a historical user verification module; if it is determined that there is no identification model corresponding to the user access request, identifying and marking whether the user access request is an access request of a forged user through an initial user verification module. This solves the problem in the related art that illegal crawlers cause system anomalies of website servers and affect normal user access.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an information processing method, apparatus, device and storage medium. Background Art

[0002] With the rapid development of the Internet, the value of data has become increasingly important. As a result, web crawler technology was born. A large number of illegal crawlers will cause tremendous pressure on website servers, causing system anomalies of website servers and affecting normal user access. Summary of the invention

[0003] The embodiments of the present application provide an information processing method, apparatus, device, and storage medium, which can improve system stability while ensuring access by normal users.

[0004] According to a first aspect of an embodiment of the present application, there is provided an information processing method, including:

[0005] Obtaining a user access request and determining whether there is an identification model corresponding to the user access request;

[0006] In the case where it is determined that there is an identification model corresponding to the user access request, identifying and marking whether the user access request is an access request of a forged user through a historical user verification module;

[0007] In the case that it is determined that there is no identification model corresponding to the user access request, the initial user verification module identifies and marks whether the user access request is an access request of a forged user.

[0008] According to a second aspect of an embodiment of the present application, there is provided an information processing device, including:

[0009] A determination module, used to obtain a user access request and determine whether there is a recognition model corresponding to the user access request;

[0010] A first identification module, configured to identify and mark whether the user access request is an access request of a forged user through a historical user verification module when it is determined that there is an identification model corresponding to the user access request;

[0011] The second identification module is used to identify and mark whether the user access request is an access request of a forged user through the initial user verification module when it is determined that there is no identification model corresponding to the user access request.

[0012] According to a third aspect of an embodiment of the present application, there is provided a computer device, including: a memory and a processor;

[0013] A memory for storing a computer program;

[0014] The processor is used to execute the computer program stored in the memory, and when the computer program is run, the processor executes the steps of the information processing method shown in the first aspect.

[0015] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a computer device, the computer device executes the steps of the information processing method shown in the first aspect.

[0016] According to a fifth aspect of an embodiment of the present application, a computer program product is provided, comprising a computer program, which, when executed by a computer device, enables the computer device to perform the steps of the information processing method shown in the first aspect.

[0017] According to the sixth aspect of the embodiment of the present application, a chip is provided, the chip including a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the steps of the information processing method of the first aspect.

[0018] According to the information processing method, device, equipment and storage medium in the embodiment of the present application, compared with the current website server only including one access request processing link, the embodiment of the present application adopts two access request processing links, namely the initial user verification module and the historical user verification module, to identify and mark whether the user access request is an access request of a forged user. While ensuring that the website server can effectively identify whether the user access request is malicious traffic, the identification of the new user access request by the initial user verification module solves the problem of abnormal server (or information processing system in the server) caused by abnormality when the new user is malicious traffic. Thus, global abnormalities caused by abnormal access requests of new users are prevented, access of normal users is maintained, the stability of the entire system is guaranteed, and the independence and stability between users are guaranteed, so as to improve the stability of the access request processing link in the website server in identifying malicious traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present application may be better understood from the following description of specific embodiments of the present application in conjunction with the accompanying drawings, wherein the same or similar figure numbers represent the same or similar features.

[0020] Figure 1 is a schematic diagram showing an information processing architecture according to an embodiment;

[0021] Figure 2 is a schematic diagram showing another information processing architecture according to an embodiment;

[0022] Figure 3 is a schematic diagram showing another information processing architecture according to an embodiment;

[0023] Figure 4 is a flow chart showing an information processing method according to one embodiment;

[0024] Figure 5 is a flowchart illustrating determining whether there is a recognition model corresponding to a user access request in an information processing method according to an embodiment;

[0025] Figure 6 is one of the flow charts illustrating identifying and marking user access requests in an information processing method according to one embodiment;

[0026] Figure 7 is a flow chart showing determination of a first target recognition model in an information processing method according to an embodiment;

[0027] Figure 8 is a schematic diagram showing the structure of an initial user authentication module according to an embodiment;

[0028] Fig. 9 is a schematic diagram showing the structure of an initial user monitoring module according to an embodiment;

[0029] Fig.10 is a second flowchart illustrating identifying and marking user access requests in an information processing method according to an embodiment;

[0030] Fig.11 is a flow chart showing determination of a second target recognition model in an information processing method according to an embodiment;

[0031] Fig.12 is a schematic diagram showing the structure of a historical user verification module according to an embodiment;

[0032] Fig.13 is a schematic diagram showing the structure of a historical user monitoring module according to one embodiment;

[0033] Fig.14 is a flow chart illustrating identifying and marking a user access request by a backup user verification module in an information processing method according to an embodiment;

[0034] Fig.15 is a third flowchart illustrating identifying and marking user access requests in an information processing method according to an embodiment;

[0035] Fig.16 is a flow chart showing determination of a third target recognition model in an information processing method according to an embodiment;

[0036] Fig.17is a schematic diagram showing the structure of a standby user authentication module according to an embodiment;

[0037] Fig.18 is a schematic diagram showing the structure of an information processing device according to an embodiment;

[0038] Fig.19 FIG. 4 is a schematic diagram showing the hardware structure of a computer device according to an embodiment. DETAILED DESCRIPTION

[0039] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the specific embodiments described herein are only configured to explain the present application and are not configured to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0040] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0041] Web crawler technology is a method used by hackers to obtain valuable data from website servers in batches by calling free interfaces opened by websites. However, a large number of illegal crawlers will not only put huge pressure on website servers and affect normal user access, but will also lead to the theft of data from website servers, causing negative impacts on websites.

[0042] In the related art, malicious traffic can be identified through browser fingerprints, and crawlers can also be detected by detecting thresholds to increase access restrictions on the Internet Protocol (IP). However, the malicious traffic involved in the former identification method is easy to be tampered with, the labor cost is high, and the malicious traffic cannot be automatically identified. The latter detection method has a high false alarm rate and cannot automatically identify malicious traffic. In addition, the current website server only includes one access request processing link. When there is large-scale attack traffic or a large amount of malicious traffic, it will cause system abnormalities on the website server and affect the access of normal users. Here, malicious traffic refers to malicious crawlers, automatons, simulators, etc., which forge access requests initiated by real users. Malicious traffic can achieve the purpose of profit by attacking websites, applications or application programming interfaces (Application Programming Interface, API) at the application layer.

[0043] Therefore, how to improve the system stability in the website server while distinguishing normal user traffic from malicious machine traffic to ensure normal user access has become an issue that needs to be solved urgently.

[0044] Based on this, the embodiment of the present application provides an information processing method, by defining the intention behavior of malicious traffic and normal user access requests, characterizing access requests from multiple dimensions, upgrading the website application protection system in the website server, adding a system abnormality monitoring module, and upgrading the architecture link of the website application protection system, that is, relative to the situation where there is only one production link in the traditional solution, the embodiment of the present application provides at least two production links, that is, an initial user verification module and a historical user verification module are set in the system abnormality verification module, or an initial user verification module, a historical user verification module and a standby user verification module, each module provides a production link, so that new user access requests can be processed through the grayscale link in the initial user verification module, while ensuring that the website server can effectively identify whether the user access request is malicious traffic, through the identification of the new user access request by the initial user verification module, solve the global abnormality caused by the abnormality of the new user access request. And, when an abnormality occurs in the production link, the historical user verification module is switched to the standby user verification module through risk triggering, and the user access request is processed through the standby link in the standby user verification module to solve the global abnormality problem caused by the abnormality of the historical user access request.

[0045] Therefore, while identifying malicious traffic, the user verification module can be automatically switched when a system anomaly occurs or the preset conditions are met to ensure that the link in each user verification module processes the user access request, thereby maintaining the stability of the entire website application protection system and ensuring the independence and stability of each user.

[0046] The following is combined with Figure 1 To Attachment Figure 3 The information processing architecture provided by the embodiment of the present application is shown, and the information processing method provided by the embodiment of the present application is described in detail.

[0047] like Figure 1 As shown, the information processing architecture proposed in the embodiment of the present application may include a server 10. The server 10 includes providing global resources for a cloud platform (such as a public cloud, a private cloud, and a proprietary cloud), and the global resources include a website application protection system (Web Application Firewall, WAF). WAF performs feature recognition and protection on the access flow of a website or application, and returns normal and secure traffic to the server to ensure the security of data in the website server and prevent server performance abnormalities caused by attacks on the server by malicious traffic.

[0048] In one or more possible embodiments, Figure 1 As shown, WAF may include a domain name matching module 110 and a system anomaly verification module 120. Further, the system anomaly verification module 120 includes an initial user verification module 1201 and a historical user verification module 1202. The initial user verification module 1201 includes a grayscale link, which is a link that provides grayscale verification services, that is, a link where a new user initially accesses and performs malicious traffic verification on the access request of the new user; the historical user verification module 1202 includes a production link, which is a link that formally provides services online, and is the main link for performing malicious traffic verification on the access request of historical users.

[0049] Therefore, based on the above information processing architecture, combined with Figure 1 The information processing method provided in the embodiment of the present application is described in detail.

[0050] First, WAF obtains the user access request.

[0051] Next, the WAF transmits the user access request to the domain name matching module 110. The domain name matching module 110 determines whether there is an identification model corresponding to the user access request (the requested domain name), and transmits the determination result to the system abnormality verification module 120, wherein the identification model is used to identify whether the user access request is an access request of a forged user. When the user access request is identified as an access request of a forged user, the user access request is marked.

[0052] Next, the system abnormality verification module 120 receives the determination result output by the domain name matching module 110, and when the determination result is that there is no identification model corresponding to the user access request, the system abnormality verification module 120 identifies and marks whether the user access request is an access request of a forged user through the initial user verification module 1201. Alternatively, when the determination result is that there is an identification model corresponding to the user access request, the historical user verification module 1202 identifies and marks whether the user access request is an access request of a forged user.

[0053] Therefore, the embodiment of the present application adopts two access request processing links of the initial user verification module and the historical user verification module to identify and mark whether the user access request is an access request of a forged user. While ensuring that the website server can effectively identify whether the user access request is malicious traffic, the initial user verification module identifies the access request of the new user, prevents global anomalies caused by abnormal access requests of new users, and improves the stability of the access request processing link in the website server in identifying malicious traffic, thereby ensuring the stability of the entire system and guaranteeing the independence and stability of each user, improving the automation and confrontation of the entire server (or the information processing system in the server), and ensuring access by normal users.

[0054] It should be noted that, in one example, when the system abnormality verification module 120 detects that the user access request identified and marked by the initial user verification module meets the preset conditions, it can switch from the initial user verification module 1201 to the historical user verification module 1202, and identify and mark whether the user access request is an access request of a forged user through the historical user verification module 1202. In this way, the new user access request can be migrated to the historical user verification module after running for a certain period of time through the initial user verification module, so as to solve the global abnormality problem caused by the abnormal access request of the new user, and improve the stability of the access request processing link in the website server to identify malicious traffic.

[0055] In another or more possible embodiments, Figure 1 As shown, the system abnormality verification module 120 may also include a backup user verification module 1203. The backup user verification module 1203 includes a backup link, which is an online disaster recovery link. When a production link fails, the backup link is enabled to identify malicious traffic through the backup link. It should be noted that each link in the embodiment of the present application (i.e., the gray link, the production link, and the disaster recovery link) has the function of identifying malicious traffic in massive user access requests.

[0056] Based on this, when the system abnormality verification module 120 detects that the historical user verification module 1202 has a fault, it switches from the historical user verification module 1202 to the backup user verification module 1203, and through the backup user verification module 1203, identifies whether the user access request is an access request from a fake user, and marks the access request from the fake user.

[0057] Therefore, compared with the traditional solution that has only one production link, the embodiment of the present application provides at least two production links. While ensuring that the website server can effectively identify whether the user access request is malicious traffic, the initial user verification module identifies the new user access request, prevents the global anomaly caused by the new user access request exception, and improves the access request processing link in the website server. In addition, when an exception occurs in the historical user verification module, the historical user verification module is automatically switched to the backup user verification module through risk triggering, and the user access request is processed by the backup user verification module to solve the global anomaly problem caused by the historical user access request exception, thereby improving the automation and stability of the entire WAF and effectively identifying malicious traffic stably.

[0058] In another or more possible embodiments, Figure 2 As shown, based on Figure 1 The WAF may also include a system anomaly monitoring module 130 and an alarm processing module 140 .

[0059] Further, the system anomaly monitoring module 130 includes an initial user monitoring module 1301 corresponding to the initial user verification module 1201 and a historical user monitoring module 1302 corresponding to the historical user verification module 1202. The system anomaly monitoring module 130 is used to perform adversarial detection on the recognition model (such as the first target recognition model, the second target recognition model, the third target recognition model, etc.) in the system anomaly verification module 120 to effectively adapt to the transformation of malicious traffic and improve the stability and accuracy of the system anomaly verification module 120 in identifying malicious traffic.

[0060] Based on this, when the log data of the user access request includes the behavior data of the user access, and the behavior data includes at least one of the following: access sequence, access time, and interval time of the access sequence, and the system abnormality verification module 120 outputs the marked abnormal behavior data, the system abnormality monitoring module 130 determines the confrontation index of the recognition model in the system abnormality verification module 120 according to the marked abnormal behavior data, wherein the confrontation index is used to measure the probability value of the failure of the recognition model. When the confrontation index is less than or equal to the preset confrontation index, the recognition model is updated based on the log data.

[0061] Further, the initial user monitoring module 1301 can determine the confrontation index of the recognition model trained by the initial user verification module according to the marked abnormal behavior data output by the initial user verification module 1201. In this way, when the confrontation index is less than or equal to the preset confrontation index, the first target recognition model is updated by the initial user verification module 1201 based on the log data. Of course, the historical user monitoring module 1302 can also determine the confrontation index of the recognition model trained by the historical user verification module 1202 according to the marked abnormal behavior data output by the historical user verification module 1202. In this way, when the confrontation index is less than or equal to the preset confrontation index, the second target recognition model is updated by the historical user verification module 1202 based on the log data.

[0062] The alarm processing module 140 is used to monitor whether there is an abnormality in the user or WAF through the results produced by the system abnormality verification module 120 and the online protection traffic of the system abnormality monitoring module 130, and to issue an alarm for the abnormality if an abnormality occurs.

[0063] Therefore, the recognition model in the system anomaly verification module 120 can be updated through the system anomaly monitoring module 130 to improve the stability and accuracy of the system anomaly verification module 120 in identifying malicious traffic.

[0064] In addition, in one or more possible embodiments, Figure 3 As shown, based on Figure 4 , WAF may also include a system stability monitoring module 150 and a model storage module 160 .

[0065] The system stability monitoring module 150 is used to monitor the stability of the WAF by monitoring the output result of at least one recognition model in the WAF.

[0066] The model storage module 160 is used to provide data storage services and cloud storage services, wherein the data storage service can provide structured statement data storage services, specifically OTS table storage, which stores log data in the form of structured statements. The cloud storage service can be an object storage service of the operation support system (OSS), which can store at least one model in the WAF, such as OSS1 for storing the recognition model in the system anomaly verification module 120, and OSS2 for storing the updated recognition model in the anomaly monitoring module 130.

[0067] According to the above architecture and application scenarios, the following Figure 4 The information processing method provided in the embodiments of the present application is described in detail.

[0068] Figure 4is a flow chart showing an information processing method according to one embodiment.

[0069] like Figure 4 As shown, the information processing method can be applied to the website application protection system, and the information processing method can specifically include:

[0070] Step 410, obtaining a user access request and determining whether there is an identification model corresponding to the user access request. Step 420, if it is determined that there is an identification model corresponding to the user access request, identifying and marking whether the user access request is an access request of a forged user through a historical user verification module; and if it is determined that there is no identification model corresponding to the user access request, identifying and marking whether the user access request is an access request of a forged user through an initial user verification module.

[0071] The above steps are described in detail below, as shown below.

[0072] In one example, step 410 is performed in conjunction with Figure 3 The architecture shown can obtain the user access request of WAF in OTS. In one example, refer to Figures 1 to 3 The architecture shown can determine whether there is a recognition model corresponding to the user access request through the domain name matching module 110, and the recognition model is used to identify and mark whether the user access request is an access request of a forged user.

[0073] Furthermore, if Figure 5 As shown, step 410 may specifically include step 4101 and step 4102.

[0074] Step 4101: Generate log data of the user access request according to the user access request, and the log data includes target request characteristics.

[0075] Specifically, the target request feature in the embodiment of the present application may include at least one of the following: a request domain name in the log data, a user device IMEI, a user ID, and a device access fingerprint.

[0076] Step 4102: Determine whether there is a recognition model corresponding to the user access request based on the target request characteristics.

[0077] In one example, you can combine Figure 3 The architecture shown is used for explanation, such as the domain name matching module 110 obtains the preset association information of the request feature and the model stored in OSS1, such as the preset association relationship between the domain name and the model, and matches the recognition model corresponding to the request domain name according to the preset association information of the request feature and the model.

[0078] Thus, step 4102 may specifically include:

[0079] According to the preset association relationship between the request feature and the model, the recognition model corresponding to the target request feature is matched;

[0080] In the case where a recognition model corresponding to the target request feature is matched, determining that there is a recognition model corresponding to the user access request;

[0081] When no recognition model corresponding to the target request feature is matched, it is determined that there is no recognition model corresponding to the user access request.

[0082] It should be noted that there are two possible determination results outputted from the domain name matching module 110. One is that the domain name matching module 110 matches the recognition model corresponding to the target request feature, that is, the determination result is that the domain name matching module 110 determines that there is a recognition model corresponding to the user access request, indicating that the user corresponding to the user access request is a historical user. The other is that the domain name matching module 110 does not match the recognition model corresponding to the target request feature, that is, the determination result is that the domain name matching module 110 determines that there is no recognition model corresponding to the user access request, indicating that the user corresponding to the user access request is a new user.

[0083] In step 420, the situations where the user corresponding to the user access request is a new user or the user corresponding to the user access request is a historical user are described respectively.

[0084] First, the process of processing a user access request from a new user is described.

[0085] In one or more possible embodiments, the target request feature is a request domain name as an example for description, such as Figure 6 As shown, step 420 may specifically include steps 4201 to 4203.

[0086] Step 4201: Based on the log data, a first target recognition model corresponding to the requested domain name is trained through an initial user verification module.

[0087] Step 4202: Identify whether the user access request is an access request from a forged user through the first target recognition model.

[0088] Step 4203: When it is identified that the user access request is an access request of a forged user, the user access request is marked as an access request of a forged user by a first preset identifier.

[0089] The above steps are described below respectively.

[0090] Involving step 4201, in one example, Figure 7As shown, step 4201 may specifically include steps 42011 to 42013.

[0091] Step 42011, divide the log data according to the first preset sliding time window, and obtain the first target log data of each first preset sliding time window in multiple first preset sliding time windows.

[0092] For example, Figure 8 As shown, reference Figures 1 to 3 In the architecture shown, the first preset sliding time window is a sliding window of 15 minutes (min), that is, the log data in the form of data stream is divided according to the sliding window of 15 minutes (min) to obtain multiple 15-minute log data, wherein the value range of the first preset sliding time window includes a size (size) set to 30 minutes and a boundary (side) set to 1 minute.

[0093] Step 42012: According to the first preset training condition, the first initial recognition model is trained according to the first target log data of each first preset sliding time window to obtain the first recognition model of each first preset sliding time window.

[0094] For example, still referring to Figure 8 According to each 15 minutes of log data, a first initial recognition model corresponding to each 15 minutes of log data is trained to obtain a first recognition model for each 15 minutes. In this way, multiple, for example, N, 15 minutes of first recognition models are obtained, such as model 1, model 2, model 3...model N, where N is an integer greater than or equal to 1.

[0095] Step 42013, screening out a first target recognition model that satisfies a first preset evaluation condition from a plurality of first recognition models.

[0096] For example, still referring to Figure 8 According to the preset evaluation conditions and the preset single model availability evaluation conditions, the N first recognition models are evaluated to obtain a first target recognition model such as Mx that meets the preset evaluation conditions and the preset single model availability evaluation conditions, where X is any integer from 1 to N.

[0097] Then, the initial user verification module 1201 may store Mx in the model storage module 160 , where Mx is used to identify whether the user access request corresponding to the new user is an access request of a forged user, and mark the access request of the forged user when the recognition model identifies that the user access request is an access request of a forged user.

[0098] In step 4202, the log data of the embodiment of the present application may include the behavior data of the user's access, and the behavior data includes at least one of the following: access sequence, access time, and interval time of the access sequence. Based on this, according to different types of behavior data, the embodiment of the present application provides at least three ways to identify whether the user access request is a forged user's access request, which are described below.

[0099] 1) In one example, the behavior data is an access sequence, and the preset behavior data is a cyclic and fixed sequence of accessing a server (platform, web page, website).

[0100] Specifically, through the first target recognition model, it is identified whether the sequence of users accessing the server in the log data is a cyclic and fixed sequence of accessing the server (platform, webpage, website).

[0101] When the sequence of user access to the server in the identification log data is a cyclic and fixed sequence for accessing the server, the user access request is determined to be an access request of a forged user. Conversely, when the sequence of user access to the server in the identification log data is not a cyclic and fixed sequence for accessing the server, the user access request is determined to be an access request of a normal user.

[0102] For example, in general, when a normal user actually browses information, he or she will switch multiple servers (platforms, web pages, websites), such as accessing server A → accessing platform B → accessing web page C of platform B in sequence. When it is detected that a certain user cyclically and fixedly accesses a server (platform, web page, website), that is, cyclically sends a user access request to a fixed server (platform, web page, website), it can be determined that the user is a fake user, and the access request sent by the fake user is an access request of the fake user.

[0103] 2) In another example, the behavior data is access time, and the preset behavior data is behavior data of accessing a server (platform, web page, website) at a fixed time (time period).

[0104] Through the first target recognition model, identify whether the access time of the user to the server in the log data is a fixed time (time period), and the behavior data of accessing the server (platform, web page, website) at the fixed time (time period).

[0105] When the access time (time period) is a fixed time (belonging to a fixed time period) and the behavioral data of accessing the server (platform, web page, website) at the fixed time (time period) is included, the user access request is determined to be an access request of a fake user; otherwise, when the access time (time period) is not a fixed time (time period), the user access request is determined to be an access request of a normal user.

[0106] For example, generally speaking, the time when a normal user accesses the server every day should be random or irregular. Therefore, if a user only accesses the fixed B platform between 2 and 3 in the morning, it can be determined that the user is a fake user, and the access request sent by the fake user is an access request of the fake user.

[0107] 3) In another example, the behavior data is the (time) interval of the access sequence, and the preset behavior data is the same as the (time) interval of the access sequence or conforms to a preset rule.

[0108] Using the first target recognition model, identifying whether the intervals of the access sequence of users accessing the server in the log data are the same or conform to a preset rule;

[0109] When the intervals of the access sequences are the same or conform to a preset rule, the user access request is determined to be an access request of a forged user. Conversely, when the intervals of the access sequences are not the same or conform to a preset rule, the user access request is determined to be an access request of a normal user.

[0110] Exemplarily, if the access sequence of the user's access to the server in the log data is accessing server A → accessing platform B → accessing web page C of platform B, and the time interval from accessing server A → accessing platform B is the same as the time interval from accessing platform B → accessing web page C of platform B, then it can be determined that the user is a fake user, and the access request sent by the fake user is an access request of the fake user.

[0111] In addition, if the access sequence of the user accessing the server in the log data is accessing server A → accessing platform B → accessing webpage C of platform B, and the time interval from accessing server A → accessing platform B is multiple of the time interval from accessing platform B → accessing webpage C of platform B, then it can also be proved that the user is a machine or a fake user. The reason is that when a normal user browses information, the platform to be accessed or the time interval between switching the platforms to be accessed is mostly different and there is no pattern to be found. If the intervals between switching the platforms to be accessed are the same or conform to the preset pattern, then it can be proved that the user is a machine or a fake user, and the access request sent by the user is an access request of a fake user.

[0112] It should be noted that the at least three methods of identifying whether a user access request is an access request of a forged user mentioned above can be used in combination or independently, and will not be described in detail here.

[0113] Therefore, the embodiments of the present application define the intended behaviors of malicious traffic and normal user access requests, characterize access requests from multiple dimensions through the above-mentioned multiple methods, use user access behavior data as the basis for identifying malicious traffic, and reduce the false alarm rate.

[0114] Based on this, Figure 2 and Figure 3 Taking the initial user monitoring module 1301 shown in as an example, the automatic confrontation flow of the first target recognition model obtained above is started to be described. Therefore, the information processing method provided by the embodiment of the present application may also include:

[0115] In the case where the behavior data includes labeled abnormal behavior data, determining the adversarial index of the first target recognition model trained by the initial user verification module according to the labeled abnormal behavior data, where the adversarial index is used to measure the probability value of failure of the first target recognition model;

[0116] When the confrontation index is less than or equal to the preset confrontation index, the first target recognition model is updated through the initial user verification module based on the log data.

[0117] For example, Fig. 9 As shown, the protection effect of the first target recognition model in the initial user verification module 1201 is monitored, that is, whether the first target recognition model in the initial user verification module 1201 can effectively identify malicious traffic in the user request information corresponding to the request domain name is detected.

[0118] Based on this, when the behavior data includes the marked abnormal behavior data, the system initial user monitoring module 1301 is triggered to perform confrontation monitoring to detect whether the abnormal behavior data currently corresponding to the request domain name is in confrontation with the previous abnormal behavior data. If no confrontation occurs, the detection continues. On the contrary, if confrontation occurs, the confrontation index of the first target recognition model trained by the initial user verification module is determined based on the marked abnormal behavior data.

[0119] Based on this, if the confrontation index is greater than the preset confrontation index, it means that no confrontation has occurred, and it is possible to return to execute the detection of whether the abnormal behavior data currently corresponding to the requested domain name is in confrontation with the previous abnormal behavior data. If the confrontation index is less than or equal to the preset confrontation index, it means that confrontation has occurred, that is, according to the log information corresponding to the current abnormal behavior data, the recognition model is retrained to update the original first target recognition model to the retrained recognition model, and the updated recognition model is stored in the model storage module 160.

[0120] Here, the confrontation in the embodiment of the present application can be understood as, if the marked abnormal behavior data is a cyclic and fixed access to server A → access to platform B, and the abnormal behavior data corresponding to the requested domain name changes, that is, from a cyclic and fixed access to server A → access to platform B to a cyclic and fixed access to server A → access to platform C, then it can be characterized that the current abnormal behavior data corresponding to the requested domain name is in confrontation with the previous abnormal behavior data.

[0121] Based on this, when the access from cyclic and fixed access to server A → access to platform B is transformed into cyclic and fixed access to server A → access to platform C, and when the access from cyclic and fixed access to server A → access to platform C is transformed into cyclic and fixed access to platform C → access to server A, the original first target recognition model can no longer detect its abnormal behavior data. At this time, the retraining of the recognition model can be triggered to update the original first target recognition model to the retrained recognition model.

[0122] In this way, it can effectively adapt to the changes in malicious traffic, improve the stability and accuracy of the system anomaly verification module in identifying malicious traffic, and thus enhance the automation and confrontation of the entire server (or the information processing system in the server).

[0123] Then, the process of processing the user access request of the historical user is described.

[0124] In one or more other possible embodiments, the target request feature is a request domain name as an example for description. Fig.10 As shown, step 420 may specifically include steps 4204 to 4206.

[0125] Step 4204: Based on the log data, a second target recognition model corresponding to the requested domain name is trained through a historical user verification module.

[0126] Step 4205: Identify, based on the second target recognition model, whether the user access request is an access request from a forged user.

[0127] Step 4206: When it is identified that the user access request is an access request of a forged user, the user access request is marked as an access request of a forged user by a second preset identifier.

[0128] The above steps are described below respectively.

[0129] In one example, if Fig.11 As shown, step 4204 may specifically include steps 42041 to 42043.

[0130] Step 42041, divide the log data according to the second preset sliding time window to obtain the second target log data of each second preset sliding time window in multiple second preset sliding time windows.

[0131] For example, Fig.12 As shown, reference Figures 1 to 3In the architecture shown, the second preset sliding time window is a sliding window of 15 minutes (min), that is, the log data in the form of data stream is divided according to the sliding window of 15 minutes (min) to obtain multiple 15-minute log data, wherein the value range of the second preset sliding time window includes the size (size) being set to 30 minutes and the boundary (side) being set to 1 minute.

[0132] Step 42042: According to the second preset training condition, the second initial recognition model is trained according to the second target log data of each second preset sliding time window to obtain the second recognition model of each second preset sliding time window.

[0133] For example, refer to Fig.12 According to each 15 minutes of log data, a second initial recognition model corresponding to each 15 minutes of log data is trained to obtain a second recognition model for each 15 minutes. In this way, multiple, such as N, 15 minutes of second recognition models such as model 1, model 2, model 3...model N, where N is an integer greater than or equal to 1.

[0134] Step 42043, screening out a second target recognition model that meets a second preset evaluation condition from a plurality of second recognition models.

[0135] Further, refer to Fig.12 , according to the preset evaluation conditions and the preset single model availability evaluation conditions, the N second recognition models are evaluated for their effectiveness, and a second target recognition model such as My that meets the preset evaluation conditions and the preset single model availability evaluation conditions is obtained, where y is any integer from 1 to N.

[0136] Then, the historical user verification module 1202 can store My in the model storage module 160, and the second target recognition model is used to identify whether the user access request corresponding to the historical user is an access request of a forged user, and when the second target recognition model identifies that the user access request is an access request of a forged user, it marks the access request of the forged user.

[0137] In step 4205, the log data of the embodiment of the present application may include the behavior data of the user's access, and the behavior data includes at least one of the following: access sequence, access time, and interval time of the access sequence. Based on this, according to different types of behavior data, the embodiment of the present application provides at least three ways to identify whether the user access request is a forged user's access request, which are described below.

[0138] 1) In one example, the behavior data is an access sequence, and the preset behavior data is a cyclic and fixed sequence of accessing a server (platform, web page, website).

[0139] Specifically, through the second target recognition model, it is identified whether the access sequence of users accessing the server in the log data is a cyclic and fixed sequence of accessing the server (platform, web page, website).

[0140] When the sequence of user access to the server in the identification log data is a cyclic and fixed sequence for accessing the server, the user access request is determined to be an access request of a forged user. Conversely, when the sequence of user access to the server in the identification log data is not a cyclic and fixed sequence for accessing the server, the user access request is determined to be an access request of a normal user.

[0141] For example, in general, when a normal user actually browses information, he or she will switch multiple servers (platforms, web pages, websites), such as accessing server A → accessing platform B → accessing web page C of platform B in sequence. When it is detected that a certain user cyclically and fixedly accesses a server (platform, web page, website), that is, cyclically sends a user access request to a fixed server (platform, web page, website), it can be determined that the user is a fake user, and the access request sent by the fake user is an access request of the fake user.

[0142] 2) In another example, the behavior data is access time, and the preset behavior data is behavior data of accessing a server (platform, web page, website) at a fixed time (time period).

[0143] Through the second target recognition model, identify whether the access time of the user to the server in the log data is a fixed time (time period), and the behavior data of accessing the server (platform, web page, website) at the fixed time (time period).

[0144] When the access time (time period) is a fixed time (belonging to a fixed time period) and the behavioral data of accessing the server (platform, web page, website) at the fixed time (time period) is included, the user access request is determined to be an access request of a fake user; otherwise, when the access time (time period) is not a fixed time (time period), the user access request is determined to be an access request of a normal user.

[0145] For example, generally speaking, the time when a normal user accesses the server every day should be random or irregular. Therefore, if a user only accesses the fixed B platform between 2 and 3 in the morning, it can be determined that the user is a fake user, and the access request sent by the fake user is an access request of the fake user.

[0146] 3) In another example, the behavior data is the (time) interval of the access sequence, and the preset behavior data is the same as the (time) interval of the access sequence or conforms to a preset rule.

[0147] Using the second target recognition model, identifying whether the intervals of the access sequence of users accessing the server in the log data are the same or conform to a preset rule;

[0148] When the intervals of the access sequences are the same or conform to a preset rule, the user access request is determined to be an access request of a forged user. Conversely, when the intervals of the access sequences are not the same or conform to a preset rule, the user access request is determined to be an access request of a normal user.

[0149] Exemplarily, if the access sequence of the user's access to the server in the log data is accessing server A → accessing platform B → accessing web page C of platform B, and the time interval from accessing server A → accessing platform B is the same as the time interval from accessing platform B → accessing web page C of platform B, then it can be determined that the user is a fake user, and the access request sent by the fake user is an access request of the fake user.

[0150] In addition, if the access sequence of the user accessing the server in the log data is accessing server A → accessing platform B → accessing webpage C of platform B, and the time interval from accessing server A → accessing platform B is multiple of the time interval from accessing platform B → accessing webpage C of platform B, then it can also be proved that the user is a machine or a fake user. The reason is that when a normal user browses information, the platform to be accessed or the time interval between switching the platforms to be accessed is mostly different and there is no pattern to be found. If the intervals between switching the platforms to be accessed are the same or conform to the preset pattern, then it can be proved that the user is a machine or a fake user, and the access request sent by the user is an access request of a fake user.

[0151] It should be noted that the at least three methods of identifying whether a user access request is a forged user access request mentioned above can be used in combination or independently, and will not be described in detail here.

[0152] Therefore, the embodiments of the present application define the intended behaviors of malicious traffic and normal user access requests, characterize access requests from multiple dimensions through the above-mentioned multiple methods, use user access behavior data as the basis for identifying malicious traffic, and reduce the false alarm rate.

[0153] Based on this, Figure 2 and Figure 3 Taking the historical user verification module 1202 shown in as an example, the traffic with automatic confrontation enabled is described. In this way, the information processing method provided by the embodiment of the present application may also include:

[0154] In the case where the behavior data includes labeled abnormal behavior data, determining the adversarial index of the second target recognition model trained by the historical user verification module according to the labeled abnormal behavior data, the adversarial index being used to measure the probability value of the failure of the second target recognition model;

[0155] When the confrontation index is less than or equal to the preset confrontation index, the second target recognition model is updated through the historical user monitoring module based on the log data.

[0156] For example, Fig.13 As shown, the historical user monitoring module 1302 monitors the protection effect of the second target recognition model in the historical user verification module 1202, that is, detects whether the second target recognition model can effectively identify malicious traffic in the user request information corresponding to the request domain name.

[0157] Based on this, when the behavior data includes the marked abnormal behavior data, the system historical user monitoring module 1302 is triggered to perform confrontation monitoring to detect whether the abnormal behavior data currently corresponding to the request domain name is in confrontation with the previous abnormal behavior data. If no confrontation occurs, the detection continues. On the contrary, if confrontation occurs, the confrontation index of the second target recognition model trained by the historical user verification module is determined based on the marked abnormal behavior data.

[0158] Based on this, if the confrontation index is greater than the preset confrontation index, it means that no confrontation has occurred, and it is possible to return to execute the detection of whether the abnormal behavior data currently corresponding to the request domain name is in confrontation with the previous abnormal behavior data. If the confrontation index is less than or equal to the preset confrontation index, it means that confrontation has occurred, that is, according to the log information corresponding to the current abnormal behavior data, the recognition model is retrained to update the original second target recognition model to the retrained recognition model, and the updated recognition model is stored in the model storage module 160.

[0159] Here, the confrontation in the embodiment of the present application can be understood as, if the marked abnormal behavior data is a cyclic and fixed access to server A → access to platform B, and the abnormal behavior data corresponding to the requested domain name changes, that is, from a cyclic and fixed access to server A → access to platform B to a cyclic and fixed access to server A → access to platform C, then it can be characterized that the current abnormal behavior data corresponding to the requested domain name is in confrontation with the previous abnormal behavior data.

[0160] Based on this, when the access from cyclic and fixed access to server A → access to platform B is transformed into cyclic and fixed access to server A → access to platform C, and when the access from cyclic and fixed access to server A → access to platform C is transformed into cyclic and fixed access to platform C → access to server A, the original second target recognition model can no longer detect its abnormal behavior data. At this time, the retraining of the recognition model can be triggered to update the original second target recognition model to the retrained recognition model.

[0161] It should be noted that the embodiment of the present application does not use browser fingerprint or browser identification to verify that the user access request is a forged user's access request, so as to perform online tagging confrontation, because these features can be easily tampered with. However, the embodiment of the present application abstracts and defines malicious traffic and normal user traffic intention behavior based on the behavioral data of user access in multiple dimensions, and characterizes the traffic features from multiple dimensions, so that the confrontation in the embodiment of the present application is enhanced, not easy to be tampered with, and the accuracy of training or updating the recognition model is higher, and the false alarm rate is lower.

[0162] The information processing method provided in the embodiment of the present application, in addition to sending the user access request to the above-mentioned two initial user verification modules and historical user verification modules respectively, the embodiment of the present application also provides switching between the initial user verification module and the historical user verification module, as shown below.

[0163] After the above step 420, the information processing method provided in the embodiment of the present application may further include:

[0164] When the user access request identified and marked by the initial user verification module meets the preset conditions, the initial user verification module is switched to the historical user verification module, and the historical user verification module is used to identify and mark whether the user access request is an access request of a forged user.

[0165] It should be noted that the preset conditions in the embodiments of the present application include that the first time duration for the initial user verification module to identify and mark the user access request is greater than or equal to a first preset time duration; or, the preset conditions include that the initial user verification module does not identify the access request of a fake user within a second preset time duration.

[0166] Based on the above different preset conditions, the switching process of the initial user verification module and the historical user verification module is described in detail respectively.

[0167] 1) The preset condition includes that the first duration of the user access request identified and marked by the initial user verification module is greater than or equal to the first preset duration.

[0168] Exemplarily, after the time for a new user's user access request to be processed in the initial user verification module exceeds 24 hours, the new user may be classified as a historical user so that subsequent user access requests of the user can be identified and marked through the historical user verification module.

[0169] 2) The preset condition includes that the initial user verification module does not identify an access request from a fake user within a second preset time period.

[0170] For example, if no malicious traffic is identified in the new user's user access request within a preset time period, such as 12 hours, the new user can be characterized as a stable normal user. In this way, the user's subsequent user access requests can be identified and marked through the historical user verification module.

[0171] 3) In combination with 1) and 2) above, the preset condition includes that the first time duration for the initial user verification module to identify and mark the user access request is greater than or equal to the first preset time duration, and no access request from a fake user is identified within the second preset time duration. Here, the first preset time duration and the second preset time duration may be the same or different, and the embodiment of the present application is explained by taking the two being the same as an example.

[0172] Exemplarily, if the time it takes for a new user's user access request to be processed in the initial user verification module is greater than 24 hours, and within 24 hours, no access requests from forged users are identified in the new user's user access requests, the new user can be classified as a historical user, and the historical user verification module can be used to identify and mark whether subsequent user access requests from the user are access requests from forged users.

[0173] In addition, the information processing method provided in the embodiment of the present application, in addition to the switching between the initial user verification module and the historical user verification module involved above, also provides switching between the historical user verification module and the standby user verification module. That is, in the embodiment of the present application, when an abnormality occurs in the historical user verification module 1202, the risk-triggered automatic switching module switches the user access request to the standby user verification module 1203, so that the subsequent user access request is processed by the standby user verification module 1203, thereby solving the global abnormality problem caused by the abnormal historical user traffic.

[0174] Based on this, take the example that the delay of writing data into the log in the user access request is greater than or equal to the preset delay when the standby user authentication module is abnormal. Fig.14 As shown, after the above step 420, the information processing method provided in the embodiment of the present application may further include steps 430 to 450.

[0175] Step 430: Obtain the delay of writing data in the user access request into the log.

[0176] Step 440: When the delay is greater than or equal to the preset delay, switch from the historical user authentication module to the standby user authentication module.

[0177] Step 450: Identify and mark whether the user access request is an access request from a forged user through the backup user verification module.

[0178] Further, the target request feature is the request domain name as an example for explanation, such as Fig.15As shown, step 450 may specifically include steps 4501 to 4503.

[0179] Step 4501: Based on the log data, a third target recognition model corresponding to the requested domain name is trained through the backup user verification module.

[0180] Step 4502: Identify whether the user access request is an access request from a forged user through a third target recognition model.

[0181] Step 4503: When it is identified that the user access request is an access request of a forged user, the user access request is marked as an access request of a forged user by a third preset identifier.

[0182] The above steps are described below respectively.

[0183] Involving step 4501, in one example, Fig.16 As shown, step 4501 may specifically include steps 45011 to 45013.

[0184] Step 45011, divide the log data according to the third preset sliding time window, and obtain the third target log data of each third preset sliding time window in multiple third preset sliding time windows.

[0185] For example, Fig.17 As shown, reference Figures 1 to 3 In the architecture shown, the third preset sliding time window is a sliding window of 15 minutes (min), that is, the log data in the form of data stream is divided according to the sliding window of 15 minutes (min) to obtain multiple 15-minute log data, wherein the value range of the third preset sliding time window includes a size (size) set to 30 minutes and a boundary (side) set to 1 minute.

[0186] Step 49012: According to the third preset training condition, the third initial recognition model is trained according to the third target log data of each third preset sliding time window to obtain the third recognition model of each third preset sliding time window.

[0187] For example, still referring to Fig.17 According to each 15 minutes of log data, a third initial recognition model corresponding to each 15 minutes of log data is trained to obtain a third recognition model for each 15 minutes. In this way, multiple, such as N, 15 minutes of third recognition models such as model 1, model 2, model 3...model N, where N is an integer greater than or equal to 1.

[0188] Step 49013, screening a third target recognition model that meets a third preset evaluation condition from multiple third recognition models.

[0189] Further, still refer to Fig.17 According to the preset evaluation conditions and the preset single model availability evaluation conditions, the N first recognition models are evaluated to obtain a third target recognition model such as Mz that meets the preset evaluation conditions and the preset single model availability evaluation conditions, where z is any integer from 1 to N.

[0190] Then, the standby user verification module 1203 may store Mz in the model storage module 160. Mz is used to identify and mark whether the user access request is an access request of a forged user through the standby user verification module when the historical user verification module fails.

[0191] It should be noted that, in some examples, the system abnormality monitoring module 130 may include, in addition to the initial user monitoring module 1301 corresponding to the initial user verification module 1201 and the historical user monitoring module 1302 corresponding to the historical user verification module 1202, a standby user monitoring module (not shown in the figure) corresponding to the standby user verification module 1203. Taking the standby user monitoring module as an example, the traffic for enabling automatic confrontation is described. In this way, the information processing method provided in the embodiment of the present application may also include:

[0192] In the case where the behavior data includes marked abnormal behavior data, determining the adversarial index of the third target recognition model trained by the backup user verification module according to the marked abnormal behavior data, the adversarial index being used to measure the probability value of failure of the third target recognition model;

[0193] When the confrontation index is less than or equal to the preset confrontation index, the third target recognition model is updated through the backup user monitoring module based on the log data.

[0194] Exemplarily, the standby user monitoring module monitors the protection effect of the third recognition model in the standby user verification module 1203, that is, detects whether the third recognition model in the standby user verification module 1203 can effectively identify malicious traffic in the user request information corresponding to the request domain name.

[0195] Based on this, when the behavior data includes the marked abnormal behavior data, the system backup user monitoring module is triggered to perform confrontation monitoring to detect whether the abnormal behavior data currently corresponding to the request domain name is in confrontation with the previous abnormal behavior data. If no confrontation occurs, the detection continues. On the contrary, if confrontation occurs, the confrontation index of the third target recognition model trained by the backup user verification module 1203 is determined based on the marked abnormal behavior data.

[0196] Based on this, if the confrontation index is greater than the preset confrontation index, it means that no confrontation has occurred, and it is possible to return to execute the detection of whether the abnormal behavior data currently corresponding to the requested domain name is in confrontation with the previous abnormal behavior data. If the confrontation index is less than or equal to the preset confrontation index, it means that confrontation has occurred, that is, the standby user monitoring module retrains the recognition model based on the log information corresponding to the current abnormal behavior data to update the original third target recognition model to the retrained recognition model, and stores the updated recognition model in the model storage module 160.

[0197] In addition, the information processing method provided in the embodiment of the present application may also include:

[0198] Based on the access request of the forged user carrying the mark, an access result corresponding to the user access request is fed back, and the access result includes: forged response data, information used to characterize that the user access request is an access request of the forged user, and information used to characterize that the user access request is intercepted.

[0199] In summary, the embodiment of the present application provides an information processing method, by defining the intention behavior of malicious traffic and normal user access requests, characterizing access requests from multiple dimensions, upgrading the website application protection system in the website server, adding a system abnormality monitoring module, and upgrading the architecture link of the website application protection system, that is, relative to the situation where there is only one production link in the traditional solution, the embodiment of the present application provides at least two production links, that is, an initial user verification module and a historical user verification module are set in the system abnormality verification module; or an initial user verification module, a historical user verification module and a standby user verification module, each module includes a production link, so that a new user access request can be identified and marked by the grayscale link in the initial user verification module whether the user access request is an access request of a forged user, so as to prevent the global anomaly caused by the abnormal access request of the new user. In this way, when the user access request identified and marked by the initial user verification module meets the preset conditions, it is switched from the initial user verification module to the historical user verification module, so that the historical user access request can be identified and marked by the production link in the historical user verification module whether the user access request is an access request of a forged user, so as to solve the global anomaly problem caused by the abnormal access request of the new user. In addition, when an abnormality occurs in the production link, the risk trigger automatically switches from the historical user verification module to the backup user verification module, and the backup link in the backup user verification module identifies and marks whether the user access request is an access request of a fake user, so as to solve the global abnormality problem caused by the abnormality of the historical user access request.

[0200] Based on the above-mentioned information processing method, the present application provides an information processing device corresponding thereto. Fig.18 Provide detailed explanation.

[0201] Fig.18 is a schematic diagram showing the structure of an information processing device according to an embodiment.

[0202] like Fig.18 As shown, the information processing device 180 is applied to Figure 1 The server shown, the information processing device 180 may specifically include:

[0203] Determination module 1801, used to obtain a user access request and determine whether there is a recognition model corresponding to the user access request;

[0204] The first identification module 1802 is used to identify and mark whether the user access request is an access request of a forged user through the historical user verification module when it is determined that there is an identification model corresponding to the user access request;

[0205] The second identification module 1803 is used to identify and mark whether the user access request is an access request of a forged user through the initial user verification module when it is determined that there is no identification model corresponding to the user access request.

[0206] Therefore, compared with the current website server that only includes one access request processing link, the embodiment of the present application adopts two access request processing links, namely the initial user verification module and the historical user verification module, to identify and mark whether the user access request is an access request of a forged user. While ensuring that the website server can effectively identify whether the user access request is malicious traffic, the identification of the new user access request by the initial user verification module solves the problem of server (or information processing system in the server) abnormality caused by the abnormality when the new user is malicious traffic. Therefore, global abnormalities caused by abnormal access requests of new users are prevented, access by normal users is maintained, the stability of the entire system is guaranteed, and the independence and stability between users are guaranteed, thereby improving the stability of the access request processing link in the website server in identifying malicious traffic.

[0207] Based on this, the information processing device 180 provided in the embodiment of the present application is described in detail below:

[0208] In one or more possible embodiments, the determination module 1801 can be specifically used to generate log data of the user access request according to the user access request, the log data including target request features; and determine whether there is an identification model corresponding to the user access request according to the target request features.

[0209] Furthermore, the determination module 1801 in the embodiment of the present application may be specifically used to match the recognition model corresponding to the target request feature according to the preset association relationship between the request feature and the model;

[0210] In the case where a recognition model corresponding to the target request feature is matched, determining that there is a recognition model corresponding to the user access request;

[0211] When no recognition model corresponding to the target request feature is matched, it is determined that there is no recognition model corresponding to the user access request.

[0212] In another or more possible embodiments, the second identification module 1803 may be specifically configured to, when the target request feature includes a request domain name, train a first target identification model corresponding to the request domain name through an initial user verification module according to log data;

[0213] Identify, by means of a first target recognition model, whether the user access request is an access request of a forged user;

[0214] In the case where it is identified that the user access request is an access request of a forged user, the user access request is marked as an access request of a forged user by a first preset identifier.

[0215] In one or more possible embodiments, the information processing device 180 provided in the embodiment of the present application may further include: a first division module, a first training module and a first screening module; wherein,

[0216] A first division module, used to divide the log data according to a first preset sliding time window, to obtain first target log data of each first preset sliding time window in a plurality of first preset sliding time windows;

[0217] A first training module, configured to train a first initial recognition model according to first target log data of each first preset sliding time window according to a first preset training condition, so as to obtain a first recognition model of each first preset sliding time window;

[0218] The first screening module is used to screen a first target recognition model that meets a first preset evaluation condition from multiple first recognition models.

[0219] In one or more possible embodiments, the second identification module 1803 may be specifically used to, when the log data includes the behavior data of user access, and the behavior data includes at least one of the following: access sequence, access time, and interval time of the access sequence, determine whether at least one of the following behavior data: access sequence, access time, and interval time of the access sequence meets the preset behavior data through the first target recognition model;

[0220] When at least one of the following behavior data: access sequence, access time, and interval time of the access sequence meets preset behavior data, it is determined that the user access request is an access request of a forged user.

[0221] In one or more possible embodiments, the information processing device 180 provided in the embodiment of the present application may further include: a calculation module and a first update module; wherein,

[0222] A calculation module, for determining, when the behavior data includes labeled abnormal behavior data, a confrontation index of the first target recognition model trained by the initial user verification module according to the labeled abnormal behavior data, wherein the confrontation index is used to measure a probability value of failure of the first target recognition model;

[0223] The first updating module is used to update the first target recognition model through the initial user verification module based on the log data when the confrontation index is less than or equal to the preset confrontation index.

[0224] In one or more possible embodiments, the information processing device 180 provided in the embodiments of the present application may also include: a first switching module, used to switch from the initial user verification module to the historical user verification module when the user access request identified and marked by the initial user verification module meets a preset condition, and identify and mark through the historical user verification module whether the user access request is an access request of a forged user.

[0225] In yet another one or more possible embodiments, the preset condition includes the first time duration of the initial user verification module identifying and marking the user access request as being greater than or equal to a first preset time duration;

[0226] Alternatively, the preset condition includes that the initial user verification module does not identify an access request from a fake user within a second preset time period.

[0227] In yet another one or more possible embodiments, the first identification module 1802 may be specifically configured to train a second target identification model corresponding to the request domain name through a historical user verification module according to the log data;

[0228] According to the second target identification model, identifying whether the user access request is an access request of a forged user;

[0229] In the case where it is identified that the user access request is an access request of a forged user, the user access request is marked as an access request of a forged user by a second preset identifier.

[0230] In one or more possible embodiments, the information processing device 180 provided in the embodiment of the present application may further include: a second division module, a second training module, and a second screening module; wherein:

[0231] A second division module, used to divide the log data according to the second preset sliding time window, to obtain second target log data of each second preset sliding time window in a plurality of second preset sliding time windows;

[0232] A second training module is used to train a second initial recognition model according to the second target log data of each second preset sliding time window according to a second preset training condition to obtain a second recognition model of each second preset sliding time window;

[0233] The second screening module is used to screen a second target recognition model that meets a second preset evaluation condition from multiple second recognition models.

[0234] In one or more possible embodiments, the information processing device 180 provided in the embodiment of the present application may further include: an acquisition module, a second switching module and a third identification module; wherein,

[0235] An acquisition module is used to obtain the delay of writing data into the log in the user access request;

[0236] A second switching module is used to switch from the historical user authentication module to the standby user authentication module when the delay is greater than or equal to the preset delay;

[0237] The third identification module is used to identify and mark whether the user access request is an access request of a forged user through the backup user verification module.

[0238] In one or more possible embodiments, the information processing device 180 provided in the embodiments of the present application may also include: a feedback module, which is used to feedback an access result corresponding to the user access request based on the access request of the forged user carrying a mark, and the access result includes: forged response data, information used to characterize that the user access request is an access request of a forged user, and information used to characterize that the user access request is intercepted.

[0239] Fig.19 FIG. 4 is a schematic diagram showing the hardware structure of a computer device according to an embodiment.

[0240] like Fig.19 As shown, the computer device 1900 includes an input device 1901 , an input interface 1902 , a processor 1903 , a memory 1904 , an output interface 1905 , and an output device 1906 .

[0241] The input interface 1902, the processor 1903, the memory 1904, and the output interface 1905 are interconnected via the bus 1910, and the input device 1901 and the output device 1906 are connected to the bus 1910 via the input interface 1902 and the output interface 1905, respectively, and are further connected to other components of the computer device 1900. Specifically, the input device 1901 receives input information from the outside, and transmits the input information to the processor 1903 via the input interface 1902; the processor 1903 processes the input information based on the computer executable instructions stored in the memory 1904 to generate output information, temporarily or permanently stores the output information in the memory 1904, and then transmits the output information to the output device 1906 via the output interface 1905; the output device 1906 outputs the output information to the outside of the computer device 1900 for use by the user.

[0242] In one embodiment, Fig.19 The computer device 1900 shown may be implemented as an information processing device, which may include: a memory configured to store a program; and a processor configured to run the program stored in the memory to execute the information processing method described in the above embodiment.

[0243] In one embodiment, the memory can also be used to store the consultation dialogue data and the Figures 1 to 10 The calculation results of each step in the described information processing process. As an example, the calculation results at least include: identifying the model, marking the access request of the forged user, etc.

[0244] According to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer-readable storage medium. For example, an embodiment of the present application includes a computer-readable storage medium, which includes storing a program or instruction on the computer-readable storage medium, and when the program or instruction is executed by a computer device, the computer device performs the steps of the above method.

[0245] According to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network, and / or installed from a removable storage medium.

[0246] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions, and when it is run on a computer, the computer executes the method described in each of the above embodiments. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instruction can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrations. The available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid-state drives), etc.

[0247] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0248] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. An information processing method, comprising: Obtaining a user access request, and determining whether there is an identification model corresponding to the user access request; In the case where it is determined that there is an identification model corresponding to the user access request, identifying and marking whether the user access request is an access request of a forged user through a historical user verification module; In the case that it is determined that there is no identification model corresponding to the user access request, the user access request is identified and marked by an initial user verification module as an access request of a forged user.

2. The method according to claim 1, wherein: The obtaining of the user access request and determining whether there is a recognition model corresponding to the user access request includes: Generate log data of the user access request according to the user access request, wherein the log data includes target request features; According to the target request feature, it is determined whether there is a recognition model corresponding to the user access request.

3. The method according to claim 2, wherein: The determining, according to the target request feature, whether there is a recognition model corresponding to the user access request includes: Matching the recognition model corresponding to the target request feature according to the preset association relationship between the request feature and the model; In the case where a recognition model corresponding to the target request feature is matched, determining that there is a recognition model corresponding to the user access request; When no recognition model corresponding to the target request feature is matched, it is determined that there is no recognition model corresponding to the user access request.

4. The method according to claim 2, wherein: The target request feature includes a request domain name; The identifying and marking whether the user access request is an access request of a forged user by the initial user verification module includes: According to the log data, training a first target recognition model corresponding to the request domain name through the initial user verification module; identifying, by means of the first target recognition model, whether the user access request is an access request of a forged user; In the case where it is identified that the user access request is an access request of a forged user, the user access request is marked as an access request of a forged user by a first preset identifier.

5. The method according to claim 4, wherein: The step of training a first target recognition model corresponding to the request domain name by the initial user verification module according to the log data includes: Dividing the log data according to the first preset sliding time window to obtain first target log data of each first preset sliding time window in a plurality of first preset sliding time windows; According to the first preset training condition, a first initial recognition model is trained according to the first target log data of each first preset sliding time window to obtain a first recognition model of each first preset sliding time window; From the plurality of first recognition models, a first target recognition model that meets a first preset evaluation condition is screened.

6. The method according to claim 4, wherein: The log data includes user access behavior data, and the behavior data includes at least one of the following: access sequence, access time, and interval time of access sequence; The identifying, by using the first target recognition model, whether the user access request is an access request of a forged user includes: Determine, by means of the first target recognition model, at least one of the following behavior data: whether the access sequence, the access time, and the interval time of the access sequence meet the preset behavior data; When at least one of the following behavior data: access sequence, access time, and interval time of access sequence meets preset behavior data, it is determined that the user access request is an access request of a forged user.

7. The method according to claim 6, wherein: The behavior data includes marked abnormal behavior data; the method further includes: Determine, according to the marked abnormal behavior data, a confrontation index of the first target recognition model trained by the initial user verification module, wherein the confrontation index is used to measure a probability value of failure of the first target recognition model; When the confrontation index is less than or equal to a preset confrontation index, the first target recognition model is updated by the initial user verification module based on the log data.

8. The method according to claim 1, wherein: The method further comprises: When the user access request identified and marked by the initial user verification module meets the preset conditions, the initial user verification module is switched to the historical user verification module, and the historical user verification module is used to identify and mark whether the user access request is an access request of a forged user.

9. The method according to claim 8, wherein: The preset condition includes that the first time duration of the user access request identified and marked by the initial user verification module is greater than or equal to a first preset time duration; Alternatively, the preset condition includes that the initial user verification module does not identify an access request from a fake user within a second preset time period.

10. The method according to claim 2, wherein: The target request feature includes a request domain name; The identifying and marking whether the user access request is an access request of a forged user by a historical user verification module includes: According to the log data, training a second target recognition model corresponding to the request domain name through the historical user verification module; According to the second target recognition model, identifying whether the user access request is an access request of a forged user; In the case where it is identified that the user access request is an access request of a forged user, the user access request is marked as an access request of a forged user by a second preset identifier.

11. The method according to claim 10, wherein: The step of training a second target recognition model corresponding to the request domain name by the historical user verification module according to the log data includes: Dividing the log data according to the second preset sliding time window to obtain second target log data for each second preset sliding time window in a plurality of second preset sliding time windows; According to the second preset training condition, a second initial recognition model is trained according to the second target log data of each second preset sliding time window to obtain a second recognition model of each second preset sliding time window; From the plurality of second recognition models, a second target recognition model that meets a second preset evaluation condition is screened.

12. The method according to claim 1, wherein: The method further comprises: Obtaining the time delay of writing data in the user access request into the log; When the delay is greater than or equal to the preset delay, switching from the historical user authentication module to the standby user authentication module; Through the standby user verification module, it is identified and marked whether the user access request is an access request of a forged user.

13. The method according to claim 1, wherein: The method further comprises: Based on the access request of the forged user carrying the mark, an access result corresponding to the user access request is fed back, and the access result includes: forged response data, information used to characterize that the user access request is an access request of the forged user, and information used to characterize that the user access request is intercepted.

14. An information processing device, comprising: A determination module, used to obtain a user access request and determine whether there is a recognition model corresponding to the user access request; A first identification module, configured to identify and mark whether the user access request is an access request of a forged user through a historical user verification module when it is determined that there is an identification model corresponding to the user access request; The second identification module is used to identify and mark whether the user access request is an access request of a forged user through the initial user verification module when it is determined that there is no identification model corresponding to the user access request.

15. A computer device comprising: Memory and processor, The memory is used to store a computer program; The processor is used to execute the computer program stored in the memory, and when the computer program is run, the processor executes the steps of the information processing method according to any one of claims 1 to 13.

16. A computer-readable storage medium storing a program or instruction, wherein when the program or instruction is executed by a computer device, the computer device executes the steps of the information processing method according to any one of claims 1 to 13.

17. A computer program product, comprising a computer program, which enables a computer device to execute the steps of the information processing method according to any one of claims 1 to 13 when the computer program is executed by the computer device.

Images